chief honeypot @defusedcyber
☠ 💻 🔑 🛡 cyberspace
- Tweets 5,420
- Following 328
- Followers 3,311
- Likes 11,284
Pinned Tweet
Easter holidays and a Fortinet 0-day - a match made in heaven 🐰
(also my first credited CVE 😇)
🚨 New Fortinet vulnerability being exploited as an 0-day
CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical
After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure.
Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6.
The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests.
This discovery was made through our upcoming Radar feature launching next week 😇
Advisory: fortiguard.com/psirt/FG-IR-2…
Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar 👉 console.defusedcyber.com/sig…
Credit also to @heckintosh_ for independently discovering this vulnerability 💪
5
15
113
39,482
something else than PHP for a change
🚨 Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27.
The bug was recently disclosed by @Horizon3ai and patched in Oracle's October CPU. No public report exists of this CVE being attempted in the wild.
Full IOCs on Defused Radar 👉 console.defusedcyber.com/sig…
1
3
7
1,054
🍯🍯🍯
⚠️php2shell (CVE-2026-109618 and CVE-2026-109619): we’re seeing “P2SB” multipart probes hitting our Palo Alto GlobalProtect honeypots.
The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker (“p2s-rider”) and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.
Source is a known mass-exploit IP: 204.76.203.]7 (AS51396 Pfcloud UG, NL)
Track php2shell exploitation on Defused 👉 console.defusedcyber.com/sig…
4
377
"Your website is vuln. Contact blue team https://pentest-tools.]com/ now and update ur webapp fast."
This can't be legitimate 😂
5
9
970
Simo retweeted
We wrote up how to find every PHP service you run, including the ones on odd ports, under sub-paths, inside appliances and containers, and how to patch and verify them.
Commands plus prompts for your coding agent.
We also started SecureTheWeb.org
It checks Chaos for services running an affected version and emails their security@ inbox for free, with the fix.
We are enriching Chaos over the coming months so the next time a bug like this lands, the affected services are mapped fast and remediation starts sooner.
Read: go.projectdiscovery.io/SIC1T…
5
53
210
25,926
Simo retweeted
Please don't fall to slop generated exploits. There are no currently public working PoCs on the CVE-2026-109618 and CVE-2026-109619.
The one published by J4ck3LSyN provide no path that makes PHP interpret the sprayed bytes as a callable implementation.
Read more below 👇
8
18
246
45,943
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.siddz.com/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
54
408
3,086
395,154
Simo retweeted
AI won't replace offensive security, but it's changing what we can achieve during real engagements.
I'm considering a 2-day advanced hands-on training on Augmented Pentesting, sharing how I use LLMs for n-day research and exploitation.
Not perfect, but tested and proven during real-world engagements.
The question is:
Would you be interested?
-------------
🇫🇷
L'IA ne remplacera pas la sécurité offensive, mais elle change déjà ce que nous pouvons accomplir lors de nos missions.
J'envisage de proposer une formation technique avancée de 2 jours sur le Pentest Augmenté, pour partager la manière dont j'utilise les LLM dans la recherche et l'exploitation de vulnérabilités n-day.
Une approche qui n'est pas parfaite, mais qui a été testée et éprouvée lors de missions réelles.
La question est donc : est-ce que ça vous intéresserait ?
10
6
40
2,720
🍯🍯🍯🍯
🚨 Our Redis decoys recorded repeated scripted attempts to exploit CVE-2026-25243, a heap memory-corruption bug in Redis’s RESTORE command, overnight Oct 16-17. No prior public report exists of this CVE being attempted in the wild.
One source hit the decoy five times on a timer with a identical payload: fingerprint the server, shape the heap with 26 key writes, fire a single malformed-zipmap RESTORE that triggers the documented over-read, run a throwaway Lua compute probe, then FLUSHALL the keyspace, destroying data and its own artifacts every run. Note that the bug needs command access to be exploitable.
Full IOCs on Defused Radar 👉 console.defusedcyber.com/sig…
5
24
1,508
Featuring @DefusedCyber 👌🍯
Ivanti warns of Connect Secure zero-day exploited in attacks
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
8
449
Advisory for this vuln: hub.ivanti.com/s/article/Sec…
🚨 Our Ivanti Connect Secure decoys caught pre-disclosure exploitation we assess as CVE-2026-104935. Activity was recorded on Oct 1st, twelve days before Ivanti’s advisory, on both our public honeypots and customer instances.
