RESEARCH — PUBLISHED AS WE CAPTURE ITUPDATED 2026-09-03
Field notes from the fleet
Threat breakdowns, vulnerability analysis, and what our honeypots are catching — written for the small teams defending the places that matter most.
RESEARCH SPOTLIGHTFEATURED2026-08-02 · 138,809 commands attributed · 60 netblocks whois’d
The Inside Is Not a Safe Place Anymore: Implicit Trust, Flat Networks, and Cheap Decoys
An academic team used AI agents to find 84 flaws in 4G and 5G cores, 81 now carrying CVEs, and almost all of them trace to one habit: internal components trusting each other without checking. We ran our own cellular-gateway decoys in three postures to test the same idea, then attributed the industrial traffic properly — and found that 82.4% of every industrial-protocol command our fleet has ever recorded comes from two commercial scanning vendors.
Read the analysis →82.4% of industrial-protocol commands are commercial scanning
1,347 distinct sources resolved
0 writes, controls or restarts in four months
FLEET TELEMETRY2026-09-04After the login: what bots sent to a fake FortiGateAcross 53,509 sessions, a FortiGate-persona decoy captured 44 command sessions. Seventeen sessions from eight sources resubmitted the same Linux profiling sequence unchanged, alongside GPU checks, password guessing, and an SSH-first loader.Read →ACTIVE EXPLOITATION2026-09-03SMA1000 is being exploited again. Third time in nine months.SonicWall confirms active exploitation of two new SMA1000 flaws. CISA added both to KEV with a September 5 deadline. The builds that fixed July are affected again, and Rapid7 assesses the flaws can potentially be chained to unauthenticated remote code execution.Read →VULNERABILITY2026-08-26A public PoC changes the priority, not the evidence: CVE-2026-41551Siemens documents unauthenticated arbitrary file read and write in the ROS# file_server service, rated CVSS v4.0 9.3. The fix shipped in April; a public read PoC appeared 25 August. Not in CISA KEV.Read →VULNERABILITY2026-08-14The Overflow That Owns the Gateway: CVE-2026-8452Citrix disclosed this NetScaler flaw in late June and called it a crash. On August 14 a working proof of concept turned the same SAML signature bug into unauthenticated remote code execution as root, with persistence. There is no workaround and no confirmed in-the-wild use of this CVE yet, but the sibling flaw from the same bulletin was exploited within 24 hours, and it was caught on decoy infrastructure.Read →ACTIVE EXPLOITATION2026-08-12The Request That Reboots the Firewall: CVE-2026-20349An actively exploited, unauthenticated denial of service in the Remote Access SSL VPN of Cisco ASA and FTD. One crafted HTTP request reloads the firewall, taking the perimeter, the remote access, and the box's own logs down together. Industrials are the top exposed sector, roughly 19,200 instances face the internet, and the federal deadline is August 14.Read →ACTIVE EXPLOITATION2026-08-09Public Exploit Code Is Now Circulating for a Root-Level Palo Alto Firewall Bug: CVE-2026-0300CVE-2026-0300 gives unauthenticated code execution as root on PA-Series and VM-Series firewalls where the User-ID Authentication Portal is exposed. Disclosed and patched in May, but this week the public exploit tooling matured into a documented exploit with a payload generator and a packaged scanner. We add what our firewall and VPN decoys actually see: roughly 8,000 source IPs, about 2,000 of them research scanners we set aside, and the default credential still being sprayed.Read →ACTIVE EXPLOITATION2026-08-04The Public Exploit Has Landed on a VPN Gateway a Ransomware Crew Already Owns: CVE-2026-15409 and CVE-2026-15410Three weeks after two chained SonicWall SMA 1000 zero-days hit CISA KEV, the two things responders feared most both arrived: a public proof of concept on August 3, and a KEV ransomware flag on August 4, with INC Ransomware named the dominant operator. An update to our July 15 coverage — and because the operators steal