The Shadowserver Foundation

13 Dec 2025

Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API? We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash. Check it out at github.com/The-Shadowse...

PHP Attacks Update: As others, we have been observing a lot of AI slop PHP attempts against our honeypot sensors the last week, but so far no confirmed exploitation. We have also refrained from CVE-2026-109618/619 tagging in scans, due to lack of reliable, safe large scale methods.

endoflife.datePHPCheck end-of-life, release policy and support schedule for PHP.

Instead we have opted for reporting out End of Life instances, which is hopefully the more actionable approach at this stage. We added 'eol-php' to the Vulnerable HTTP reporting. Tagging is based on: endoflife.date/php (anything older than 8.2)

You can track unique IPs (not hostnames) running EOL PHP at dashboard.shadowserver.org/statistics/c... Make sure to update those systems! #CyberCivilDefense

Copeland/Dixwell XWEB refrigeration web controller incidents: As in the case of Danfoss, for a long time we have been sharing exposed Copeland XWEB Pro & Evo panels in Device ID reporting. We see around 1200 instances daily - these should of course not be publicly accessible.

dashboard.shadowserver.orgWorld map · IoT device statistics · The Shadowserver FoundationDevelopment of the Shadowserver Dashboard was funded by the UK FCDO. IoT device fingerprinting statistics and honeypot attack statistics co-financed by the Connecting Europe Facility of the European Union (EU CEF VARIoT project).

World Map view: dashboard.shadowserver.org/statistics/i... Tree Map view: dashboard.shadowserver.org/statistics/i... Exposure tracker: dashboard.shadowserver.org/statistics/i... See also: cert.cyber.gouv.fr/alerte/CERTF... Additional info: claroty.com/team82/resea...

#CyberCivilDefense

Danfoss refrigeration incidents: We are sharing exposed instances for a long time in our Device ID reporting, daily. For Danfoss AK-SM800A we still see at least 365 unique instances daily (drop from over 550 last few days) exposed. These need to be taken off the public Internet!

shadowserver.orgINFO: Device Identification Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2023-12-06 DEFAULT SEVERITY LEVEL: INFO This report contains a list of devices we have identified in our daily Internet scans. The assessment is made based on all our Interne...

Data shared in www.shadowserver.org/what-we-do/n... World Map view: dashboard.shadowserver.org/statistics/i... Tree map view: dashboard.shadowserver.org/statistics/i... Exposure tracker: dashboard.shadowserver.org/statistics/i...

claroty.comFreeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration ControllersTeam82 researched the attack surface of the Danfoss AK-SM 800A refrigeration controller platform and identified multiple vulnerabilities affecting the embedded web management interface. Team82 disclos...

Background: claroty.com/team82/resea... We are working on possible CVE tagging too

We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): www.shadowserver.org/what-we-do/n... Around 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA Stats: dashboard.shadowserver.org/statistics/c...

View full thread

cert.plCritical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommendedThe CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS, including two critical ones. The vulnerabilities are already being actively exploited to...

Background: cert.pl/en/posts/202... #CyberCivilDefense

shadowserver.orgINFO: Accessible SSH Report | The Shadowserver FoundationThis report identifies hosts that have the Secure Shell (SSH) service running and accessible on the Internet.

For MikroTik with SSH enabled, check out our Accessible SSH reporting (shadowserver.org/what-we-do/n...), with the tag 'mikrotik' dashboard.shadowserver.org/statistics/c... - just over 119K seen daily currently

These should not be publicly accessible on the Internet due to potential vulnerabilities, like CVE-2026-67277 nvd.nist.gov/vuln/detail/... You can find all our MikroTik detections in Device ID report www.shadowserver.org/what-we-do/n... (around 3M daily): dashboard.shadowserver.org/statistics/i...

nvd.nist.govNVD - Home

Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on US CISA KEV. Top: US (141) Stats - World Map view: dashboard.shadowserver.org/statistics/c... Tracker: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Vulnerable HTTP Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2026-09-11 DEFAULT SEVERITY LEVEL: CRITICAL This report identifies hosts that have the Hypertext Transfer Protocol (HTTP) service running on some port that may have a vulnera...

IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': www.shadowserver.org/what-we-do/n... 218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. Patch info: documentation.n-able.com/N-central/Re...

huntress.comCritical N-able N-central Vulnerability and Active Exploitation | HuntressUPDATE: Critical vulnerability in N-able N-central gives attackers unauthenticated, "god-mode" access to the RMM console.

Background on incidents: www.huntress.com/blog/n-able-... #CyberCivilDefense

We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @greynoise.io. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'. Dashboard Tree Map stats: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Compromised Website Report | The Shadowserver FoundationThis report is a list of all the websites we (or our collaborative partners) have been able to identify and verify to be compromised.

