"Don’t take BADCANDY from strangers ..." The Australian Signals Directorate (ASD) recently published an advisory on the BadCandy implant still present in many Cisco IOS XE devices: www.cyber.gov.au/about-us/vie... We still see around 15 000 Cisco IOS XE devices with the implant

We added CVE-2025-40778 BIND9 tagging (potential susceptibility to cache poisoning) to our DNS scans: www.shadowserver.org/what-we-do/n... We found nearly 8898 unpatched DNS open resolvers on 2025-10-30, down to 6653 on 2025-11-01: dashboard.shadowserver.org/statistics/c...

Attention - Microsoft WSUS CVE-2025-59287 incidents! We are observing exploitation attempts based on a published POC. We have also began fingerprinting exposed WSUS instances (ports 8530/8531) with at least 2800 seen on 2025-10-25 (not necessarily vulnerable).

We are now sharing daily IP data on WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242 vulnerable instances, with over 71 000 seen on 2025-10-18. Data shared in our Vulnerable ISAKMP reportings - www.shadowserver.org/what-we-do/n... Top affected: US with 23.2K instances

Proud to support our Law Enforcement partners in another successful cybercrime disruption: Operation SIMCARTEL Great work everyone involved 👏 europol.europa.eu/media-press/...

Regarding F5 network compromise (see my.f5.com/manage/s/art...): We are sharing daily IP data on F5 exposures in our Device ID www.shadowserver.org/what-we-do/n... (device_vendor set to F5). ~269K IPs seen daily, nearly half in US. Geo breakdown: dashboard.shadowserver.org/statistics/i...

Oracle E-Business Suite incidents: We have added CVE-2025-61882 scanning & reporting with 576 potential vulnerable IPs found on 2025-10-06. Top affected: USA IP data in www.shadowserver.org/what-we-do/n... World map view of likely vulnerable instances: dashboard.shadowserver.org/statistics/c...

You can track CVE-2025-20333 & CVE-2025-20362 vulnerable (unpatched) Cisco ASA/FTD instances here - dashboard.shadowserver.org/statistics/c... Around ~45K vulnerable seen on 2025-10-04

Attention! Cisco ASA/FTD CVE-2025-20333 & CVE-2025-20362 incidents: we are now sharing daily vulnerable Cisco ASA/FTD instances in Vulnerable HTTP reports: www.shadowserver.org/what-we-do/n... Over 48.8K unpatched IPs found 2025-09-29. Top affected: US dashboard.shadowserver.org/statistics/c...

Last week we released a new daily report type, "Badsecrets Report": www.shadowserver.org/what-we-do/n... (default severity: HIGH) It identifies the use of known or very weak cryptographic secrets across a variety of web frameworks/platforms. 12168 IPs seen (2025-09-14) using "bad" secrets!

FreePBX CVE-2025-57819 (CVSS 10.0) incidents: 6620 unpatched instances seen 2025-08-29, at least 386 compromised. Dashboard links: Vulnerable (unpatched): dashboard.shadowserver.org/statistics/c... Compromised: dashboard.shadowserver.org/statistics/c...

Citrix NetScaler CVE-2025-7775 patch rate as seen in our scans: dashboard.shadowserver.org/statistics/c... dashboard.shadowserver.org/statistics/c... Down from 28.2K to 12.4K. Europe patching at faster rate than North America (toggle overlapping/stacked time series on our Dashboard to compare)

ALERT: On 2025-08-26 over 28K Citrix NetScaler instances were unpatched to CVE-2025-7775 RCE. There is exploitation in the wild confirmed by US CISA KEV. Patch info: support.citrix.com/support-home... Top affected: US, Germany Dashboard geo breakdown: dashboard.shadowserver.org/statistics/c...

We added a new daily scan report type, Accessible GPRS Tunneling Protocol (GTP) services listing IPs with publicly exposed GTP-C (Core) on port 2123/UDP & GTP-U (User) 2152/UDP. Report format: www.shadowserver.org/what-we-do/n... Dashboard World map: dashboard.shadowserver.org/statistics/c...

Since July 30th we are seeing an increase in scans coming from ~2200 compromised Cisco Small Business RV series routers, Linksys LRT series & Araknis Networks (AN-300-RT-4L2W). Top affected: US but also many others. IP data on these scans shared in www.shadowserver.org/what-we-do/n...

We added version based N-able N-central RMM CVE-2025-8875 & CVE-2025-8876 detection to our daily scans. 1077 IPs unpatched IPs seen on 2025-08-15. Both CVEs recently added to US CISA KEV. Top affected: US, Canada, Netherlands, UK Dashboard map view: dashboard.shadowserver.org/statistics/c...

