Censys (@censysio) header
Censys (@censysio) profile picture

Censys

@censysio

The Intelligence for AI-Powered Security. Real-time defense requires real-time intelligence and visibility.

 Ann Arbor, MI
censys.com
Joined September 2015
  • Tweets2.7K
  • Following1.5K
  • Followers13K
1.1KMedia
Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)
🚨 Censys is closely tracking PHP2Shell exposure and remediation worldwide. Our live dashboard tracks affected PHP versions and patching progress by country, network, and PHP version. View the live dashboard: php2shell.censys.com
Image from Censys (@censysio)
8
27
5
98
11,203
🚨 Rapid Response: A critical Gravity Forms vulnerability (CVE-2026-103039, CVSS 9.8) could lead to remote code execution under specific conditions. Censys identified 83,800 web properties running Gravity Forms. Read the full advisory for additional details and queries:bit.ly/4zmbKBB
A Censys world map on a dashboard displaying "Countries by Host Count" using varying shades of orange and grey. The United States has the highest count with 667 hosts, highlighted in a dark orange. Other countries with notable host counts include Australia, Canada, Germany, United Kingdom, France, Singapore, Ireland, and Netherlands. The sidebar on the right lists the countries with their respective host counts. The map and list are part of a Censys interface.

ALT A Censys world map on a dashboard displaying "Countries by Host Count" using varying shades of orange and grey. The United States has the highest count with 667 hosts, highlighted in a dark orange. Other countries with notable host counts include Australia, Canada, Germany, United Kingdom, France, Singapore, Ireland, and Netherlands. The sidebar on the right lists the countries with their respective host counts. The map and list are part of a Censys interface.

104
🚨 Rapid Response: Seven vulnerabilities in Progress WS_FTP Server, including a critical authentication bypass (CVE-2026-84295, CVSS 10.0), could expose administrative credentials and allow further server compromise. Censys ARC identified ~2,500 Internet-exposed WS_FTP Server hosts. Read the full advisory for additional details and queries: censys.com/advisory/cve-2026… #CensysARC
Censys world map showing host counts by country. The United States has 1,503 hosts, followed by Germany with 159 hosts, and Canada with 106 hosts. Other countries include United Kingdom, Italy, Netherlands, India, France, and China. A key indicates varying densities of hosts. Censys logo is displayed.

ALT Censys world map showing host counts by country. The United States has 1,503 hosts, followed by Germany with 159 hosts, and Canada with 106 hosts. Other countries include United Kingdom, Italy, Netherlands, India, France, and China. A key indicates varying densities of hosts. Censys logo is displayed.

1
1
4
527
In this clip from our latest podcast @silascutler of @censysio talks about what #php2shell attacks exploiting newly disclosed flaws might look like from the targeted organization’s POV. #mustwatch. Check out the full interview here: securityledger.com/2026/10/s…
1
2
2
269
Industrial control systems exposure isn't improving. Censys ARC found a 4% increase globally over 2 1/2 years, with the U.S. accounting for 32% of exposures. Censys Principal Security Researcher Emily Austin explains the findings. Download the report: bit.ly/4iuKwCs #CensysARC #CensysSOTIR
2
3
385
Why do PHP exposure counts disagree? It depends on what gets scanned and counted. Censys scans all 65,535 ports, first-party, every day, and fingerprints each open port down to protocol and service. See how to go from global numbers to your own assets. bit.ly/4e9JTvQ
Dashboard showing PHP2Shell services data. Displayed are various metrics, including exposed services, total affected hosts, and countries affected. A gauge indicates 45 million vulnerable services globally. Graphs depict live scanner data over the past 24 hours. Entities listed include Censys and ARC.

ALT Dashboard showing PHP2Shell services data. Displayed are various metrics, including exposed services, total affected hosts, and countries affected. A gauge indicates 45 million vulnerable services globally. Graphs depict live scanner data over the past 24 hours. Entities listed include Censys and ARC.

