Company
Censys is an internet scanning and attack surface management company that maps internet-connected devices and services to help identify exposed systems.
Censys counted 71% fewer internet-exposed Danfoss StoreView panels in France three days after the October 11 attack on hundreds of supermarkets. It found no rise in patched firmware, so the older versions are still running.
Reality
France's cyber agency ANSSI says the attack that hit about 700 supermarkets also reached Copeland and Dixell XWEB refrigeration controllers. Danfoss says most of its affected units are end-of-life and unpatched.
Reality
iVerify disclosed P7 DarkSword, a reworked variant of a leaked iOS exploit kit for iPhones on iOS 18.4 to 18.7 that steals keychain and crypto-wallet data. The commercial chain leaked onto a second-hand market, where financially motivated operators have been buying it since late 2025.
Reality
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
10 publishersReality
One $6 Frankfurt server received its first unsolicited packet 3.77 seconds after its listener opened, according to a write-up on dev.to. Ranked by events, addresses or networks, the same log puts a different port at the top each time.
Reality
Plex Media Server 1.43.3 and Desktop 1.115.0 fix flaws that still carry no CVE IDs and no description, which leaves anyone running the server on a NAS waiting on a package manager while the patched builds are already public.
Perspective Coverage
3 publishersReality
CVE-2026-91843 lets an attacker with no credentials run code as root through the login process, and Check Point has published indicators of compromise while saying it has seen no exploitation in the wild.
Perspective Coverage
4 publishersReality
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
Reality
CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
Mysterium VPN counted 36,769 self-hosted AI endpoints reachable from the public internet. Ollama is the only population where the scan can prove that nothing on the host asked for credentials.
Reality
Censys counts more than 294,000 public IPs running one of 43 AI or LLM tools, up from roughly 183,000 in October 2025. The two platforms it names for growth, Langflow and LiteLLM, both carry KEV-listed flaws.
Reality
CISA says attackers reached programmable logic controllers over the internet during July 2026, changed IP addresses and passwords, and left some utilities unable to monitor their own equipment. No actor has been named.
Reality
July's intrusions into US water utilities did not need an exploit. They needed a PLC on a cellular modem with nothing in front of it, and CISA's August 21 guidance is an inventory job.
Reality
The warning as relayed names no agency, no CVE and no actor, which leaves internet reachability as the only control operators can act on. Read access is described as preparation for writes.
Reality
A Siemens-specific follow-up to the July PLC warning describes internet-wide discovery paired with AI-generated Python tooling that reads and writes ladder logic.
Reality