Compromised Website Report: www.shadowserver.org/what-we-do/n... Thank you to @greynoise.io for the share! Background with info about the AI-orchestrated campaign behind the compromises (includes IOCs): www.greynoise.io/blog/ai-orch...

9 Sept

Since 2026-09-04 we are scanning/reporting daily unpatched versions of Plex Media Server in response to an advisory issued by Plex forums.plex.tv/t/important-... for v1.43.2 & earlier. Over 36K instances found still unpatched! Top affected: US World Map: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Vulnerable HTTP Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2026-09-09 DEFAULT SEVERITY LEVEL: CRITICAL This report identifies hosts that have the Hypertext Transfer Protocol (HTTP) service running on some port that may have a vulnera...

9 Sept

No CVEs have been issued meaning the vulnerabilities are invisible to the security community limiting an effective response. We tag the raw IP data shared 'vulnerable-plex' in Vulnerable HTTP reporting: www.shadowserver.org/what-we-do/n... Tracker: dashboard.shadowserver.org/statistics/c...

dashboard.shadowserver.orgTree map · General statistics · The Shadowserver FoundationDevelopment of the Shadowserver Dashboard was funded by the UK FCDO. IoT device fingerprinting statistics and honeypot attack statistics co-financed by the Connecting Europe Facility of the European Union (EU CEF VARIoT project).

9 Sept

Running an outdated Plex Media Server? Patch! Dashboard Tree Map view: dashboard.shadowserver.org/statistics/c...

The Shadowserver Foundation reposted

We added MikroTik SSH identification to our daily scans on 2026-09-04, in response to MikroTik's patches mikrotik.com/supportsec/s.... As discovered by CERT Polska cert.pl/en/posts/202... unpatched MikroTiks can be compromised, if device supports remote access using SSH protocol

shadowserver.orgINFO: Accessible SSH Report | The Shadowserver FoundationThis report identifies hosts that have the Secure Shell (SSH) service running and accessible on the Internet.

At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check). IP data shared daily in Accessible SSH reporting www.shadowserver.org/what-we-do/n... tagged 'mikrotik' & Device Identification reports: www.shadowserver.org/what-we-do/n...

Exploitation is reported in the wild. Review for compromise and patch!

PaperCut MF/NG incidents: At least 204 instances found on 2026-08-31 still vulnerable to CVE-2026-82078/CVE-2026-81578 RCE that is exploited in the wild. Make sure to check for compromise & patch. Top affected: US (60). Dashboard World Map view stats: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Vulnerable HTTP Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2026-08-31 DEFAULT SEVERITY LEVEL: CRITICAL This report identifies hosts that have the Hypertext Transfer Protocol (HTTP) service running on some port that may have a vulnera...

Daily IP data now in our Vulnerable HTTP reporting, tagged 'cve-2026-82078' & 'cve-2026-81578': www.shadowserver.org/what-we-do/n... Tree map view: dashboard.shadowserver.org/statistics/c... NVD entry: nvd.nist.gov/vuln/detail/... nvd.nist.gov/vuln/detail/...

papercut.comURGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)Short description of what is in the security bulletin

Patch info: www.papercut.com/kb/Main/secu... Make sure to install Emergency Patch (Release 3) - but assume compromise. Background on PaperCut incidents: www.huntress.com/blog/papercu... Detection based on Nuclei template by darses - github.com/projectdisco... #CyberCivilDefense

We are scanning & reporting daily on vulnerable Microsoft Exchange CVE-2026-62911 (Authentication Bypass by Capture-replay) instances in our Vulnerable Exchange reporting: www.shadowserver.org/what-we-do/n... At least 21899 IPs seen unpatched 2026-08-31, top US (6.2K) & Germany (5.1K)

dashboard.shadowserver.orgWorld map · General statistics · The Shadowserver FoundationDevelopment of the Shadowserver Dashboard was funded by the UK FCDO. IoT device fingerprinting statistics and honeypot attack statistics co-financed by the Connecting Europe Facility of the European Union (EU CEF VARIoT project).

Dashboard World Map view stats: dashboard.shadowserver.org/statistics/c... Dashboard Tree Map stats: dashboard.shadowserver.org/statistics/c... NVD entry: nvd.nist.gov/vuln/detail/... MS advisory: msrc.microsoft.com/update-guide... Daily IP data tagged 'cve-2026-62911'

ncsc.nlErnstige kwetsbaarheden in Microsoft Exchange Server | NCSCEr zijn meerdere ernstige kwetsbaarheden gevonden in Microsoft Exchange Server. Een van deze kwetsbaarheden is CVE-2026-62911, met een CVSS-score van 8.0. Voor deze kwetsbaarheid is exploitcode online...

See also NCSC NL advisory: www.ncsc.nl/alerts/ernst...

