Non-Cooperative Defense and Impermissive Access

In mid-July the Internet ran a live-fire exercise on a question I keep circling back to, and I started writing this post while the logs were still warm. It's been sitting in drafts since, mostly because I wasn't sure it was finished. The White House just published the other half of it, so let's call it finished.

On July 17, Searchlight Cyber published wp2shell, a pre-authentication remote code execution chain against WordPress core: an unauthenticated request to the REST API's batch endpoint (CVE-2026-63030), escalated through a SQL injection (CVE-2026-60137) into remote code execution on a default install. Public exploit code surfaced almost immediately, mass scanning and webshells followed, and four days later both CVEs were on CISA's Known Exploited Vulnerabilities list. The fixed versions (6.9.5 and 7.0.2) were available while the mass exploitation was happening. The gap between "advisory published" and "weaponized at scale" closed in days.

What I said while it was happening

This #wp2shell bug/chain (*) is a pretty great example of why I pretty strongly believe that "non-cooperative defense" is a place we're all quite likely to end up. It's an awful and legally fraught solution, but it definitely feels like gravity is pulling in that direction for "break glass" Internet-scale trashfires.

* = The absolutely TINY time-to-exploitation; whatever comes next with regressive vulns, research clustering, and patch lag; and massive and easily weaponizable deployment base.

LinkedIn, July 20, 2026

I followed it up with the part that makes the whole thing concrete:

check my work on this, but if you own wordpress site that's vulnerable to #wp2shell, and have a working shell, with permission to modify the wordpress instance: ```bash find / -type f -name wp-config.php 2>/dev/null | while read -r cfg; do d=$(dirname "$cfg"); echo "updating $d"; (cd "$d" && wp core update --skip-plugins --skip-themes && wp core update-db --skip-plugins --skip-themes); done

X, July 20, 2026

The one-liner is the argument

That command I posted finds every WordPress install on a box and patches it, database migration included. The caveats in front of it ("if you own", "with permission") are doing enormous legal work, because the identical command, run from the identical shell by someone who wasn't given that permission, is a crime under the CFAA and its equivalents in most of the world. It is also, mechanically, the action that ends the incident.

That's the whole tension in two sentences. Non-cooperative defense means remediating a system you don't own, without the owner's consent, because the owner is absent, unreachable, or was never going to act inside the window that matters, and the blast radius of their inaction lands on everyone else.

I raised this back in April in Offense Scales with Compute. Defense Scales with Committees. as the debate almost nobody wants to have in public: whether a government can reach out and patch critical infrastructure without the owner's consent under wartime conditions. wp2shell is a civilian rehearsal of the same question.

Why I said gravity

I said gravity, not policy or preference, because (aside from these two) the inputs point the same direction:

• Time-to-exploitation keeps collapsing, and research clustering plus regression-prone patches mean the next one is already queued.
• Patch lag is not improving at anything close to the same rate. The lag is the attack surface.
• The deployment bases are enormous, often effectively unowned in practice, and easily weaponized.

When the defensive action that works is the one the law forbids, and the forbidden action keeps getting cheaper, more obvious, and more clearly effective, one of two things eventually happens: the law moves to accommodate a controlled version of it, or someone does it anyway and the precedent gets set by whoever moved first. Gravity doesn't ask for sign-off.

To be clear: I don't want this. I've spent thirteen-plus years building the cooperative version of exactly this machinery: bug bounty, coordinated disclosure, safe harbor. Cooperation remains the right default, and it works when there's someone on the other end of the line. Non-cooperative defense is what's left when there isn't. Pretending the category doesn't exist just guarantees that the first version we get is the improvised one.

It's a similar position to the one I have around Full Disclosure. I'm not a fan of it, but no-one really needs to be a fan of it, that's not really the point.

The glass has already been broken

The part of this conversation that usually gets missed: non-cooperative defense isn't hypothetical. Governments have been doing it, mostly under court supervision, for fifteen years, and the cadence is accelerating.

The cleanest example is the FBI's HAFNIUM web shell removal in April 2021. After the mass exploitation of on-prem Microsoft Exchange, the DOJ obtained a search-and-seizure warrant in the Southern District of Texas and the FBI issued commands through the web shells themselves to delete them from hundreds of victim-owned servers. No prior consent from the owners (they were notified afterwards). The operation was also surgically narrow: it removed each shell by its unique file path, and deliberately did not patch the underlying vulnerabilities or touch anything else on the box. A government remediated private systems without permission, and a court signed off on it.

It wasn't a one-off. It sits in the middle of a lineage:

• Coreflood (2011): the first time US law enforcement commandeered a botnet, running a substitute server that answered infected machines' beacons with a "stop" command. Malware on private machines, suspended by the government, under a civil TRO.
• Kelihos (2017): the first publicly known use of the Rule 41(b)(6) "botnet prong", the December 2016 procedural amendment that lets a single magistrate authorize remote access to computers spread across five or more districts. That amendment is the quiet hinge that makes most of the rest of this list scale.
• Retadup (2019): France's Gendarmerie, working with Avast, replaced the worm's C2 server with one that answered check-ins in a way that caused Retadup to self-delete from more than 850,000 machines. Authorized by a French prosecutor, not a court warrant.
• Emotet (2021): after the Europol-coordinated takedown, Germany's BKA pushed a law-enforcement-authored module through the seized infrastructure that uninstalled Emotet from victim machines on a timer.

