Added virtual patch for CVE-2026-63030 (wp2shell, also covers CVE-2026-60137)
A chain of vulnerabilities leading to remote code execution (RCE) have been found in WordPress and have been assigned CVE-2026-63030 and CVE-2026-60137, colloquially known as wp2shell. Fastly has created a virtual patch for it that is now available within your account. To activate it and add protection to your services, follow the steps for your control panel below.
Next-Gen WAF control panel
- Professional or Premier platform
- Essential platform
Log in to the Next-Gen WAF control panel.
From the Sites menu, select a site if you have more than one site.
- From the Rules menu, select Templated Rules.
- In the search bar, enter
CVE-2026-63030and then click View for the CVE-2026-63030 templated rule. - Click Configure and then Add trigger.
- Select the Block requests from an IP immediately if the CVE-2026-63030 signal is observed checkbox.
- Click Update rule.
Log in to the Next-Gen WAF control panel.
From the Sites menu, select a site if you have more than one site.
- Click the Signals tab.
- In the search bar, enter
CVE-2026-63030and then click View for the CVE-2026-63030 tag. - Click the Detections tab and then Add detection.
- Verify the switch is set to Enabled.
- Click Create detection.
- Click the Alerts tab and then Add alert.
- In the Status area, set the switch to Enabled.
- Click Save alert.
Fastly control panel
Log in to the Fastly control panel.
Go to Security > Next-Gen WAF > Workspaces.
- Click Virtual Patches.
- In the search bar, enter
CVE-2026-63030and then click the pencil to the right of the CVE-2026-63030 virtual patch. - From the Status menu, select Enabled.
- (Optional) If your workspace is in blocking mode, choose whether to Block requests or Log requests if the CVE-2026-63030 signal is observed.
- Click Update virtual patch.
Prior change: Connect your Fastly account to your Next-Gen WAF corp
Following change: Added virtual patch for CVE-2026-66066 (KindaRails2Shell)
