Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Organization
GreyNoise
- Mentions · 7d1
- Mentions · 30d12
- All mentions39
- First seenAug 13, 2026
- Last mentioned1d ago
Timeline
39 articles · newest firstHackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
Attackers used Codex and DeepSeek agents to exploit PaperCut flaws and compromise 440 servers in 48 countries.
82
Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A threat actor used AI agents to exploit PaperCut, compromising about 440 servers and stealing Windows credentials.
88
Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks
Actor skynox7 exploited D-Link, Ubiquiti, and SAP flaws to proxyjack 143 devices.
75
New Proxyjacking Campaign Exploits Network Device Flaws to Build Stealthy Proxy Infrastructure
GreyNoise says attackers exploited NAS, NVR, and SAP flaws to install Pawns.app on 143 devices.
74
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
GreyNoise found attackers exploiting edge-device flaws in 34 countries to install Pawns.app and resell bandwidth.
58
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Honeypots recorded 1,423 attempts exploiting Langflow's critical authenticated RCE, CVE-2026-105740.
78
skynox7: Proxyjacking Edge Devices Into Residential Proxies
An actor exploited edge-device flaws to install Pawns.app, compromising at least 143 devices in 34 countries.
72
Hackers Target Hikvision Cameras in Ukraine With RCE Exploits Amid Russian Airstrikes
GreyNoise saw exploitation attempts against Ukrainian Hikvision cameras using CVE-2021-36260, with no confirmed strike link.
68
Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts
GreyNoise saw exploitation attempts against Hikvision CVE-2021-36260 aimed at Ukraine, without confirmed device takeovers.
67
Spike in Attacks Targeting Digital Video Recorders in Ukraine
GreyNoise recorded a nine-day surge of CVE-2021-36260 exploitation attempts against Hikvision devices in Ukraine.
62
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
93
Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells
Attackers are exploiting two critical Citrix NetScaler zero-days to deploy WHIPSHOT web shells and tunnel inward.
91
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Mandiant links weeks-long NetScaler ADC/Gateway zero-day exploitation to suspected state actors, hitting 100+ government, finance, and legal organizations.
95
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Mass exploitation of NetScaler CVE-2026-88772 grants attackers root access to deploy WHIPSHOT web shells and SLAPSHOT tunneler against government and financial targets.
88
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
95
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.
93
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.
95
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings
Citrix patched actively exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after a weekend of silence, and CISA added both to KEV.
91
Swarming Against Citrix 0-Day Exploitation
GreyNoise saw pre-disclosure exploitation of Citrix NetScaler CVE-2026-88771 three days before public disclosure.
85
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
82
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
82
Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords
Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.
80
CISA orders feds to patch Zyxel flaw exploited for data theft
CISA added actively exploited Zyxel GS1900 flaw CVE-2026-7273 to KEV, ordering federal agencies to patch by Thursday after ~1,000 switches were compromised.
74
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
80
AI agents exploited PaperCut flaws to breach 395 organizations
GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.
82
PaperCut Flaws Exploited in AI-Powered Attacks
GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.
77
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws
PaperCut shipped maintenance releases replacing emergency patches for two actively exploited flaws abused in AI-assisted attacks on 395 organizations.
78
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
82
AI-powered attack exploited PaperCut flaws to hack 395 organizations
AI-driven campaign exploited PaperCut flaws CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations in 48 countries.
88
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.
76
Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers
AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.
82
Hackers Use Hundreds of AI Agents to Exploit PaperCut Flaws and Compromise 440 Servers Worldwide
A Russian-speaking actor used hundreds of AI agents to exploit PaperCut flaws, compromising 440 servers across 395 organizations in 48 countries.
78
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR
GreyNoise expanded its CrowdStrike Falcon integration with Next-Gen SIEM dashboards, correlation rules, and Charlotte Agentic SOAR playbooks.
25
A New Way to Navigate GreyNoise
GreyNoise launched a redesigned Visualizer that consolidates internet-noise analysis workflows into one interface.
12
GreyNoise Welcomes New SVP of Adversary Operations
GreyNoise hires a former Google Threat Intelligence leader as SVP of Adversary Operations to expand proactive threat discovery and disruption.
15
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2021-44228100%10.0JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
- CVE-2025-3132499%9.8Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer
- CVE-2024-3273100%9.8Command Injection in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L NAS Devices
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
Appears with
- DeepSeekai model · 11
- PaperCutvendor · 11
- OpenAIvendor · 10
- PaperCut MFproduct · 9
- PaperCut NGproduct · 9
- Mandiantorganization · 8
- DeepSeekvendor · 8
- Ubiquitivendor · 8
- CISAorganization · 7
- GreyNoisevendor · 7
- Citrixvendor · 6
- watchTowrorganization · 6
- Citrixorganization · 6
- Hikvisionvendor · 6
- PaperCutorganization · 5
- NetScaler Gatewayproduct · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.