Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Vendor
TP-Link
- Mentions · 7d1
- Mentions · 30d8
- All mentions15
- First seenAug 17, 2026
- Last mentioned2d ago
Timeline
15 articles · newest firstWanted to download an ISO, ended up writing a kernel exploit
Researcher wrote a kernel exploit to root an EOL TP-Link EAP770 after Wi-Fi downloads silently corrupted.
54
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
Four more U.S. states sued TP-Link over router security claims and alleged China ties.
61
US states sue popular kitmaker TP-Link over China risks
Four US states sued TP-Link, alleging deceptive router-security marketing and hidden reliance on Chinese suppliers.
66
New Linux malware turns vulnerable IoT devices into proxy nodes
Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.
72
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.
76
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.
68
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
SecurityWeek roundup: ransomware developer sentenced, critical SAP flaw CVE-2026-44756, PhantomRaven npm info-stealer, WordPress mass exploitation, and AI agent security findings.
32
TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users
Two zero-day flaws in TP-Link Tapo C200 cameras allowed authentication bypass and denial-of-service; fixed in firmware V5_1.4.6.
55
TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password
Two flaws in TP-Link Tapo C200 cameras allow network-adjacent admin access without a password (CVE-2026-15315) or DoS (CVE-2026-15316); fixed in V5_1.4.6.
48
Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping
OPSWAT disclosed two zero-days in TP-Link Tapo C200 cameras: CVE-2026-15315 authentication replay bypass enabling surveillance and CVE-2026-15316 denial-of-service, both patched in firmware.
52
A Deep Dive Into Attempted Exploitation of CVE-2023
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
52
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
Unit 42 tracks a Mirai botnet campaign exploiting over 20 IoT vulnerabilities in routers, cameras and DVRs to build DDoS botnets since March 2023.
42
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Fortinet researchers documented Evooo1Bot, a new Mirai-derived Linux botnet active since July 2026 that exploits known edge-device flaws to build SOCKS5 proxy networks.
55
Related CVEs
by mentions- CVE-2026-15315<1%8.7Authentication Bypass via Challenge Validation Flaw in TP-Link Tapo C120/C200 Cameras
- CVE-2026-15316<1%7.1Unauthenticated Input Validation DoS in TP-Link Tapo C200 v5 Configuration Service
- CVE-2023-1389100%8.8Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution
- CVE-2022-30525100%9.8OS Command Injection in Zyxel Firewalls Enables Remote Command Execution
- CVE-2025-3403525%10.0Unauthenticated root command injection in EnGenius EnShare
- CVE-2024-2362523%9.8A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages
- CVE-2022-3655391%9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
- CVE-2021-4642294%9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication
- CVE-2022-26134100%9.8Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center
- CVE-2023-3353842%8.8Command Injection in TP-Link TL-WR940N, TL-WR841N, TL-WR740N Routers
Appears with
- D-Linkvendor · 6
- Tapo C200product · 4
- Hytecvendor · 4
- ClingSTUNmalware · 4
- Fortinetvendor · 4
- Tendavendor · 3
- Miraimalware · 3
- AVTECHvendor · 3
- FortiGuard Labsorganization · 3
- Realtekvendor · 3
- EnGeniusvendor · 3
- Volt Typhoonthreat actor · 3
- Archer AX21product · 3
- Ivantivendor · 3
- OPSWATvendor · 3
- Netgearvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.