The exploit ran an unauthenticated bypass to plant an implant that runs entirely in memory and writes no files to disk - which is potentially why the advisory ships with no reliable IOCs.
Full fingerprint + IOCs on Defused Radar 👉 console.defusedcyber.com/sig…
3
25
1,407
😮💨🍯🍯🍯
🚨Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate access path SSRF, CVSS 10.0) was disclosed earlier this week by SonicWall. We notified Defused subscribers of the anomalous traffic via our Radar functionality.
Full capture + what differs from known tooling on Defused Radar 👉 console.defusedcyber.com/sig…
2
21
973
IPs that hit our NetScaler sensors on September 17th with the deflate payloads against SAML surface (probe/1 UA):
194[.]77.94.40 2,804 → 63,488B 'G'
103[.]171.122.41 1,759 → 62,464B 'G'
157[.]85.104.79 2,862 → 62,534B 'G'
102[.]18.119.22 1,756 → 62,464B 'G'
46[.]247.43.50 117 → 98,304B 'P'
103[.]112.0.110 78 → 272 B valid-XML canary
2
25
87
5,830
Simo retweeted
🐝🍯🍯🍯🍯🍯🍯🍯
🚨 In addition to the IPs on circulating on social media, some additional IPs we are observing interacting with .ctxs.receiver webshells (Citrix Netscaler) on our decoys:
194[.]127.166.19
194[.]127.166.32
194[.]127.166.36
194[.]127.166.70
194[.]127.166.126
103[.]214.20.54
81[.]94.239.8
We're also seeing multiple actors sending the crafted Pitboss log entry in-request (pre-exploit). This is possibly a variation on CVE-2026-88771 exploitation, but we have not confirmed it works.
Track Citrix Netscaler activity live 👉 console.defusedcyber.com/sig…
1
1
24
3,922
🍯🍯🍯
🚨 In addition to the IPs on circulating on social media, some additional IPs we are observing interacting with .ctxs.receiver webshells (Citrix Netscaler) on our decoys:
194[.]127.166.19
194[.]127.166.32
194[.]127.166.36
194[.]127.166.70
194[.]127.166.126
103[.]214.20.54
81[.]94.239.8
We're also seeing multiple actors sending the crafted Pitboss log entry in-request (pre-exploit). This is possibly a variation on CVE-2026-88771 exploitation, but we have not confirmed it works.
Track Citrix Netscaler activity live 👉 console.defusedcyber.com/sig…
4
21
2,406
We have entered the era of stealth exploits (encoding a single character to bypass security controls)🍯🍯🍯
🚨 We are seeing in-the-wild exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-76504 / API auth bypass) in our honeypots since Sep 30 UTC, about seven hours after Cisco's advisory. Attackers are hex-encode the login path (/%6a_security_check) to slip past the auth rule and reach the admin API.
Source IPs and the full indicators are available on Defused Radar.
console.defusedcyber.com/sig…
7
23
1,689
Simo retweeted
🚨Per @watchtowr research, CVE-2026-88771 (Citrix NetScaler) is exploitable across multiple paths (any logged field works)
We have observed hundreds of hits on our decoys in the last 24h across:
• /nf/auth/doAuthentication.do
• /cgi/login
• /p/u/doLogon.do
• /logon/LogonPoint/tmindex.html
• / (payload in the User-Agent header)
Post-exploit intent we're seeing includes:
→ whoami/id to prove root
→ marker files (nx_verify.html) to tag vuln boxes for a target list
→ curl/wget/fetch pulling stage-2
→ blind DNS callbacks
Full IOCS are available on Defused Radar
6
19
73
5,900
Google / Mandiant linked this activity to ShinyHunters! cloud.google.com/blog/topics…
🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation.
Source IPs and the full indicators are available on Defused Radar.
console.defusedcyber.com/sig…
2
10
55
6,669
Simo retweeted
timely.
I wonder what news about Oracle PeopleSoft made some threat actors hone in on this vuln's capabilities???
🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation.
Source IPs and the full indicators are available on Defused Radar.
console.defusedcyber.com/sig…
2
9
36
3,582
🍯🍯🍯
🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation.
Source IPs and the full indicators are available on Defused Radar.
console.defusedcyber.com/sig…
5
15
2,345