Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!
Global
Joined March 2009
- Tweets2.4K
- Following0
- Followers22.1K
- Likes328
Pinned Tweet
Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API?
We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash.
Check it out at github.com/The-Shadowserver-…
PHP Attacks Update: As others, we have been observing a lot of AI slop PHP attempts against our honeypot sensors the last week, but so far no confirmed exploitation.
We have refrained from CVE-2026-109618/619 tagging in scans, due to lack of reliable, safe large scale methods.
Instead we have opted for reporting out End of Life instances, which is hopefully the more actionable approach at this stage. We added 'eol-php' to the Vulnerable HTTP reporting. Tagging is based on: endoflife.date/php (anything older than 8.2)
You can track unique IPs (not hostnames) running EOL PHP at dashboard.shadowserver.org/s…
Make sure to update those systems!
Copeland/Dixwell XWEB refrigeration web controller incidents: As in the case of Danfoss, for a long time we have been sharing exposed Copeland XWEB Pro & Evo panels in Device ID reporting. We see around 1200 instances daily - these should of course not be publicly accessible.
Data shared in shadowserver.org/what-we-do/…
World Map view:
dashboard.shadowserver.org/s…
Tree Map view:
dashboard.shadowserver.org/s…
Exposure tracker: dashboard.shadowserver.org/s…
See also @CERT_FR cert.cyber.gouv.fr/alerte/CE…
Additional info: claroty.com/team82/research/…
Danfoss refrigeration incidents: We are sharing exposed instances for a long time in our Device ID reporting, daily. For Danfoss AK-SM800A we still see at least 365 unique instances daily (drop from over 550 last few days) exposed. These need to be taken off the public Internet!
Data shared in shadowserver.org/what-we-do/…
World Map view: dashboard.shadowserver.org/s…
Tree map view: dashboard.shadowserver.org/s…
Exposure tracker:
dashboard.shadowserver.org/s…
Background: claroty.com/team82/research/…
We are working on possible CVE tagging too
We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): shadowserver.org/what-we-do/…
Around 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA.
Tree map stats: dashboard.shadowserver.org/s…
These should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 nvd.nist.gov/vuln/detail/cve…
You can find all our MikroTik detections in Device ID report shadowserver.org/what-we-do/… (around 3M daily): dashboard.shadowserver.org/s…
For MikroTik with SSH enabled, check out our Accessible SSH reporting (shadowserver.org/what-we-do/…), with the tag 'mikrotik' dashboard.shadowserver.org/s… - just over 119K seen daily currently
Background: cert.pl/en/posts/2026/09/vul…
Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top: US (141)
Stats - World Map view: dashboard.shadowserver.org/s…
Tracker: dashboard.shadowserver.org/s…
IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': shadowserver.org/what-we-do/…
218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly.
Patch info: documentation.n-able.com/N-c…
Background on incidents: huntress.com/blog/n-able-vul…
We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @GreyNoiseIO. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'.
Dashboard Tree Map stats: dashboard.shadowserver.org/s…
Compromised Website Report: shadowserver.org/what-we-do/…
Thank you to @GreyNoiseIO for the share! Background with info about the AI-orchestrated campaign behind the compromises (includes IOCs): greynoise.io/blog/ai-orchest…
Since 2026-09-04 we are scanning/reporting daily unpatched versions of Plex Media Server in response to an advisory issued by Plex forums.plex.tv/t/important-s… for v1.43.2 & earlier. Over 36K instances found still unpatched! Top affected: US (16K)
World Map: dashboard.shadowserver.org/s…
No CVEs have been issued meaning the vulnerabilities are essentially invisible to the security community limiting an effective response.
We tag the raw IP data shared 'vulnerable-plex' in Vulnerable HTTP reporting: shadowserver.org/what-we-do/…
Tracker: dashboard.shadowserver.org/s…
Running an outdated Plex Media Server? Patch!
Dashboard Tree Map view: dashboard.shadowserver.org/s…
We added MikroTik SSH identification to our daily scans on 2026-09-04, in response to MikroTik's patches mikrotik.com/supportsec/sept…. As discovered by @CERT_Polska_en cert.pl/en/posts/2026/09/vul… unpatched MikroTiks can be compromised, if device supports remote access using SSH protocol
At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check).
IP data shared daily in Accessible SSH reporting shadowserver.org/what-we-do/… tagged 'mikrotik' & Device Identification reports: shadowserver.org/what-we-do/…