Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026
Attacks rose 208% year over year, but 98% stayed under 1 Gbps and most ended within ten minutes.
1
Stories per day · 30 days
1 RSS
Relatedphp8php2shell8potassium6botnet3cloudflare3ddos3dns-amplification3rce3aslr2botnets2poc2remote-code-execution2ai-worm1android-tv1anthropic1badbox1booter1censys1
31 stories, newest first · one card per story
Stories tagged #mirai
Cloudflare blocked over 8,200 network DDoS attacks an hour in Q3
Most attacks lasted under ten minutes and stayed below 1 Gbps, while terabit-scale floods fell nearly 69% from the prior quarter.
1
Cloudflare: short DDoS bursts rose 208% in Q3 2026
Attacks over 1 Tbps fell to 251 from 805 after takedowns of four large IoT botnets.
1
Attackers use public PHP2Shell exploits against university and business sites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
Researcher exploits PHP2Shell flaws, wins Bitcoin challenge and releases PoC
CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, were fixed October 21; Amazon saw attempts from October 17.
Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
Mirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
AI worms could spread across your smart devices, Anthropic warns
Anthropic warns small AI models may soon self-replicate on vulnerable IoT devices, without showing a live worm.
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
US authorities seized China-linked Integrity Tech tools Microscan and FishHub used to hack critical infrastructure.
6
FBI disrupts Flax Typhoon hacking tools used in global cyberattacks
FBI seized seven domains powering Flax Typhoon's Microscan and FishHub tools, used against U.S. and Taiwanese critical infrastructure and universities.
2
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI seized seven domains for Microscan and FishHub tools used by China-linked Flax Typhoon contractor Integrity Technology Group.
3
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to China's Integrity Technology Group.
9
Hackers Exploit cPanel CVE-2026-41940 Auth Bypass to Deploy Mirai Malware
Attackers are exploiting CVE-2026-41940, a critical unauthenticated cPanel/WHM auth bypass, to compromise hosting servers and recruit them into Mirai botnets.
1
Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.
Echo: Learning-based Matching Decompilation using Trusted Back Translation
Researchers introduce Echo, a matching decompiler using trusted back-translation that roughly doubles exact-match rates and outperforms GPT-5.6 and Codex on Mirai.
New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks
Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.
New Mirai Variant Targeting Network Security Devices
New Mirai botnet variant exploits nine vulnerabilities in SonicWall, D-Link, Netgear, and other devices, with attacks ongoing at publication.
A Deep Dive Into Attempted Exploitation of CVE-2023
Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.
9
New Mirai-Based Evooo1Bot Botnet Targets Linux Devices
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.