7
411
🚨 Rapid Response: Critical Drupal RCE (CVE-2026-108097) Censys identified ~1.47M web properties running Drupal. Exploitation requires additional code. A single host can have multiple hostnames and ports, which is why web property counts are higher. Patches are available. bit.ly/4kmA9lA
A Censys world map shows the distribution of hosts by country, with darker shades indicating more hosts. The top countries listed with host counts are: United States (18,433), Germany (1,024), France (1,094), United Kingdom (754), China (748), Ireland (561), India (507), Canada (329), and Singapore (292). The map legend indicates host density.

ALT A Censys world map shows the distribution of hosts by country, with darker shades indicating more hosts. The top countries listed with host counts are: United States (18,433), Germany (1,024), France (1,094), United Kingdom (754), China (748), Ireland (561), India (507), Canada (329), and Singapore (292). The map legend indicates host density.

10
29
2,212
In this clip from the latest @securityledger podcast, @silascutler goes over the numbers from @censysio php2shell.censys.com which tracks the tens of millions of devices vulnerable to #php2shell. Full article here: securityledger.com/2026/10/s…
Censys PHP2Shell Exposure Tracker

Censys PHP2Shell Exposure Tracker

Track Internet-wide PHP2Shell exposure and patching progress with hourly data from Censys.

php2shell.censys.com
securityledger (@securityledger) profile picturesecurityledger
@securityledgerOct 29
In our latest Security Ledger podcast, host @paulfroberts interviews @silascutler of @censysio on both the #php2shell attacks and the hack of refrigeration control systems in France earlier this mont (and - maybe - on U.S. military bases back in August?!). Check out the full post here: securityledger.com/2026/10/s…
1
2
173
In its October 28 advisory, Censys reported 2,246 web properties running EBS. “An Internet-facing instance that was unpatched should be reviewed for the indicators of compromise,” Censys advised. Via @helpnetsecurity
Help Net Security (@helpnetsecurity) profile pictureHelp Net Security@helpnetsecurityOct 29
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com/2026/10/… - @DefusedCyber @Horizon3ai @censysio - #Oracle #CVE #vulnerability #SQLInjection #Cybersecurity #CyberSecurityNews #SecurityNews
Image from Help Net Security (@helpnetsecurity)
1
516
🚨 Rapid Response: CVE-2026-101767 (CVSS 9.8) could allow unauthenticated takeover of Oracle E-Business Suite. Censys identified 2,246 exposed web properties. Exposure does not confirm vulnerability. Patch and investigate: bit.ly/4yRfrOy #CensysARC
Censys world map showing host distribution by country. The United States has the most with 147 hosts, followed by China with 76, and several other countries with fewer hosts. A legend indicates host count using shades of orange. A list on the right provides a detailed count for the top ten countries.

ALT Censys world map showing host distribution by country. The United States has the most with 147 hosts, followed by China with 76, and several other countries with fewer hosts. A legend indicates host count using shades of orange. A list on the right provides a detailed count for the top ten countries.

2
8
37
2,356
Censys CLI skills let AI coding assistants turn plain-English requests into Censys queries to search, pivot, and investigate Internet infrastructure. Learn how it works on our blog: bit.ly/4iM4wkT Get the skills: github.com/censys/censys-ai-…
1
2
10
862
A critical vulnerability alert is only the beginning. What happens next matters just as much. With @censysio, security teams can gain greater visibility into their external attack surface and identify systems that warrant further investigation. Our latest blog explores how organizations can move from discovery to action in response to newly disclosed critical PHP vulnerabilities. Read more: hubs.ly/Q04CtLNp0 #Cybersecurity #PHP
2
3
159
Censys Investigator, our agentic framework, now has an API. Feed it IPs, domains, or threat intel reports from your scripts, SOAR, or AI agents to uncover related attacker infrastructure. See how it works: bit.ly/4exLnQy
Censys AI Agents: Automate Investigations and Amplify Your Threat Intel - Censys

Censys AI Agents: Automate Investigations and Amplify Your Threat Intel - Censys

Learn how Censys Investigator works, example use cases, and how you can use it to build repeatable workflows in your environment.

