A blog comment can now zero-click hijack a WordPress admin session and drop a self-deleting PHP webshell. https://intel.threadlinqs.com/threat/TL-2026-2717 #ThreatIntel #CVE_2026_93485 #Comment2Shell #Comment2XSS