Censys

🚨 Censys is closely tracking PHP2Shell exposure and remediation worldwide. Our live dashboard tracks affected PHP versions and patching progress by country, network, and PHP version. View the live dashboard: php2shell.censys.com

In a recent @reuters.com article on staying safe online as AI accelerates cyber threats, Censys Principal Security Researcher @whyli.me discusses the basic steps everyone should take to help protect themselves.

Censys and Torq now give your AI SOC first-party Internet context at every stage of a case: triage, detection, investigation, and response. Read the joint solution brief: https://bit.ly/4i9hFDJ

Our PHP2Shell Response Hub includes: 🔹 Live exposure and patching dashboard 🔹Updated Censys ARC advisory 🔹Option to request a custom report We'll continue updating as new findings emerge. https://bit.ly/3UDHpiC

🚨 Rapid Response: CVE-2026-110264 (CVSS 10.0) allows unauthenticated RCE in GitLab. On the day of disclosure, Censys observed roughly 82,000 hosts and about 209,000 web properties running GitLab. Full advisory and Censys queries: https://bit.ly/4epIFwo

NBC News spoke with Censys ARC researcher @silascutler.bsky.social about the critical PHP vulnerabilities. Follow our updated advisory for the latest findings: censys.com/advisory/cve...

Two critical PHP vulnerabilities. Widespread Internet exposure. Reuters covers the latest developments, citing Censys research. reuters.com/world/asia-p... Follow our Censys ARC advisory for the latest findings and updates: censys.com/advisory/cve...

Sources: bsky.app/profile/cens... blog.talosintelligence.com/two-critical...

🚨 Rapid Response: Two critical PHP RCE flaws (CVE-2026-109618/109619), both CVSS 9.2. Censys observes ~2.58M exposed hosts and ~54.9M web properties running PHP. Exposure does not confirm vulnerability. Patch immediately! Full advisory and Censys queries: https://bit.ly/4zLmDML

Rough estimate - likely over 1.3 million internet exposed hosts vulnerable to #PHP2Shell For all PHP: `host.services.software.product: "PHP"` ( 2,574,043 results) platform.censys.io/search?q=hos... @censys.bsky.social query: gist.github.com/silascutler/...

🚨 Rapid Response: Plex Media Server RCE chain is being actively exploited. Censys ARC sees ~340,000 Internet-exposed; ~30% run vulnerable builds. Fewer than 2% of still-vulnerable hosts patched in 3 days after exploit publication. https://bit.ly/4dMS1SJ

Internet-exposed AI infrastructure grew 63% in nine months. Download the 2026 State of the Internet Report: https://bit.ly/4iuKwCs Watch the full episode here: https://bit.ly/4hVa3Vq

Do you know which libraries, web technologies, and plugins are running across your attack surface, and which ones pose a risk? Censys ASM maps these technologies for you, detects associated vulnerabilities, and provides web screenshots and full redirect chains. https://bit.ly/4hTVVu4

🚨 Rapid Response | BeyondTrust Remote Support/Privileged Remote Access Zero-Day (CVE-2026-102764) (CVSS 9.3) critical vulnerability. Censys detects 9,569 exposed hosts & 177,497 web properties running Remote Support or Privileged Remote Access, not all confirmed vulnerable. https://bit.ly/4ymlmeh

🚨 Rapid Response: CVE-2026-110447 (CVSS 9.2), a critical flaw in the Collabora Online Built-in CODE Server for Nextcloud, has reportedly been exploited in the wild. Censys detects 19,454 hosts and 103,350 web properties with the app installed, not all confirmed vulnerable. https://bit.ly/4BbTBrm

Three In Four Exposed n8n Servers Run A Release With A Critical Flaw Exposed AI infrastructure grew 63% in nine months, Censys finds. Read all about it: cyberinsurancenews.org/exposed-ai-i... #cyberinsurance #cybersecurity @censys.bsky.social

The wait is over. Our 2026 State of the Internet Report is here. The Internet is vast. And volatile. Drawing on more than two years of Internet intelligence, Censys ARC examines what's changing, what's staying the same, and what it means for security teams. Download here: https://bit.ly/4hZExEe

🚨 Rapid Response: Ivanti Connect Secure CVE-2026-104935 (CVSS 8.6) is actively exploited and on CISA's KEV list. Censys sees 7,604 exposed hosts and 269,319 web properties (not confirmed vulnerable). Censys ARC advisory: https://bit.ly/4jplTIr

Internet-exposed Danfoss refrigeration controllers in France are disappearing from public view at a dramatic rate following a cyber incident targeting supermarket food supplies, according to @censys.bsky.social. www.infosecurity-magazine.com/news/france-...