censys.com
4
23
1,208
The Video That Plays You: Fake MP4 File Carries Malicious Payload. Read the blog by @censysio, a Health-ISAC Community Services Champion. health-isac.org/the-video-th…
Image from Health-ISAC (@HealthISAC)
1
1
170
In a recent @Reuters article on staying safe online as AI accelerates cyber threats, Censys Principal Security Researcher @emailyee discusses the basic steps everyone should take to help protect themselves.
Reuters (@Reuters) profile pictureReuters
@ReutersOct 23
Five ways to keep safe online in the wake of AI-supercharged hacking reut.rs/4kdEF5T reut.rs/4kdEF5T
Five ways to keep safe online in the wake of AI-supercharged hacking

ALT Five ways to keep safe online in the wake of AI-supercharged hacking

2
1
4
692
Missed our special edition of Censys ARC Flash? The recording is now available on-demand. Watch the recording for our findings and guidance, including a demo of how to use Censys to identify potentially exposed PHP infrastructure. Watch On-Demand: bit.ly/48dfOIe Get a personalized report to help your team find Internet-facing PHP services and investigate potentially vulnerable assets: bit.ly/3WNIUvb
This image is a promotional graphic for an "ARC Flash PHP2Shell Briefing." It features five people in video call frames, labeled as Fauna Tucker, Lisa Mauck, Matthew Guidryy, Michael Schwartz, and Silas Cutler. The ARC logo is displayed prominently. At the bottom, there is a button that reads, “Watch On-Demand.”

ALT This image is a promotional graphic for an "ARC Flash PHP2Shell Briefing." It features five people in video call frames, labeled as Fauna Tucker, Lisa Mauck, Matthew Guidryy, Michael Schwartz, and Silas Cutler. The ARC logo is displayed prominently. At the bottom, there is a button that reads, “Watch On-Demand.”

1
2
454
Censys and @torq_io now give your AI SOC first-party Internet context at every stage of a case: triage, detection, investigation, and response. Read the joint solution brief: bit.ly/3W99Pl1
390
AI Security’s Fight Night LIVE on YouTube from @unpromptedconf ! AI Hacker Jeopardy and debates, Wed October 28, 6:10PM PT! Hit ‘NOTIFY ME' here: youtube.com/live/7kD--XEKrQ0 Your fight card: - @EppSecurity, creator of the Zero Day Clock, and @jeremiahg, founder of WhiteHat Security and CEO of @rootevidence - Tim Brown (CISO-in-Residence, @team8group; former @SolarWinds CISO) and @gadievron (CEO, @knosticai; Chair, [un]prompted) - @k8em0 (Founder & CEO, @LutaSecurity) vs. @raistolo (Full Professor, @polimi) Debates shepherded by Stephen Llano, Ph.D. (@StJohnsU). And - AI HACKER JEOPARDY with @g_mark! Want to play? email [email protected]: team name, 3 player names, cell number. Pls SHARE with your community. [un]prompted II, the AI Security Practitioner Conference, October 27–29 at the Hibernia in San Francisco or online: unpromptedcon.org Thank you to our Sponsors: @knosticai, TachTech, @censysio, @Ent_Security, @WorkOS, @DecibelVC, Whiterabbit, @zenitysec, @runsybil, @AISLE_Inc Thank you to our Community Partners: @SANSInstitute, @cloudsa, @OneRSAC, @FIRSTdotOrg. @jaybeale @jonsakoda @WHITEHACKSEC @robtlee @joesu11ivan
Image from unprompted (@unpromptedconf)
12
3
18
2,793
We've just added a drop down filter on the globe to make it easy to see country level impact
20
1
183
Our PHP2Shell Response Hub includes: 🔹 Live exposure and patching dashboard 🔹Updated Censys ARC advisory 🔹Option to request a custom report We'll continue updating as new findings emerge. bit.ly/3UDHpiC
Image from Censys (@censysio)
1
474
🚨 Rapid Response: CVE-2026-110264 (CVSS 10.0) allows unauthenticated RCE in GitLab. On the day of disclosure, Censys observed roughly 82,000 hosts and about 209,000 web properties running GitLab. Full advisory and Censys queries: bit.ly/4epIFwo
Image from Censys (@censysio)
1
12
27
2,211
Load more