‼️CVE-2026-41940: cPanel & WHM Authentication Bypass (CVSS 9.8 Critical)  A critical authentication bypass has been discovered in cPanel & WHM. Modat Magnify Query:  (technology="cPanel" or web.html~"/cPanel_magic_revision_" or web.headers~"whostmgrrelogin") and tag!=honeypot

New Modat research: Belastingdienst-themed phishing hitting Dutch taxpayers, mostly aimed at crypto wallets.  Notable shift: attackers ditching backends for direct Telegram bot exfil. Full research: www.modat.io/post/phishin...

Focusing on Iran's "blackout" misses the bigger picture.  New research across 8 countries. Three strategies: mediation, deception, stabilisation. None of them silence.  Read full research: www.modat.io/post/beyond-...

⚠️CVE-2026-34486: Fail-open regression in Tomcat Tribes may lead to unauth RCE. If TCP/4000 is reachable & gadget classes exist on the classpath, unencrypted packets can trigger code execution via bypassed encryption. Affected: 11.0.20, 10.1.53, 9.0.116. Update now! Query: technology="Apache Tomcat"

New research by Modat & Recorded Future reveals how attackers automate defense evasion in a modular cryptomining campaign. Explore the findings: www.modat.io/post/neutral...

⚠️ CVE-2026-33032 (CVSS 9.8) in Nginx UI ≤2.3.5 allows unauthenticated takeover via exposed /mcp_message endpoint (missing auth + fail-open IP whitelist). Attackers can control configs & service. No patch, restrict access now. Query: web.title~"nginx ui"

Citrix fixed CVE-2026-3055 (9.3) & CVE-2026-4368 (7.7) in NetScaler ADC/Gateway. A memory overread may leak data and a race condition can cause session mix-up. Check - (SAML IdP / Gateway / AAA). Query: product="Citrix Gateway" OR product="Citrix ADC" OR web.title~"NetScaler Gateway" tag!=honeypot

⚠️ CISA added CVE-2025-66376 to KEV after active exploitation of Zimbra Collaboration Suite. A stored XSS in the Classic UI allows script injection via HTML emails; opening them can trigger in-session execution and enable mailbox access or session hijacking. Query: product="Zimbra Collaboration"

⚠️️ CISA added CVE-2025-68613 (CVSS 10.0) to KEV. Together with CVE-2026-27577 & CVE-2026-27493, n8n workflow expression flaws allow remote code execution and credential theft, potentially leading to full instance compromise. Patch now.  Query: web.title~"n8n.io - Workflow Automation" tag!=honeypot

CISA added CVE-2026-22719 to KEV after active exploitation of VMware Aria Operations (incl. Cloud Foundation & vSphere Foundation). Patch immediately. Query: web.html~"com.vmware.vsphere.client" OR web.title~"VMware Cloud Director Availability" OR web.title~"VMware Aria Operations"

⚠️ CISA added CVE-2026-20127 to its KEV catalog and issued ED 26-03 after active exploitation of Cisco Catalyst SD-WAN. An auth bypass lets unauthenticated attackers gain admin access and manipulate SD-WAN configs. Patch now. Modat Magnify Query: web.html~"Cisco SD-WAN" OR web.html~"Cisco Catalyst"

CISA added CVE-2025-49113 & CVE-2025-68461 to its KEV catalog after active exploitation of Roundcube Webmail. A 9.9 deserialization flaw enables authenticated RCE, while an SVG animate XSS allows script injection. Patch 1.6.12 / 1.5.12+. Modat Magnify Query: web.title~"Roundcube Webmail"

⚠️ Active exploit. of SolarWinds Web Help Desk. Internet‑exposed WHD hit via unauth RCE. Attackers use Zoho RMM for persistence, Velociraptor for C2/recon/exfil, Cloudflare for access, then disable Defender/firewall. WHD <12.8.7 HF1 is vulnerable. Patch 2026.1+ Magnify Query: web.html.mmh3=1424519104

⚠️CVE-2026-25253: 1-click RCE in OpenClaw. A crafted link leaks gateway tokens via WebSocket, enabling host command execution even on localhost. Fixed v2026.1.29 patch & rotate tokens. Query: web.title~"Clawdbot Control" OR web.title~"OpenClaw Control" OR web.title~"Moltbot Control"  magnify.modat.io

Latest research: Moldbot exposed across 53 countries.  
1,487 hosts leaking data via mDNS, 635 public control panels, and credential artifacts tied to Signal, Telegram & WhatsApp. 
Full research👉 www.modat.io/post/moldbot...

