GreyNoise

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441)

0-day, Binarly, Don't miss, exploit, GreyNoise, Hot stuff, News, Zyxel /

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) 2026-11-05 at 14:06 By Zeljka Zorz Zyxel GS1900 series network switches that received a fix for a flaw that was later reported to have been exploited in the wild are still open to an exploit attackers used, Binarly found. That’s because the patch fixed a […]

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) Read More »

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

Censys, CERT-EU, Don't miss, GreyNoise, Hot stuff, Lupovis, NetScaler, News, PoC, vulnerability, WatchTowr /

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) 2026-09-29 at 17:59 By Zeljka Zorz The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread “spray and pray” exploitation, fueled by the publication of a root-cause analysis and a proof-of-concept exploit […]

NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) Read More »

Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)

Arctic Wolf Networks, Don't miss, exploit, Government, GreyNoise, Hot stuff, News, SMBs, Veeam Software, Zyxel /

Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) 2026-09-22 at 13:42 By Zeljka Zorz A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 devices across 48 countries, GreyNoise reported on Monday. The affected switches are predominantly located in Italy, the […]

Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) Read More »

AI agents exploited PaperCut flaws to breach 395 organizations

AI, cyberattack, GreyNoise, News, PaperCut, vulnerability /

AI agents exploited PaperCut flaws to breach 395 organizations 2026-09-11 at 13:05 By Sinisa Markovic A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise. The result was […]

AI agents exploited PaperCut flaws to breach 395 organizations Read More »

Threat actors are posing as AI crawlers to hunt for exposed credentials

AI, credentials, cybercrime, GreyNoise, News /

Threat actors are posing as AI crawlers to hunt for exposed credentials 2026-08-31 at 17:54 By Sinisa Markovic Attackers are disguising automated scanning as traffic from AI crawlers operated by OpenAI, Anthropic, Google, Perplexity and other companies while searching websites for exposed credentials and configuration files, according to GreyNoise. (Source: GreyNoise) “Every program that visits […]

Threat actors are posing as AI crawlers to hunt for exposed credentials Read More »

Edge systems take the brunt of internet-wide exploitation attempts

cybersecurity, GreyNoise, News, report, Threat Intelligence /

Edge systems take the brunt of internet-wide exploitation attempts 2026-02-25 at 07:18 By Anamarija Pogorelec Internet-facing VPNs, routers, and remote access services absorbed sustained exploitation attempts throughout the second half of 2025, with nearly 3 billion malicious sessions recorded over 162 days. The concentration on edge infrastructure aligns with how attackers pursue initial access across […]

Edge systems take the brunt of internet-wide exploitation attempts Read More »

CISA confirms exploitation of VMware ESXi flaw by ransomware attackers

Broadcom, CISA, Don't miss, ESXi, exploit, GreyNoise, Hot stuff, News, patching, Ransomware, VMWare, vulnerability, vulnerability management /

CISA confirms exploitation of VMware ESXi flaw by ransomware attackers 2026-02-05 at 18:17 By Zeljka Zorz CVE-2025-22225, a VMware ESXi arbitrary write vulnerability, is being used in ransomware campaigns, CISA confirmed on Wednesday by updating the vulnerability’s entry in its Known Exploited Vulnerabilities (KEV) catalog. Researchers linked VMware ESXi zero-day trio to single exploit toolkit […]

CISA confirms exploitation of VMware ESXi flaw by ransomware attackers Read More »

Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts

0-day, Cisco, Don't miss, firewall, Government, government-backed attacks, GreyNoise, Hot stuff, News, Shadowserver /

Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts 2025-10-01 at 13:36 By Zeljka Zorz Despite Cisco and various cybersecurity agencies warning about attackers actively exploting zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) in Cisco Adaptive Security Appliances (ASA) for months, there are still around 48,000 vulnerable appliances out there. The number is provided by […]

Too many Cisco ASA firewalls still unsecure despite zero-day attack alerts Read More »

GreyNoise unveils MCP Server to power AI-driven SOC workflows

GreyNoise, Industry news /

GreyNoise unveils MCP Server to power AI-driven SOC workflows 2025-09-18 at 07:17 By Industry News GreyNoise Intelligence introduced the GreyNoise Model Context Protocol (MCP) Server to enable MCP-compatible LLMs and agents to query GreyNoise APIs directly, providing real-time, actionable threat intelligence for AI agents. “AI Agents represent a major shift in cybersecurity, moving beyond simple […]

GreyNoise unveils MCP Server to power AI-driven SOC workflows Read More »

Can AI make threat intelligence easier? One platform thinks so

analytics, automation, CISO, cybersecurity, data collection, Don't miss, GreyNoise, News, Threat Intelligence /

Can AI make threat intelligence easier? One platform thinks so 2025-08-28 at 07:38 By Mirko Zorz When analysts at RH-ISAC found themselves spending 10 hours a week just collecting threat intelligence, they knew their process wasn’t sustainable. They were manually tracking blogs, RSS feeds, and social media channels, but it took too long to separate […]

Can AI make threat intelligence easier? One platform thinks so Read More »

Brute-force attacks hammer Fortinet devices worldwide

brute-force, Don't miss, exploit, firewall, Fortinet, GreyNoise, Hot stuff, News /

Brute-force attacks hammer Fortinet devices worldwide 2025-08-14 at 17:05 By Zeljka Zorz A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabilities in Fortinet devices. Shifting attacks Greynoise, a cybersecurity intelligence service that through its global network […]

Brute-force attacks hammer Fortinet devices worldwide Read More »

