/
attack_type:scanning × criticity:medium × limpar

Resultados

6 casos · pág. 1/1

greynoise.io · medium

GreyNoise Reports 597,000-Session Spike in SonicWall SonicOS API Scanning, Echoing Pattern Before CVE-2026-0400

Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 an…

greynoise.io · medium

GreyNoise: 242,666 Unverified Hong Kong Scanning IPs Surge in a Week While UCLOUD (AS135377) Drives Real Multi-Protocol Scanning

Between March 12 and 18, 2026, the GreyNoise Observation Grid (GOG) recorded 242,666 new scanning IPs geolocating to Hong Kong, 48.9% of all new scanning IPs seen that week. 99.7% never completed a TCP handshake, so GreyNoise classes them as "spoofable" (unverified source addresses). They carried no payloads and triggered no signatures. G…

f5.com · exploit público medium

Scanner from HOSTGLOBAL.PLUS (UK) probes 130 URLs for exposed .env files using 12,000+ rotating User-Agents; August 2025 CVE trends

F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …

f5.com · exploit público medium

Azure-hosted cluster scans for planted WordPress webshells tied to CVE-2018-14028, per F5 Honeynet March 2026 data

F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…

f5.com · exploit público medium

F5 Labs June 2026: Honeynet attacks up 55.5%; LiteSpeed Cache CVE-2024-44000 debug.log scanning surges alongside Exchange and PHP exploits

F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…