Company
GreyNoise is a cybersecurity firm that monitors internet-wide scanning and attack traffic, providing threat intelligence on mass exploitation activity.
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
Reality
Spain's data protection authority said on 14 September 2026 it received its first breach notification blaming an AI agent. The account is the victim's own and still under analysis, so it is enough to add the scenario to a response plan and too thin to size it.
Reality
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
Mandiant and Google traced a September 2026 campaign exploiting NetScaler bug CVE-2026-88772, CVSS 9.5, to root on appliances with no login. From there the intruders drop web shells and a Python tunneler that reaches into victims' internal networks to steal credentials.
Perspective Coverage
21 publishersReality
LevelBlue says attackers are exploiting NetScaler flaw CVE-2026-88771, rated 9.5, to create a hidden superuser account and plant web shells. The patch closes the injection but removes neither, so already-exposed appliances need a compromise check.
Reality
TASK#STOMP, a Windows backdoor researchers dissected, uploads a victim's business documents and then stays to copy each new or edited one. Loss from a single infection keeps growing until someone finds and removes it.
Reality
CVE-2026-21962 reached CISA's exploited-vulnerabilities catalog on August 24 with an August 27 deadline. Honeypots logged attempts in March, and Oracle's fix has been available since January.
Reality
GreyNoise and Blackpoint Cyber trace the new PaperCut auth-bypass chain to one scanning address running AI agents against schools, which turns an unpatched print server from a maintenance ticket into a credential incident.
Perspective Coverage
6 publishersReality
PaperCut NG/MF 26.0.5, 25.0.13 and 24.1.10 carry every fix from three emergency patch rounds plus two regression fixes, while GreyNoise and Blackpoint Cyber count at least 395 organizations already breached.
Reality
GreyNoise reports the WordPress intrusion and the Zyxel switch harvest as separate operations run from shared scanning infrastructure by a suspected Chinese-speaking actor it tracks as Kapibala.
Reality
GreyNoise traced scans from a single IP address, running since early June 2026, to a Chinese-speaking actor that breached 49 organizations through WordPress Core and stripped configs and root hashes from 996 ZyXEL switches.
Reality
A site logged twenty requests for its unreachable /.env file from a client naming itself ClaudeBot. GreyNoise counted 824 addresses scanning under forged AI crawler names, and saw no request for robots.txt in the whole campaign.
Reality
Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.
Reality
GreyNoise's January tally of React2Shell traffic shows payload text mutating freely while the client tooling behind it stays nearly fixed. That decides what a perimeter rule should match on.
Reality
GreyNoise says a likely Russian-speaking actor built and tested PaperCut exploits in a lab, then ran hundreds of agents on a Codex harness with a DeepSeek model against 440 servers in 48 countries. The sending infrastructure was already on its watchlist.
Reality
Wiz says a TeamCity honeypot exposing JDWP was mining Monero within hours, and GreyNoise counted more than 6,000 unique IPs scanning for the protocol in 90 days.
Reality