credentials, sessions, and MFA seeds, patching alone does not evict them.Read →FLEET TELEMETRY2026-07-27One Source, Twenty Decoys: the IT/OT divide is an org chartOne automated source touched our fake Linux servers, our fake hospital, and our fake water plant in a single sweep, speaking SSH and Modbus alike. To the machines scanning the internet, there is no line between IT and OT. Part 1 of 2.Read →ACTIVE EXPLOITATION2026-07-30A Shipped-In Password on the Box That Runs the Firewalls: CVE-2026-20316Cisco Secure Firewall Management Center shipped with a static login for a low-privileged account, and an unauthenticated attacker can read sensitive data straight off the appliance. Exploited as a zero-day, on CISA KEV with an August 1 federal deadline, and it governs the firewalls that separate IT from the plant floor.Read →ACTIVE EXPLOITATION2026-07-28The Orchestrator Was Never Supposed to Face the Internet: CVE-2026-16812A perfect-10 command injection flaw in Arista's on-premises VeloCloud Orchestrator lets an unauthenticated attacker run commands on the box that manages an entire SD-WAN fabric. Exploited as a zero-day, on CISA KEV with a three-day clock, and sitting exactly where SD-WAN carries traffic into operational networks.Read →FLEET TELEMETRY2026-07-27The Same Scanners Phone Home: what a compromised Redis pool does and does not tell youWe took the scanners that crossed our IT and OT decoys and pivoted them through Shodan. They led us to a population of genuinely compromised Redis and ZooKeeper servers — and to a hard limit on what a client list can tell you about who runs them. Part 2 of 2.Read →ACTIVE EXPLOITATION2026-07-26One Packet to the Edge: CVE-2025-9242 in WatchGuard FireboxA single crafted VPN packet gives an unauthenticated attacker code execution on a WatchGuard Firebox, the firewall at the edge of tens of thousands of small offices and remote sites. Actively exploited, on CISA KEV, 75,000+ exposed, and a fresh public exploit-plus-scanner just widened the pool of who can hit it.Read →FLEET TELEMETRY2026-07-22The 52-Command Playbook: how a botnet sizes you up before it strikesA 52-command reconnaissance playbook ran 886 times, byte-for-byte identical, from a small botnet, resolving CPU architecture, checking for a GPU, and writing a test script to confirm the shell is real. That last step is anti-honeypot detection, and we take the whole thing apart.Read →ACTIVE EXPLOITATION2026-07-22A Token to the Top of the Trust Chain: CVE-2026-16232 in Check Point SmartConsoleAn unauthenticated attacker lifts a login token and takes full administrative control of a Check Point management server, the box that writes firewall policy for every gateway beneath it. Exploited in the wild, added to CISA KEV with a three-day deadline, and dangerous exactly where a firewall enforces the IT-to-OT boundary.Read →ACTIVE EXPLOITATION2026-07-21An Old Router Bug, Newly Exploited: CVE-2021-27137 in DD-WRT and the C0XMO BotnetA five-year-old UPnP buffer overflow in DD-WRT router firmware is being used to spread the C0XMO botnet, and CISA just added it to the Known Exploited Vulnerabilities catalog. One unauthenticated packet to UDP 1900 crashes the router or runs code on it, on the edge gear that sits between the internet and everything behind it.Read →VULNERABILITY2026-07-19Brute-forcing the Ground Station: CVE-2026-44595 & CVE-2026-44596 in YamcsTwo medium-severity flaws in Yamcs, the open-source mission-control platform that flies real spacecraft: a missing authorization check enumerates every admin, and a login endpoint with no rate limit invites brute force. Chained, they point from any low-privilege account toward operator access on a spacecraft ground station. Not in KEV — but public PoCs exist, and un-throttled brute force is the single most common behavior our sensors see.Read →ACTIVE EXPLOITATION2026-07-17When the sandbox that judges your files gets taken over: CVE-2026-39808 & CVE-2026-25089Two Fortinet FortiSandbox command injection flaws on CISA