24 casos · pág. 1/2
GreyNoise observed automated scanners impersonating the web crawlers of OpenAI, Anthropic, Google, Perplexity, DeepSeek and Amazon while requesting environment files, cloud access keys, private keys and password stores. A cluster of 13 forged AI crawler names from eight companies was seen; six names (belonging to Anthropic, OpenAI, Google…
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-25 based on evidence of active exploitation: CVE-2026-87902, a remote file inclusion flaw in WordPress Core. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterp…
Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltere…
Researchers at Hacktron (author ginoah) described five bypasses of the Vercel WAF rules protecting against React2Shell (CVE-2025-55182), a pre-auth RCE in React Server Functions affecting Next.js 15.x–16.0.6 and other React-based frameworks. The bypasses were found during a Vercel bounty challenge. Per Vercel's writeup, 116 researchers to…
Hacktron analyzes wp2shell, an unauthenticated RCE chain in WordPress core found by Searchlight Cyber. It combines CVE-2026-63030, a route handler confusion in the REST API batch endpoint, with CVE-2026-60137, an SQL injection in WPQuery. Affected versions are WordPress 6.9.0-6.9.4, 7.0.0-7.0.1 and the 7.1 beta, fixed in 6.9.5, 7.0.2 and …
F5 Labs analyzed exploitation of CVE-2026-24423, a CVSS 9.8 unauthenticated remote code execution flaw in SmarterTools SmarterMail (CWE-306). CISA added it to the KEV catalog on February 2, 2026 and notes it has been used in ransomware campaigns. Despite public write-ups, F5 sensors saw only one IP, 193.24.123.58 (ASN 200593, Russian ISP …
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…
F5 Labs, using attack telemetry from Efflux's global sensor network, analyzed the most exploited vulnerabilities in July 2025 and found that nearly all top-scanned CVEs are HTTP-based RCE or command injection flaws in web interfaces. CVE-2017-9841 (PHPUnit) was the most exploited, followed by CVE-2023-1389 (TP-Link Archer AX21), CVE-2022-…
F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…
F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …
F5 Labs, using Efflux sensor telemetry, reports that CVE-2023-1389, an RCE in TP-Link Archer AX21 routers, was the most scanned-for CVE in December 2024 for the fifth consecutive month, with traffic far above any other tracked CVE. Other heavily scanned flaws include CVE-2022-24847 (GeoServer), CVE-2022-22947 (Spring Cloud Gateway), CVE-2…
CVE-2026-9082 is a critical (CVSS 9.8) pre-authentication SQL injection in the JSON:API module of Drupal Core. It was published on May 20, 2026 and added to the CISA KEV catalog the same month, with a remediation deadline of May 27. F5 sensors recorded 576 exploitation attempts from 9 source IPs between May 20 and May 31, 2026. The earlie…
F5 Labs, using attack telemetry from Efflux sensors, reports that CVE-2017-9841 (PHPUnit eval-stdin.php RCE) remained the most targeted vulnerability in May 2025 with over 54,000 instances. CVE-2020-8958 (Guangzhou ONU command injection RCE) shows near-exponential targeting growth for a third consecutive month. CVE-2024-3721 (TBK DVR OS c…
F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
FortiGuard Labs describes Evooo1Bot, a Linux botnet that embeds the Mirai DDoS engine in a more modular and capable framework. It uses encrypted C2 communications, layered string obfuscation (AES-256-CTR, ChaCha20, XOR-based key derivation) and a 28-command remote administration interface. It also ships an integrated exploit arsenal again…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
AI pen-testing startup Terra Security reports a sharp rise in security fixes later found to be bypassed or incomplete. The share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days held near 0.2% from 2019 to 2025 but jumped to 2.3% in 2026. Terra links the trend to the 2026 explosion in AI-driven vulne…
