Silas Cutler

🚨 Rapid Response: Two critical PHP RCE flaws (CVE-2026-109618/109619), both CVSS 9.2. Censys observes ~2.58M exposed hosts and ~54.9M web properties running PHP. Exposure does not confirm vulnerability. Patch immediately! Full advisory and Censys queries: https://bit.ly/4zLmDML

🚨 Rapid Response: Critical AnyDesk Linux RCE (CVE-2026-109390, CVSS 9.8). Public exploit available. Censys detects 175,838 Internet-exposed AnyDesk hosts on TCP 7070 (not confirmed vulnerable). Censys ARC advisory: https://bit.ly/47jqCEh

Censys ARC researcher @silascutler.bsky.social examines an exposed server containing Moobot botnet source code, active attack records, additional DoS tooling, and a fraudulent identity verification service. Full analysis of what the exposed directory revealed: https://bit.ly/3SUCPvz

Armitage and Metasploit Collaboration (NoVa Hackers - May 2011) I thought this one was lost. One of my earliest talks on the red team collaboration vision for Armitage and some reflection from using it in some 2011 exercises. www.youtube.com/watch?v=Mjr9...

⏰ Just a few short days left to get your CFP in for 🆘 Volume II We exclusively showcase research into state-sponsored operations, demonstrate how the landscape is changing, and what sits on the horizon. Deadline is Aug. 14. Submit here 👉https://stateofstatecraft.com/cfp 🧵 1/N

New #Boston conference just dropped

New Shitty Kitty V2 inventory available for pickup at #defcon34 at uberflux.com/product/UF-SK2 @defcon.bsky.social #defcon #badgelife

Registration and CFP for 🆘VOLUME II is officially OPEN! On October 22, 2026, we return to Brussels to showcase a day of community and discussions on the latest developments in state-sponsored operations and the actors & institutions that champion them.

🚗

Harness, Scaffold, and the AI Agent Terms Worth Getting Right https://huggingface.co/blog/agent-glossary

Start your weekend off right by watching the amazing @arianamirian.bsky.social talk about the way those gross text scams work and how she's working to disrupt their whole situation. youtu.be/5ArUiAjBoB8?...

Five years ago today Philip Reiner, Michael Daniel, John Davis, Jen Ellis Christopher Painter, Michael Phillips, Kemba Walden and I, together with the then tiny but mighty IST team and the essential input of the 60 plus Task Force participants, launched the #RansomwareTaskForce Report.

Countdown is real ⌛️ Next week‼️ #ThreatResearch community gathers in Málaga 🇪🇸 Time to remind our PIVOTcon song: soundcloud.com/argonix/pivo... But watch out — it's a banger! #CTI #ThreatIntel #PIVOTcon26

LABScon 2026 Call for Papers is open. Sept 16–19, Scottsdale. Invite-only. Fifth year.

Bay Area hackers GO SEE THIS MOVIE. Trust your boy. It’s great!

One of the best pieces I’ve seen on the omnishambles of the FTC, by @masnick.com www.techdirt.com/2026/04/16/o...

I've been uploading #hacking magazines from #China, some of which have been removed for reasons I don't understand, to Internet Archive. This is a decent scan of an issue of Hacker Defence (or Hacker Defence Line?) from I think the early to mid 00s. #hacker #history archive.org/details/hack...

NEW: The U.S. Treasury is sanctioning a Russian zero-day broker called Operation Zero. U.S. officials confirmed that Operation Zero was the company that bought exploits stolen by the former boss of U.S. defense contractor L3Harris Trenchant. Trenchant made hacking tools for the U.S. and its allies.

Our blog at @Censys now has a proper RSS feed https://censys.com/feed/ (cc: @Feedly #GoogleReader)

I've been seeing Vshell in #opendirs for a few years. With the recent attention, it was time to do a proper write-up on it: https://censys.com/blog/vshell/

Check out the agenda for [un]prompted . It was incredible to see what folks submitted and I'm excited to see everyone in March https://unpromptedcon.org/

#InternetOfPlants

🔥 👀 New research from @morecoffeeplz.bsky.social and @silascutler.bsky.social on the "silent" AI network, a massive, unmanaged layer of open-source AI infrastructure operating in the shadows.

