Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026
Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.
58
- Mentions · 7d5
- Mentions · 30d23
- All mentions38
- First seenAug 13, 2026
- Last mentioned1d ago
Timeline
38 articles · newest firstCloudflare blocked over 8,200 network DDoS attacks an hour in Q3
Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.
58
Cloudflare: short DDoS bursts rose 208% in Q3 2026
Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.
46
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
88
Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
84
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
78
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
78
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
74
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
74
AI worms could spread across your smart devices, Anthropic warns
Anthropic warns small AI models may soon self-replicate on vulnerable IoT devices, without showing a live worm.
54
The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws
Cyble sensors logged exploitation attempts against about 20 flaws as CISA issued 14 ICS advisories.
68
Anthropic warns small AI models could self-replicate through IoT devices
Anthropic found small models cannot yet self-replicate across IoT devices, though larger GLM-5.2 appeared capable.
62
Anthropic conjures another threat that doesn't exist yet to stoke fears of AI apocalypse
The Register says Anthropic's self-replicating AI worm research overstates a threat that does not yet exist.
56
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Anthropic says small models may soon replicate themselves across poorly secured IoT devices.
64
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
US authorities seized China-linked Integrity Tech tools Microscan and FishHub used to hack critical infrastructure.
84
US Disrupts Chinese State-Sponsored Hacking Tools
The US seized domains for Chinese state-sponsored tools MicroScan and FishHub used against critical infrastructure.
78
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI seized seven domains for Microscan and FishHub tools used by China-linked Flax Typhoon contractor Integrity Technology Group.
78
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
FBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to China's Integrity Technology Group.
80
International coalition seizes tools used by cyber firm behind Flax Typhoon
A US-led coalition seized Flax Typhoon tools Microscan and FishHub operated by China's Integrity Tech.
80
Hackers Exploit cPanel CVE-2026-41940 Auth Bypass to Deploy Mirai Malware
Attackers are exploiting CVE-2026-41940, a critical unauthenticated cPanel/WHM auth bypass, to compromise hosting servers and recruit them into Mirai botnets.
80
Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.
85
Echo: Learning-based Matching Decompilation using Trusted Back Translation
Researchers introduce Echo, a matching decompiler using trusted back-translation that roughly doubles exact-match rates and outperforms GPT-5.6 and Codex on Mirai.
25
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
50
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
75
A Deep Dive Into Attempted Exploitation of CVE-2023
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
52
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
45
Mirai Variant MooBot Targeting D
Unit 42 observed the MooBot Mirai variant exploiting four D-Link vulnerabilities to compromise unpatched routers for use in DDoS attacks.
40
Mirai Variant V3G4 Targets IoT Devices
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
45
Old Wine in the New Bottle: Mirai Variant Targets Multiple IoT Devices
Unit 42 analyzed the Mirai IZ1H9 botnet variant exploiting Tenda, LB-Link, DCN and Zyxel flaws to build DDoS-capable IoT botnets.
40
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
42
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.
55
New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies
A newly observed Mirai-based Linux botnet dubbed Evooo1Bot compromises edge devices and turns them into persistent proxies for threat actors.
40
New Mirai variant adds stealth capabilities to notorious botnet code
FortiGuard Labs reports new Mirai-derived botnet Evooo1Bot actively exploits unpatched routers and edge devices, adding encrypted C2, stealthy SSH scanning, and proxying.
60
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2021-4642294%9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
- CVE-2020-1098780%9.8Unauthenticated OS Command Injection in Tenda AC15 AC1900 Router
- CVE-2022-3705556%9.8Unauthenticated Buffer Overflow in D-Link GO-RT-AC750 Router Firmware
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2018-145589%9.8Unauthenticated Command Injection in Tenda AC7, AC9, and AC10 Routers
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2007-301097%—Command Injection RCE in Alcatel OmniPCX Enterprise masterCGI
Appears with
- Sophosorganization · 8
- Potassiummalware · 8
- Kimwolfmalware · 7
- Microsoftvendor · 7
- Flax Typhoonthreat actor · 7
- Microscanproduct · 6
- Integrity Technology Grouporganization · 6
- FishHubproduct · 6
- Evooo1Botmalware · 6
- CISAorganization · 6
- PHPvendor · 6
- Aisurumalware · 5
- Microsoft Exchangeproduct · 5
- Unit 42organization · 5
- D-Linkvendor · 5
- Anthropicorganization · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.