Then the pace picks up. Cyclops Blink (2022): the FBI removed GRU malware from victim-owned WatchGuard firewalls and closed their external management ports. Operation MEDUSA (2023): the FBI's PERSEUS tool spoke the FSB's own protocol and told the Snake implant to overwrite itself. Qakbot (2023): an FBI uninstaller pushed to roughly 700,000 infected computers. The KV Botnet (2024): malware deleted from hundreds of end-of-life home routers being used to stage Volt Typhoon operations. Moobot (2024): the FBI deleted GRU tooling from Ubiquiti routers and changed their firewall rules on the way out. Flax Typhoon (2024): disabling commands sent to malware on more than 200,000 consumer devices. PlugX (2025): a French-led operation in which the FBI deleted malware from over 4,200 US computers. Once in 2011, roughly annual through the late 2010s, multiple operations a year now.

There are legislated versions too, for the flavors a warrant can't reach. Japan's NOTICE program (2019) carves an exception out of their unauthorized-access law so NICT can attempt default-credential logins against citizens' IoT devices at scale and flag the weak ones to their ISPs. Australia's SOCI Act Part 3A (2021) goes much further: in a serious enough incident, where the operator is unwilling or unable to respond, the government can direct ASD to access a critical infrastructure operator's systems and add, alter, or delete data directly. Ministerial authorization, not judicial. That is the exact "can a government reach out and patch without consent" question from April, already on the books in my home country, and (as far as the public record shows) never yet used.

On the improvised end, the one that last paragraph worries about: Hajime (2016) infected Mirai-vulnerable IoT devices purely to close their ports, its author signing off as "just a white hat, securing some systems", and BrickerBot (2017) simply destroyed insecure devices outright, its author calling it "Internet Chemotherapy". Nobody authorized either one. That's what the improvised version looks like, and it showed up years before most people noticed the category existed.

Here's what the whole precedent stack has in common, though, and it matters for where this goes next: almost every one of these is post-compromise removal, executed through the attacker's own implant, scoped to the malware and nothing else. HAFNIUM deleted web shells and explicitly left the vulnerable Exchange servers unpatched. What no government has done publicly is the wp2shell case: non-cooperatively patching systems that are merely vulnerable, ahead of or during mass exploitation. Removal has fifteen years of precedent and a procedural rule built for it. Repair has none. The gravity I'm describing is pulling us across that line.

The line just moved

While this post sat in drafts, the prediction in the middle of it came partially true.

On August 12 the White House published a presidential memorandum, Expanding Capabilities to Combat Transnational Cyber-Enabled Crime, building on the March 2026 cybercrime executive order. It stands up a program that lets vetted private US companies ("Participating Companies", in the memo's language) run cyber operations against foreign cyber-enabled transnational criminal organizations, under the direction and oversight of the federal government, and it is not a defensive-only arrangement: the memo defines both "Cyber Surveillance Operations" and "Cyber Effects Operations", and the effects category runs all the way through "manipulation, disruption, denial, degradation, or destruction" of the target's systems.

The mechanics matter, because the shorthand ("hack-back is legal now") gets them wrong.

Nobody freelances under this. A company gets vetted in, signs a contract with DOJ or DHS, can be made to post a million-dollar bond it forfeits if it steps out of line, and doesn't touch a target until two co-directors, one from each department, sign off on that specific operation in writing. There's a ceiling those two can't approve past: anything likely to get someone killed or badly hurt, or to tip over into use-of-force under international law. Wander onto a US person or a US-based system by accident and the company has to stop, clean up, and report it. The intelligence runs both ways too, with companies pulling threat information from their commercial customers and from government at every level and pitching operations back up the chain. The chain, for what it's worth, runs through the National Coordination Center, which is the office the January 2025 immigration order stood up, which is its own kind of interesting.

The definition of Cyber Surveillance Operations is the part I keep re-reading. It covers accessing systems "without authorization from the owner or operator or by exceeding authorized access", with the intent to remain undetected. That's the CFAA's own language, the exact words that make my WordPress one-liner up top a crime, quoted back as the thing being licensed. The legal squaring happens in a single clause: the program operates in accordance with 18 U.S.C. 1030 because participating companies act "under the control and oversight of the United States Government." The conduct itself doesn't change, just whose flag it's flying under.

The industry has kicked the "cyber letters of marque" idea around for at least a decade, mostly as a thought experiment that reliably ended with everyone agreeing it was a terrible idea. As of this week it's a memorandum with an org chart and a 60-day deadline for operating procedures.

Read against the gravity argument, this is the law moving to accommodate a controlled version, and it showed up faster than I expected. It even answers most of the break-glass questions this post was originally going to end by handing out as homework: who decides, at what line, with what scope, with what accountability. Whether those are good answers is a different conversation. The oversight lives entirely inside the executive branch, with no standing judicial step for foreign targets, just a DOJ review for the cases that touch US persons or otherwise trip a constitutional or legal wire, and a judge in the loop where one is required. The definitions also quietly assume a foreign group isn't state-directed unless "clear intelligence exists" saying otherwise, and that assumption is doing a lot of work in a world where telling criminal crews apart from state cutouts is most of the actual problem.

What this isn't is the wp2shell case. The program points outward, at criminal infrastructure. Nothing in it authorizes anyone to non-cooperatively patch a victim's vulnerable system, which is the part of this problem that mass exploitation actually presents. Removal has fifteen years of precedent, offense now has a program, and repair still has nothing.

Break glass before the fire

If we're headed there anyway, and I think we are, the useful work is designing the break-glass rules before the fire: who holds the authority, past what threshold, with what scope, what logging, what liability, and what accountability when it goes wrong. Those are answerable questions. I would have told you they take years to answer well. The memo answered its version of them in a season, which cuts both ways: careful design is apparently not the constraint I assumed, and the version that gets built first is the version whoever moves first wants. The offensive side is spoken for. The repair side, the one wp2shell keeps rehearsing, is still up for grabs, and I'd much rather see that one designed in the open than have it arrive by memorandum too. No promises that's how it goes, but it seemed worth writing down while the ink is still wet.