GreyNoise enhances threat response with real-time blocklists, feeds, and SOAR integrations

GreyNoise, Industry news /

GreyNoise enhances threat response with real-time blocklists, feeds, and SOAR integrations 2025-07-31 at 16:33 By Industry News GreyNoise Intelligence introduced three new platform capabilities designed to help security teams detect, block and respond faster to emerging cybersecurity threats. These capabilities, including Real-time Dynamic Blocklists, new GreyNoise feeds and integrations for Security Orchestration, Automation and Response […]

GreyNoise enhances threat response with real-time blocklists, feeds, and SOAR integrations Read More »

GreyNoise Flags 9,000 ASUS Routers Backdoored Via Patched Vulnerability

Asus, botnet, Censys, CVE-2023-39780, GreyNoise, IoT Security, Malware & Threats, ORB, Vulnerabilities /

GreyNoise Flags 9,000 ASUS Routers Backdoored Via Patched Vulnerability 2025-05-29 at 17:37 By Ryan Naraine Professional hackers have built a network of ASUS routers that can survive firmware upgrades, factory reboots and most anti-malware scans. The post GreyNoise Flags 9,000 ASUS Routers Backdoored Via Patched Vulnerability appeared first on SecurityWeek. This article is an excerpt […]

GreyNoise Flags 9,000 ASUS Routers Backdoored Via Patched Vulnerability Read More »

Attackers are probing Palo Alto Networks GlobalProtect portals

Don't miss, enterprise, GreyNoise, Hot stuff, News, Palo Alto Networks, scanning, VPN /

Attackers are probing Palo Alto Networks GlobalProtect portals 2025-04-01 at 14:21 By Zeljka Zorz Cybersecurity company GreyNoise is warning about a significant increase of scanning activity targeting internet-facing Palo Alto Networks GlobalProtect portals in the last 30 days, and has urged organizations with exposed systems to secure them and look for signs of compromise. “The […]

Attackers are probing Palo Alto Networks GlobalProtect portals Read More »

Attackers are chaining flaws to breach Palo Alto Networks firewalls

Assetnote, Don't miss, enterprise, GreyNoise, Hot stuff, News, Palo Alto Networks, vulnerability /

Attackers are chaining flaws to breach Palo Alto Networks firewalls 2025-02-19 at 11:03 By Zeljka Zorz Exploitation attempts targeting CVE-2025-0108, a recently disclosed authentication bypass vulnerability affecting the management web interface of Palo Alto Networks’ firewalls, are ramping up. “GreyNoise now sees 25 malicious IPs actively exploiting CVE-2025-0108, up from 2 on February 13,” the […]

Attackers are chaining flaws to breach Palo Alto Networks firewalls Read More »

Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891)

Censys, Don't miss, GreyNoise, Hot stuff, News, VulnCheck, vulnerability, Zyxel /

Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) 2025-01-29 at 18:32 By Zeljka Zorz CVE-2024-40891, a command injection vulnerability in Zyxel CPE Series telecommunications devices that has yet to be fixed by the manufacturer, is being targeted by attackers, cybersecurity company Greynoise has warned. Successful exploitation would allow attackers to execute […]

Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) Read More »

New Zyxel Zero-Day Under Attack, No Patch Available

Censys, CVE-2024-40891, GreyNoise, Malware & Threats, Vulnerabilities, Zyxel /

New Zyxel Zero-Day Under Attack, No Patch Available 2025-01-29 at 18:21 By Ryan Naraine GreyNoise reports active exploitation of a newly discovered zero-day vulnerability in Zyxel CPE devices. There are no patches available. The post New Zyxel Zero-Day Under Attack, No Patch Available appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

New Zyxel Zero-Day Under Attack, No Patch Available Read More »

Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation

Don't miss, enterprise, exploit, firewall, GreyNoise, Hot stuff, News, Palo Alto Networks, PoC, security update, TrustedSec, Volexity, vulnerability, WatchTowr /

Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation 2024-04-17 at 12:31 By Zeljka Zorz While it initially seemed that protecting Palo Alto Network firewalls from attacks leveraging CVE-2024-3400 would be as easy a disabling the devices’ telemetry, it has now been comfirmed that this mitigation is ineffectual. “Device telemetry does not need to be […]

Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation Read More »

Akira, LockBit actively searching for vulnerable Cisco ASA devices

Cisco, Don't miss, enterprise, exploit, GreyNoise, Hot stuff, News, Ransomware, Truesec, vulnerability /

Akira, LockBit actively searching for vulnerable Cisco ASA devices 2024-02-08 at 14:31 By Zeljka Zorz Akira and Lockbit ransomware groups are trying to breach Cisco ASA SSL VPN devices by exploiting several older vulnerabilities, security researcher Kevin Beaumont is warning. They are targeting vulnerabilities for which patches have been made available in 2020 and 2023. […]

Akira, LockBit actively searching for vulnerable Cisco ASA devices Read More »

Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms (CVE-2023-35082)

CISA, Don't miss, endpoint management, exploit, GreyNoise, Ivanti, News, Rapid7, vulnerability /

Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms (CVE-2023-35082) 2024-01-19 at 19:49 By Zeljka Zorz A previously patched critical vulnerability (CVE-2023-35082) affecting Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core is being actively exploited, the Cybersecurity and Infrastructure Security Agency (CISA) has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities […]

Ivanti EPMM and MobileIron Core vulnerability is actively exploited, CISA confirms (CVE-2023-35082) Read More »

Scroll to Top