KEV (July 16). An unauthenticated attacker runs commands as root on the appliance a network trusts to decide which files are safe — and every downstream firewall and mail gateway keeps trusting its verdicts.Read →VULNERABILITY2026-07-16CVE-2023-4346: a lockout with no key on the KNX busCISA added a three-year-old KNX flaw to KEV after confirmed exploitation. An attacker who reaches the building-automation bus can purge a building’s controllers and set a BCU key no operator can remove — an availability attack on the OT that runs hospitals, data centers, and plants.Read →ACTIVE EXPLOITATION2026-07-15Two zero-days on the SonicWall SMA front door: CVE-2026-15409 and CVE-2026-15410Two SonicWall SMA 1000 zero-days chained from an unauthenticated request-forgery bug to admin command execution, added to CISA KEV on July 14. The SSL VPN gateway that fronts OT and critical infrastructure, taken over, and the vendor says patching alone is not enough.Read →FLEET TELEMETRY2026-07-15The Week the Noise Quadrupled: a fleet-wide attack surgeOn July 6, 2026, distinct attackers jumped almost fivefold and stayed there — broad scanners that swept the fleet, and single-target floods that hammered one node tens of thousands of times. The data behind the surge, with an honest read on what it proves.Read →
VULNERABILITY2026-07-12One crafted packet, and the cameras go dark: CVE-2026-29116An unauthenticated, remote denial-of-service flaw across a broad range of Dahua surveillance gear. One crafted packet trips a fatal assertion and reboots the device; a fresh public PoC made it low-effort and automatable.Read →VULNERABILITY2026-07-14CVE-2008-4128: an 18-year-old Cisco router flaw returns to the exploited listA 2008 cross-site request forgery bug in Cisco IOS web management, added to CISA KEV on July 13, 2026 with a three-day BOD 26-04 deadline. Not pre-auth — but the exposure it rides, an internet-facing router console on long-lived edge gear, is exactly what our decoys watch.Read →VULNERABILITY2026-07-11CVE-2025-22457: a fresh PoC reopens the Ivanti front doorA pre-auth, unauthenticated RCE in Ivanti Connect Secure — the VPN appliance that fronts remote access into hospitals, utilities, and plant networks. An old, nation-state-exploited flaw whose fresh public exploit just lowered the bar to abuse.Read →VULNERABILITY2026-07-09CVE-2026-11405: a hidden password that lets anyone into the routerSeveral Tenda router firmware builds ship with an undocumented second password that hands full admin to any username. No patch, vendor unreachable, public PoC circulating.Read →VULNERABILITY2026-07-08CVE-2026-8451: CitrixBleed comes back to the NetScaler front doorA pre-authentication memory overread in NetScaler appliances configured as SAML identity providers — a malformed login makes the box leak fragments of its own memory. Already under active exploitation on the appliances that front remote access into hospitals, utilities, and plant networks.Read →VULNERABILITY2026-07-05CVE-2026-13768: one hard-coded cloud key, an entire fleet of gardensA hard-coded, owner-level Azure IoT Hub key shipped on every Gardyn indoor garden: one extracted key enumerates the whole device fleet, runs commands on any unit, and pivots onto the owner’s home network. CISA rated it a perfect 10.0.Read →RESEARCH2026-07-01We went looking for AI attackers in our honeypotsAnthropic mapped how attackers use AI. We run honeypots and watched the same adversaries from the other side — out of 8,887 attackers, eight looked like AI, with a clear machine-speed fingerprint.Read →ACTIVE EXPLOITATION2026-06-30CVE-2026-48558: a forged token, a trusted technician, an entire fleetA critical, actively exploited authentication bypass in SimpleHelp RMM: with OIDC enabled, the server never verifies the login token signature, so a forged token becomes full technician access to every managed endpoint. On CISA KEV, ~14,000 servers exposed.Read →
View All & Historical Research →
Every post we’ve published, newest first.