⚠️ CISA added CVE-2026-24858 to its KEV catalog after active exploitation of Fortinet FortiOS via FortiCloud SSO. An auth bypass lets attackers with a FortiCloud account access other tenants’ devices, enabling admin access and config abuse. Patch now. Modat Magnify Query: os="FortiOS" product~"Forti"

⚠️ CISA added CVE‑2024‑37079 to its KEV catalogue after confirmed in‑the‑wild exploitation of VMware vCenter Server. An out‑of‑bounds write in the DCE/RPC protocol allows unauthenticated network‑based RCE via crafted packets. Patch immediately. Modat Magnify Query: product="VMware vCenter"

⚠️ CVE-2026-21962 (CVSS 10.0) impacts Oracle Fusion Middleware, including Oracle HTTP Server and WebLogic Proxy Plug-Ins. Unauthenticated attackers can gain full system control and pivot across environments. Apply Oracle’s January 2026 Critical Patch Update immediately.

⚠️ CISA has added CVE-2025-8110 to its KEV catalog after active exploitation of public-facing Gogs instances. The flaw bypasses a prior RCE fix via improper symlink handling, allowing authenticated attackers to overwrite files and achieve remote code execution. Modat Magnify Query: technology="Gogs"

Cyber Monday Deal 
Get 6 months of Modat Magnify Pro for just €5 total (save €355).  Use code: MODAT2025CYBERMONDAY   
Try the platform. Run advanced queries. Find what others miss. 
 magnify.modat.io 
#CyberMonday #Cybersecurity #OSINT

New Research – Global Impact: Over 1.2 million internet-connected healthcare devices and systems with exposure that endanger patient data.   Findings across 70+ different types of medical devices & systems: MRI, CT, X-rays, hospital management systems, others 
 
👉 Read the full blog:
bit.ly/4fqfKrv

🚨 Cisco fixed CVE-2025-20309 — a root-level backdoor in Unified CM. Affected users must update to 15 SU3 or patch now. Try this query: one_service(product="Cisco UCS Manager") and one_service(port=22 service=ssh) The platform: magnify.modat.io #Modat #CVE202520309 #ModatMagnify #Cisco

🚨 Citrix fixes critical NetScaler bug CVE-2025-5777—patch ASAP. Out-of-bounds flaw similar to CitrixBleed may expose session token. Affects gateway-configured devices. Upgrade + kill active sessions. #citrix #CVE-2025-5777 #modat #modatmagnify Try this query: magnify.modat.io/search?query=p…

🚨 New Feature Finding: Using Device DNA Tag Water Management, we uncovered exposed pump controllers in wastewater systems. A potential gateway for disruption. Platform: magnify.modat.io 
Post: www.linkedin.com/feed/update/...

New in Modat Magnify v1.2.0: • Host-level search • AI Query Assistant • Wildcard DNS search 🧠 Try it free: bit.ly/3ZpvmER #ModatMagnify #CyberSecurity #ThreatIntel

🚦 We found exposed traffic control systems online — and the risk isn’t just red lights. Read how attackers could disrupt urban safety in our latest research using Modat Magnify: tinyurl.com/2jpnhzxe #ModatMagnify #CyberSecurity #SmartCities #FeatureFinding

🚨 CVE-2025-3248 in Langflow is under active exploitation. 
Unauth RCE via exposed endpoint.  
Try with Modat Magnify:  Run → product="Langflow"   
magnify.modat.io  
#Langflow #CVE-2025-3248 #RCE #ModatMagnify #CyberSecurity #CISA #VulnerabilityAlert #LLM #RemoteCodeExecution #Infosec #ThreatIntel

🚨 CVE-2025-2905: XXE vuln in WSO2 API Manager v2.0.0 & older. 
Unauthorisez attackers can read files or DoS your service. 
 Try with Modat Magnify: 
Run this query → web.title="WSO2 API Manager" 
magnify.modat.io  
 Free access until July 1  #CVE-2025-2905 #XXE #ModatMagnify #ThreatIntel #Infosec

🚨 CVE-2025-31324 in SAP NetWeaver allows unauth RCE via file upload. Try with Modat Magnify: Run → product="SAP NetWeaver" magnify.modat.io #ModatMagnify #CVE-2025-31324 #CyberSecurity

🚨 CVE-2025-3616 in Greenshift WP plugin allows RCE via subscriber uploads.  
Update to v11.4.6+ now. 
 Try with Modat Magnify:  
Run → technology="WordPress" web.html~"greenshift" 
magnify.modat.io 
 #ModatMagnify #WordPress #RCE #CVE-2025-3616