The internet’s attack surface moves at very different speeds 📖 Read more: www.helpnetsecurity.com/2026/10/15/e... #cybersecurity #cybersecuritynews #AI #ICS #threatintel @censys.bsky.social

Following attacks on refrigeration systems in France, Censys saw a 71% drop in Internet-exposed Danfoss StoreView controllers in just 3 days. But outdated firmware isn't limited to France. The bigger issue? Internet-exposed OT systems that are difficult or impossible to patch https://bit.ly/4ynCa4x

The Censys 2026 State of the Internet Report is out today! Internet-facing AI infrastructure grew 63% in just nine months, reaching nearly 268,000 systems. That's just one of the findings. See what else is changing across the Internet: https://bit.ly/4yHN6Lc #CensysARC #CensysSOTIR

The Internet is vast & volatile. What’s changing? TODAY at 11 AM ET, join Himaja Motheram and @whyli.me as they discuss findings from the 2026 Censys State of the Internet Report. Bring your questions: https://info.censys.com/arc-webcast #CensysARC #CensysSOTIR

🚨 Critical GitLab RCE (CVE-2026-97229, CVSS 10.0) Censys currently detects 25,766 hosts & 79,224 web properties with a version of GitLab affected by this vulnerability. This is 31% & 39% of all GitLab hosts and web properties, respectively. PoC public; patches available. https://bit.ly/4BaEXAI

🚨 Rapid Response: Critical AnyDesk Linux RCE (CVE-2026-109390, CVSS 9.8). Public exploit available. Censys detects 175,838 Internet-exposed AnyDesk hosts on TCP 7070 (not confirmed vulnerable). Censys ARC advisory: https://bit.ly/47jqCEh

The Censys 2026 State of the Internet Report was featured in @axios.com. @samsabin.bsky.social spoke with Censys CEO Zakir Durumeric and researcher @whyli.me about the security implications of growing AI infrastructure. https://www.axios.com/newsletters/axios-future-of-cybersecurity

Brand abuse happens across the public Internet. Censys gives defenders visibility into the infrastructure behind it. See how to find and investigate brand impersonation, with queries you can adapt to your own brand: https://bit.ly/4ybOIf0

A messaging protocol with a multi-year ransomware track record. An actively exploited Cisco SD-WAN flaw. We added 22 new protocol and endpoint scanners last month. See what else might be exposed in your environment. https://bit.ly/4yHJ6dI

🚨 Rapid Response: SonicWall patched a critical CVSS 10.0 pre-auth SSRF in SMA1000 (CVE-2026-102255). Censys detects 5,966 Internet-exposed hosts and 39,310 web properties running SMA1000/Secure Mobile Access, excluding honeypots. Censys ARC advisory: https://bit.ly/3VWfWJc

🚨 Rapid Response: CVE-2026-21589 is a critical arbitrary file access vulnerability affecting eight Atlassian Data Center products. Censys detects 95,366 Internet facing hosts and 431,502 web properties running affected products. Details: https://bit.ly/4dWwYgs

New research from Censys ARC examines open directories exposing the full DarkSword/Coruna iOS exploitation platform: C2, admin panel, live victim telemetry, and 18 wallet-theft modules. Read the full analysis: https://bit.ly/3VVJGG6 #CensysARC

Join Censys ARC for a special edition of Censys ARC Flash at 11 AM ET for highlights of what they found across the vast and volatile Internet. Register to join: https://bit.ly/4uEpjd2 #CensysARC #CensysSOTIR