Still a large number of unpatched Citrix NetScaler devices likely vulnerable to CVE-2025-5777 (3312 seen) & CVE-2025-6543 (4142 seen). Both vulns are on US CISA KEV list. The Dutch NCSC has recently released an update related to CVE-2025-6543 activity: www.ncsc.nl/actueel/nieu...

We added VMware ESXi CVE-2025-41236 (CVSS 9.3) version based detection to our daily scans. First added 2025-07-19 with 17,238 IPs found. Latest scan (2025-08-10) detects 16,330 unpatched IPs, which is a slow patch rate. Top affected: France, China, US, Germany

We added Microsoft Exchange CVE-2025-53786 detection to our daily scans (version based). See US CISA Emergency Directive 25-02: www.cisa.gov/news-events/... Over 28K IPs unpatched (2025-08-07). Top affected: US, Germany, Russia Dashboard world map: dashboard.shadowserver.org/statistics/c...

We added version based SonicWall SMA100 CVE-2025-40596 detection to our daily scans - at least 3200 IPs seen still unpatched! Top affected: US, Japan, Germany Dashboard map: dashboard.shadowserver.org/statistics/c... NVD entry: nvd.nist.gov/vuln/detail/...

PaperCut CVE-2023-2533 was recently added to the CISA KEV catalog. We added version based detection of unpatched IPs with 129 seen (2025-08-03). dashboard.shadowserver.org/statistics/c... We also scan for CVE-2023-39143 & CVE-2023-27350. Data in Vulnerable HTTP: shadowserver.org/what-we-do/n...

We’re excited to welcome SURFcert to the Shadowserver Alliance as a Bronze Tier Partner! Together with SURFcert and fellow Alliance Partners, we’re making the Internet more secure for all. Read more about SURFcert: www.surf.nl/en

SharePoint situational update: In collaboration with Validin & CERT-BUND we improved vhost & version based detection of SharePoint instances, resulting in ~17K IPs observed exposed. 840 with CVE-2025-53770 - version based detection only. At least 20 with webshells.

Emerging threats are countered most effectively when IR teams can share technical indicators to improve detection - helping identify, notify & remediate more victims. Great example: CVE-2025-25257 & FortiWeb shells. Saudi Arabian NCA and Canadian CCCS both helped protect victims globally!

Thanks to a scan conducted by @leakix.bsky.social, we have shared SharePoint IPs confirmed vulnerable to CVE-2025-53770, CVE-2025-53771. 424 SharePoint IPs found on 2025-07-23. One-off data in www.shadowserver.org/what-we-do/n... Tree map overview: dashboard.shadowserver.org/statistics/c...

Alert! We are scanning for unpatched CrushFTP instances vulnerable to CVE-2025-54309. This vulnerability is exploited in the wild: www.crushftp.com/crush11wiki/... We see 1040 instances unpatched on 20th July. Top countries affected: US, Germany, Canada dashboard.shadowserver.org/statistics/c...

Alert: SharePoint CVE-2025-53770 incidents! In collaboration with Eye Security & watchTowr we are notifying compromised parties. See: research.eye.security/sharepoint-u... ~9300 Sharepoint IPs seen exposed daily (population, no vulnerability assessment): dashboard.shadowserver.org/statistics/i...

Proud to support our international LE partners in Europol/Eurojust coordinated Operation Eastwood - another successful public/private partnership cyber threat disruption!

We are sharing Fortinet FortiWeb instances compromised with webshells likely via CVE-2025-25257. We see 77 cases on 2025-07-15, down from 85 on 2025-07-14. CVE-2025-25257 exploitation activity observed since Jul 11th. Tree map overview (compromised): dashboard.shadowserver.org/statistics/c...

Since start of July we are seeing Wing FTP Server CVE-2025-47812 RCE exploitation attempts. We are fingerprinting exposed Wing FTP Server instances to establish the potentially vulnerable population. We see ~2000 exposed (no vulnerability checks): dashboard.shadowserver.org/statistics/i...

Live Flax Typhoon Raptor Train botnet sinkholing data now available through our free daily Sinkhole Event and Sinkhole HTTP Event network reports: shadowserver.org/what-we-do/n... shadowserver.org/what-we-do/n... events tagged as "raptor-train" Remediate current infections!