New research from @silascutler.bsky.social and myself. We tracked 175k exposed Ollama endpoints for nearly a year. Collected and analyzed custom models, sizes, quantizations, system prompts, and more.

How do you track DDoS infrastructure when C2 servers rarely last a day? @vtx-savage.bsky.social and @silascutler.bsky.social are breaking down real-world DDoSia hunting using the Synapse-Censys Power-Up in our next webinar. vertex.link/events/censy...

Join me next week at the @SANSInstitute #CTISummit in Arlington, VA where I'll be presenting on an operation against the infostealer #Rhadamanthys from early in its development. Register @ https://www.sans.org/u/1CtB

We're hosting a webinar with @censys.bsky.social! Attackers can rotate infrastructure faster than threat hunters can keep up. Learn how defenders can pivot from indicators to infrastructure-centric intelligence. @vtx-savage.bsky.social + @silascutler.bsky.social vertex.link/events/censy...

Come see me talk at the @SANSInstitute #CTISummit in Arlington, VA about the infostealer #Rhadamanthys during its early development. https://www.sans.org/u/1CtB

What a quote.

Critical MongoDB Uninitialized Memory Disclosure Vulnerability [CVE-2025-14847] #MongoBleed From Censys scanning, we're seeing around 87,000 possibly vulnerable hosts https://censys.com/advisory/cve-2025-14847

🚨🚨🚨 PATCH YO' MONGODB - PUBLIC POC AVAILABLE 🚨🚨🚨 m.cje.io/4q2Bi1Y

ColdFusion++ Christmas Campaign: Catching a Coordinated Callback Calamity https://www.labs.greynoise.io/grimoire/2025-12-26-coldfusion/

Some unusual #CobaltStrike activity we observed at Censys before the holiday. At the start of December, we saw a spike in CobaltStrike in AS138415 followed by a matching spike two days after on AS133199. Report: https://censys.com/blog/recap-of-a-suspicious-surge-in-cobalt-strike

I'm speaking at the @SANSInstitute #CTISummit on an operation against #Rhadamanthys years before #OperationEndgame. https://www.sans.org/u/1CtB

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA. CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it. My story: www.cybersecuritydive.com/news/cisa-ra...

I’m old enough to remember when CBS News would never have surrendered to a demagogic president or any other politician. Remember Edward R. Murrow?

For anyone looking to optimize their news feeds, I've been using Miniflux (https://miniflux.app/) as an RSS reader for the past few years. Recently I found it also works well for tracking newly released mechanical keyboards.

#DistillingCyber podcast is back with a special episode featuring Stacy O'Mara & Leonard Bailey. Tune in to explore whether offensive cyber operations should be used to counter cyber threats — if so, who should be authorized to carry them out? www.centerforcybersecuritypolicy.org/insights-and...

https://unpromptedcon.org/ Con: 3-4 March 2026 CFP closes 28 January 2026, Submit at https://sessionize.com/unprompted-the-ai-security-practitio/

NoName057(16) are still active despite last week's DOJ indictment. We looked into how their DDoSia platform works: https://censys.com/blog/ddosia-infrastructure

I'm sorry if I'm behind on replying to email. I'm at this point for reference

New threat, Kazu ransomware. @ecrime.ch has new information on this threat actor. Kazu has claimed ~35 mostly public sector victims across Latin America, the Middle East, and Asia. 👀 cc @gate15.bsky.social @ransomwaresommelier.com @silascutler.bsky.social #cybersecurity #ransomware

Part 2 of @DomainTools research is out: Inside the Great Firewall Part 2: Technical Infrastructure https://dti.domaintools.com/inside-the-great-firewall-part-2-technical-infrastructure/