🚨CVE-2025-30406 is under active exploit — 7 orgs hit. 
Update CentreStack & Triofox now.  
Try with Modat Magnify: 
Run → web.headers~"Set-Cookie: y-glad-state" 
magnify.modat.io  
#ModatMagnify #CyberSecurity #RCE #CVE202530406 #ModatMagnify #CentreStack #Triofox #VulnerabilityAlert #PatchNow

🚨 New Series Modat Magnify: Feature Findings Kicking series off w/ Case Management ‘Device DNA’ tag. Relevant research for National & Government CSIRTs See our findings & further research: bit.ly/3EcA5SZ 
Tag discoveries w/ #ModatMagnify #research #certs #CSIRT #cybersecurity

🚨 CVE-2025-2805 - Critical WordPress plugin flaw 
ORDER POST plugin (≤2.0.2) lets unauth attackers run arbitrary shortcodes in WP. 
RCE possible.  
Check exposure with Modat Magnify:  technology=Wordpress  
magnify.modat.io  
#WordPress #CVE20252805 #Infosec #ModatMagnify

🚨 CVE-2024-48887 — Critical FortiSwitch flaw (CVSS 9.3)   
Affected: 6.4.0–7.6.0 
Patch ASAP or disable HTTP/HTTPS admin access. 
Find exposed assets with Modat Magnify: 
cert~"FortiSwitch"   
magnify.modat.io   
#CVE-2024-48887 #Fortinet #FortiSwitch #Cybersecurity #Infosec #Vulnerability #PatchNow

🚨 CVE-2025-2704 A critical OpenVPN flaw lets attackers crash servers or run remote code. Over 3.2M services at risk. Check exposure with Modat Magnify, try using this query: protocol=openvpn Start here: magnify.modat.io #CVE20252704 #OpenVPN #Cybersecurity #ModatMagnify #OSINT #Vulnerability

🚨CVE-2025-22457   @Mandiant confirms critical Ivanti Connect Secure RCE vulnerability  📌CVE: bit.ly/4iTpKdD   📊136K+ services found magnify.modat.io   Basic Query bit.ly/3E50TEB  Device DNA bit.ly/4jcSuOV  #ModatMagnify #CVE202522457 #Ivanti #ThreatIntel #UNC5221 #APT #DFIR

Modat Magnify Alert: 
We’ve identified ~2,500 exposed CrushFTP instances worldwide.  According to @shadowserver.bsky.social ~1,800 may be vulnerable to CVE-2025-2825 (CVSS 9.8) — an auth bypass via HTTP(S) that can be exploited magnify.modat.io/search?query...  #ModatMagnify #crushftp #infosec #cve

New Device DNAs just dropped on Modat Magnify:
🖥️ KVM over IP (NanoKVM, JetKVM, PiKVM)
🛠️ BMC (e.g. Supermicro)

Available for Pro+ users.
→ magnify.modat.io #Cybersecurity #ThreatHunting #ModatMagnify #DFIR

‼️Critical Vulnerability Alert‼️  CVE-2025-29927 (CVSS 9.1) @nextjs.org Middleware Bypass Vulnerability   Query Below👇   🔗 Modat Magnify found 376K at-risk devices: magnify.modat.io/search?query...   📝  References:  nextjs.org/blog/cve-202... nvd.nist.gov/vuln/detail/... #cve2025_29927 #zerotrust

🚀 Introducing Modat Magnify: Access the Largest Internet ‘Device DNA' Dataset Launching Modat Magnify, AI-powered and research-driven. Designed by and for cybersecurity pros. Stop searching and start finding. 🔗 Get started for FREE: www.modat.io/post/introdu... #Cybersecurity #ModatMagnify #Modat

Researchers discovered 49,000 misconfigured and exposed Access Management Systems (AMS) across multiple industries and countries, which could compromise privacy and physical security in critical sectors.

‼️New Research Exposes Critical Security Risks: Misconfigured Access Management Systems Our latest report, “Doors Wide Open: Hundreds of Thousands of Employees Exposed; Thousands of Organisations Physically Vulnerable,” reveals a widespread security threat. www.modat.io/post/doors-w...

🚀 Something Big Is Coming - Waitlist Now Open for our premier product, Modat Magnify.   Modat Magnify is a faster, smarter, easier way for cybersecurity professionals to stop searching and start finding.   Sign up now waitlist2025.modat.io/join-the-wai...  and be the 1st to experience Modat Magnify.