New Special Report run in collaboration with LE partners on historical Flax Typhoon Raptor Train botnet infections: shadowserver.org/what-we-do/n... Filename prefix: 2025-07-07-special 732545 events, 179539 IPs, 2750 ASNs, 143 countries Check your reports for historical compromises

We are scanning for Citrix NetScaler CVE-2025-5777 (since 19/06) & CVE-2025-6543 (since 27/06) vulnerabilities. 1289 & 2100 IPs still seen unpatched as of 2025-06-29. Top: US & DE Tracker: dashboard.shadowserver.org/statistics/c...

Shadowserver, a member of the Common Good Cyber secretariat, is proud to help launch the Common Good Cyber Fund announced today. Special thanks to the UK and Canada for investing in the Fund and continuing to provide their steadfast support. commongoodcyber.org/news/common-...

Our digital resilience rests on underfunded nonprofit infrastructure—and it can unravel quickly Prevent costs far less than response. #CommonGoodCyber #CyberCivilDefense commongoodcyber.org/news/when-th... @gca.bsky.social @shadowserver.bsky.social

For the last few days, we are reporting out Roundcube CVE-2025-49113 vulnerable instances (allows remote code execution by authenticated users). Roundcube vulnerabilities have been frequently used for targeted attacks by possible state actors. We see ~84K unpatched worldwide.

We are happy to support our LE partners! www.justice.gov/usao-edva/pr...

We have shared a Special Report on IPs infected with Latrodectus malware during 2025-04-26 to 2025-05-20. This is one of the results of the continued international Law Enforcement action called Operation Endgame Season 2.0 Over 44K infected IPs seen: dashboard.shadowserver.org/statistics/c...

We’re excited to announce that CERT.LV (National CSIRT of Latvia) has joined the Shadowserver Alliance as a Bronze Tier Partner! Together we will raise the bar on cybersecurity. Read more about CERT.LV: cert.lv/en/ Become a Shadowserver Alliance partner today: www.shadowserver.org/partner/

You can also track CVE-2025-4427 exploitation attempts as seen by our honeypot sensors on our Dashboard: dashboard.shadowserver.org/statistics/h...

We are also scanning for Ivanti EPMM instances likely vulnerable (unpatched) to CVE-2025-4427 which can be chained with CVE-2025-4428 for RCE. First scans found 940 instances (2025-05-15), down to 798 (2025-05-18). Geo breakdown: dashboard.shadowserver.org/statistics/c...

We’re excited to announce that CERT.LV (National CSIRT of Latvia) has joined the Shadowserver Alliance as a Bronze Tier Partner! Together we will raise the bar on cybersecurity. Read more about CERT.LV: cert.lv/en/ Become a Shadowserver Alliance partner today: www.shadowserver.org/partner/

We are sharing ScreenConnect instances likely vulnerable to CVE-2025-3935 (CVSS 8.1, versions 25.2.3 & earlier may be susceptible to a ViewState code injection). Patch info: connectwise.com/company/trus... 685 instances still unpatched (2025-05-07): dashboard.shadowserver.org/statistics/c...

The dashboard has been built thanks to UK FCDO funding (www.gov.uk/government/o...) and holds 2 years worth of aggregated Shadowserver data for all to explore!

We are sharing SysAid instances likely vulnerable to CVE-2025-2775, CVE-2025-2776, CVE-2025-2777 (XXEs) any of which combined with CVE-2025-2778 allows for RCE. 77 IPs found unpatched so far (version check). Install updates from SysAid (from March!) documentation.sysaid.com/docs/24-40-60

Check out our latest Dashboard updates that now highlight compromised devices & post-exploitation frameworks/C2s discovered in scans, as well as various functionality improvements: dashboard.shadowserver.org#compromised-... dashboard.shadowserver.org#post-exploit...

Attention! We are sharing SAP NetWeaver instances vulnerable to CVE-2025-31324 unauth upload (CVSS 10.0). 454 IPs found vulnerable on 2025-04-26. If you receive an alert from us, make sure to check for signs of compromise (incl. webshells). World Map: dashboard.shadowserver.org/statistics/c...

📣 Proud to announce Identity Digital has joined the @shadowserver.bsky.social Alliance! Together, we will work to protect users from emerging online threats and make the Internet safer. 🤝🛡️ Learn more: www.businesswire.com/news/home/20... #cybersecurity #domains

We’re excited to announce that Identity Digital has joined the Shadowserver Alliance as a Bronze Tier Partner! Together we will work to make the Internet safer and more secure. Read more about Identity Digital: www.identity.digital/company

Attention! Check your Compromised Website Report for critical events tagged “fortinet-compromised” and follow Fortinet's mitigation advice on compromised devices: fortinet.com/blog/psirt-b... Data available from 2025-04-11+ shadowserver.org/what-we-do/n...