Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
Product
HAProxy
- Mentions · 7d0
- Mentions · 30d1
- All mentions7
- First seenSep 4, 2026
- Last mentioned9d ago
Timeline
7 articles · newest first[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)
OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.
67
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)
OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.
64
We've got one word for it, and it's usually the wrong one
Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.
32
North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
65
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
68
Related CVEs
by mentions- HAProxy Config Injection in OpenStack Octavia Amphora Driver via tls_ciphers
- HAProxy Config Injection via L7 Policy Redirect Fields in OpenStack Octavia
Appears with
- APT37threat actor · 3
- curlRATmalware · 3
- Rapid7vendor · 3
- curlRATproduct · 2
- Rapid7organization · 2
- OpenStackvendor · 2
- Lazarusthreat actor · 2
- OpenStackorganization · 2
- tedmalware · 2
- ted backdoorproduct · 2
- Octaviaproduct · 2
- ted backdoormalware · 2
- Kimsukythreat actor · 2
- ServiceNowvendor · 1
- Cisco Talosvendor · 1
- NetSupport Managerproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.