Welcome to Censys, Jeff Hackett! Jeff joins us as CFO, bringing 20+ years of finance experience across cybersecurity, technology, and SaaS. More: https://bit.ly/3VpYEUN

🚨 RAPID RESPONSE: CVE-2026-84411 is a critical unauthenticated RCE affecting MikroTik RouterOS web management. Censys detects 364,341 exposed hosts. This is an exposure count, not confirmed vulnerable devices. No public exploitation reported. Censys ARC advisory: https://bit.ly/4rXOqaf

🚨 Fortinet reports CVE-2026-104286 is being exploited in the wild. Censys observes ~2,800 Internet-exposed FortiMail hosts, excluding honeypots. No fixed builds are available yet. Censys ARC advisory: https://bit.ly/4htjUkY

In the 2026 State of the Internet Report, we are looking beyond the weekly news cycle to benchmark security trends across more than 2 years of Internet data. Join Censys ARC Flash on Oct 14 at 11 AM ET to hear directly from the researchers behind the report & ask questions. https://bit.ly/3ToHoyz

AI can make your SOC faster. It can’t fix incomplete data. At Cybersec Netherlands, Censys Senior Solutions Engineer Jonas Gyllenhammar explains why fresh Internet Intelligence matters for triage, investigation, hunting, and defense. Watch the session: https://www.youtube.com/watch?v=EKDdEYV8twE

🚨Two Citrix NetScaler RCE vulnerabilities are being actively exploited as zero-days. Censys sees 42,735 Internet-exposed NetScaler ADC or Gateway hosts. Censys ARC advisory:

Our most ambitious report yet. The 2026 Censys State of the Internet Report looks across more than two years of Internet data to uncover what’s changing, what persists, and where new risks are emerging. The full report arrives October 13. Pre-register to get your copy: https://bit.ly/4yPefeO

We're open-sourcing nine skills that teach your agents and AI assistants to drive the Censys CLI. https://bit.ly/4rxi1qW

Thank you to our Censys Partners! We're expanding the Censys Channel Partner Program by investing even more in helping partners bring real-time Internet intelligence to customers worldwide. https://bit.ly/4h5Fz2z #CensysPartner #CensysEverywhere

🚨 CVE-2026-10747: A critical pre-auth RCE in IBM MQ carries a CVSS 10.0. Censys ARC observes IBM MQ consoles on 120 hosts Internet-wide. IBM has released fixes; no active exploitation is currently known. https://bit.ly/4jh5qWx

@feedly.com now links straight into Censys. When a threat report surfaces an IP, it rarely tells you what that host is doing right in real-time. Now analysts can click 'Open in Censys' from a Feedly IoC Insights Card and land on the live host record. Great threat intel integration! bit.ly/3V4kr42

🚨CVE-2026-91843 is a critical (CVSS 9.8) pre-auth RCE affecting Check Point Quantum Security Management and Log Servers. Censys sees 3,836 hosts globally with the management/log server role. No public PoC or confirmed exploitation as of publication. Patches are available. https://bit.ly/4cRApEJ

Building software that collects data used to require real engineering. That skill gate, unknowingly, protected people. AI tools removed it. What came next? Dozens of student-facing apps collecting homework photos, GPAs, & essays, with no one watching where any of it goes. https://bit.ly/4gTy2Uv

Censys ARC sees 131 Mythic-associated hosts on the public Internet, with some clear fingerprints. This new Censys Threat Overview maps Mythic across the Internet and shares detection signals defenders can use to hunt for it: https://bit.ly/4xRKcTG #CensysARC

🚨 GitLab CVE-2026-85706 is a CVSS 10.0 vulnerability under active exploitation. Censys sees 86K+ GitLab hosts on the Internet. If your instance was exposed while vulnerable: patch, rotate credentials, and investigate for compromise. https://bit.ly/4A690c6

Your CFO’s phone is pwned. You have an alert with an IP. Now what? The IOC isn’t the incident. It’s where the investigation starts. See how to go from indicator ➡️ Internet infrastructure ➡️ incident scope: https://bit.ly/4xeQ5cx