The Shadowserver Foundation reposted

Craig Newmark

@craignewmark.bsky.social

@shadowserver.bsky.social seriously helps protect us all

The Shadowserver Foundation@shadowserver.bsky.social

Alert! Zimbra compromises associated with CVE-2026-73570 exploitation are spreading. 274 instances seen compromised in our scans for exploitation artifacts on 2026-08-22. Top: US (41 IPs). Detection in collaboration with @CERT_Polska_en Public Dashboard: dashboard.shadowserver.org/statistics/c...

28 Aug

We are scanning/reporting Gitea instances vulnerable to CVE-2026-60004 (code injection), with 8393 IPs found vulnerable on 2026-08-27. This vulnerability is exploited in the wild and on US CISA KEV. Top affected: China, Germany, US Dashboard view: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Vulnerable HTTP Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2026-08-26 DEFAULT SEVERITY LEVEL: CRITICAL This report identifies hosts that have the Hypertext Transfer Protocol (HTTP) service running on some port that may have a vulnera...

28 Aug

IP data shared in Vulnerable HTTP reporting tagged 'cve-2026-60004': www.shadowserver.org/what-we-do/n... Patch Tracker: dashboard.shadowserver.org/statistics/c... Exploit code is public. Gitea advisory: blog.gitea.com/release-of-1... NVD entry: nvd.nist.gov/vuln/detail/... #CyberCivilDefense

View full thread

We also see at least 8200 CVE-2026-73570 unpatched instances (this does not mean exploitable as the vuln is in a non default config) dashboard.shadowserver.org/statistics/c... Check for compromise & update: wiki.zimbra.com/wiki/Zimbra_... CVE-2026-73570 is on CISA KEV www.cisa.gov/known-exploi...

#CyberCivilDefense

Data in Compromised Website reporting tagged 'zimbra-compromised' with detail set to 'Artifact from probable CVE-2026-73570 compromise' www.shadowserver.org/what-we-do/n... Compromised Zimbra tracker: dashboard.shadowserver.org/statistics/c...

17 Aug

RondoDox botnet now also trying to exploit the new GeoServer 0-day, as seen in our sensors. We see over 1500 exposed instances worldwide (exposed population, not a vulnerability check). Patch info: geoserver.org/announcement... Tree Map Dashboard stats: dashboard.shadowserver.org/statistics/i...

17 Aug

IP data in our Device ID reporting (exposure, not vulnerability check): www.shadowserver.org/what-we-do/n... Public POC available and being used. Check for compromise and patch.

16 Aug

We are also scanning & reporting Metabase IPs likely unpatched to CVE-2026-72898 SQLi, which is exploited in the wild & on @CISACyber KEV. 2171 unpatched (version check) instances seen 2026-08-15. Top: US (603), Germany (278) Dashboard World Map stats: dashboard.shadowserver.org/statistics/c...

shadowserver.orgCRITICAL: Vulnerable HTTP Report | The Shadowserver FoundationDESCRIPTION LAST UPDATED: 2026-08-14 DEFAULT SEVERITY LEVEL: CRITICAL This report identifies hosts that have the Hypertext Transfer Protocol (HTTP) service running on some port that may have a vulnera...

16 Aug

IP Data in our Vulnerable HTTP reporting tagged 'cve-2026-72898' : www.shadowserver.org/what-we-do/n... (since 2026-08-11) NVD entry: nvd.nist.gov/vuln/detail/... Metabase advisory & patch info: github.com/metabase/met...

We are scanning & reporting F5 BIG-IP APM CVE-2025-53521 instances thanks to collaboration with the NCSC-NL SRT. 10 months after vuln disclosure, we still see over 850 IPs vulnerable to potential RCE. Top affected: US with 199 & Japan 182. IP data in Vulnerable HTTP reporting.

cisa.govKnown Exploited Vulnerabilities Catalog | CISAFor the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative so...

This vulnerability is known to be exploited in the wild and on CISACyber KEV www.cisa.gov/known-exploi... F5 Advisory: my.f5.com/manage/s/art... Check your reports for IPs tagged 'cve-2025-53521'! Public Dashboard World Map: dashboard.shadowserver.org/statistics/c...

Vulnerable HTTP Report: www.shadowserver.org/what-we-do/n...

You can also track CVE-2026-59310 & CVE-2026-59309 vulnerable VMware vCenter instances in our daily Vulnerable HTTP reporting since July 30th: shadowserver.org/what-we-do/n... Tracker: dashboard.shadowserver.org/statistics/c... World Map: dashboard.shadowserver.org/statistics/c...

The Shadowserver Foundation@shadowserver.bsky.social

Thanks to collaboration with QUIRSO GmbH we are sharing the VMware vCenter CVE-2026-59310 Exploitation Victim Special Report shadowserver.org/what-we-do/n... Check compromised IPs for your network/constituency & remediate! File prefix: 2026-08-13-special See: medium.com/@quirso_de/a...