@ethicalhack3r
Account based inSpain
About this account
- Account based in
- Spain
- Connected via
- France App Store
Account-level information from X, not a live location or the device used for a specific post.
• Vulnerability & Threat Intelligence at https://xitter.cf/t.co/pRPrjARoN2 • Founder of @_WPScan_ (acquired by Automattic) • Founder of DVWA • Ethical Hacking Graduate
Joined June 2009
- Tweets3.8K
- Following842
- Followers21.2K
- Likes15.3K
Ryan Dewhurst retweeted
A breath of fresh air? Something other than PHP2Shell...
We detected an exploitation attempt against our FortiSIEM honeypot decoy, targeting CVE-2026-106173, Fortinet FortiSIEM’s path traversal vulnerability.
The request matches the file overwrite mode in @Horizon3ai PoC, published on 20 October 2026.
Observed on 23 October at 09:43:32 UTC: one request from one source IP (85.192.29[.]68).
• POST /phoenix.phoenixSvc/SendQueryResult
• HTTP/2 over TLS on TCP port 27918
• Twelve ../ sequences in the query-id header, targeting /tmp/.fsmprobe
• A 7-byte gRPC body carrying empty file contents
The request attempted to overwrite /tmp/.fsmprobe with an empty file. It contained no shell commands. This capture does not confirm a successful file write or code execution.
Upgrade to FortiSIEM 7.5.1 or later, following Fortinet’s advisory.
Restrict access to TCP 27918 and investigate unexpected /tmp/.fsmprobe artifacts.
Details and updates 👇
In the age of AI, it's becoming clear that, AI output will be perceived as fast and cheap, and human output will be perceived as slow but premium.
Shocking! 😲
We're now seeing upload progress probes for PHP’s critical RCE vulnerability, CVE-2026-109618.
Our honeypots captured three HTTP requests from two source IPs, including PHP test code embedded in upload filenames.
Timeline (UTC):
• 20 Oct, 19:45: Previdian early-warning email sent.
• 21 Oct, 13:05: First attempt captured by our sensors.
• 21 Oct, 13:27: Follow-up warning emailed.
• 21 Oct, 13:30: PHP security fixes released.
• 21 Oct, 15:15: Previdian’s temporary virtual patch available.
Our initial warning preceded our first sensor observation by approximately 17 hours 21 minutes.
The evidence and IoCs:
• Observed source IPs: 166.1.90[.]109 & 43.134.82[.]85
• Multipart POST requests to /
• Fields: PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS
• Two requests used the upload filename: .txt
Attackers did not manage to execute PHP or upload files in these first instances.
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your vendor’s patched package.
Ryan Dewhurst retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).
We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
Ryan Dewhurst retweeted
We are behind you and that will not change, PM tells Zelensky bbc.in/4yklpHe
Ryan Dewhurst retweeted
Around 80% of vulnerabilities in Previdian's KEV dataset can be exploited without authentication. The remaining 20% require credentials.
CVE-2026-105740 (Langflow) is one of that 20%.
First, they checked whether Langflow's auto-login feature was enabled. When they found it disabled, they switched to trying common, weak credentials.
After successfully authenticating, they immediately attempted to exploit CVE-2026-105740 to access environment variables and perform other actions.
We first observed exploitation attempts on September 19, but activity increased dramatically following the CVE's publication on October 5.
If you're running Langflow, disable auto-login, enforce strong passwords, ensure all patched, and review suspicious authentication and MCP API activity.
We observe exploitation attempts targeting numerous vulnerabilities every day across our honeypot network. There's simply too much activity for us to post about everything.
Don't rely on social media to stay ahead of emerging threats. Sign up to Previdian to stay informed about the vulnerabilities attackers are actively targeting daily.
⚠️1,423 Langflow RCE exploit attempts hit Previdian honeypots from 27 IPs.
The bug lets authenticated users, even non-admins, run OS commands through MCP server configs. Fixed in 1.9.0.
Read: thehackernews.com/2026/10/la…
Confirmed from vulnerable firmware.
It is not today's date, it is derived from today's date.
Doesn't include time.
Still stupid.
Can anyone confirm, before I have to reverse the code myself (with AI), that the Danfoss fridge passwords were derived from today's date, or were today's date.
The only credible information I've seen, direct from the original Claroty source, is that the password is derived from the device's date and time.
Where ya'll getting the info that the password *was* "today's date"?
Either way, it's stupid, but not as stupid as being just today's date.
Can anyone confirm, before I have to reverse the code myself (with AI), that the Danfoss fridge passwords were derived from today's date, or were today's date.
The only credible information I've seen, direct from the original Claroty source, is that the password is derived from the device's date and time.
Where ya'll getting the info that the password *was* "today's date"?
Either way, it's stupid, but not as stupid as being just today's date.
Using AI to talk to our honeypot data really feels like we're living in the future!
You can now talk to Previdian's exploitation intelligence directly through ChatGPT (and other AI clients)!
Ask about real exploitation attempts, attacker IPs, captured payloads, vulnerability timelines, available virtual patches, and more.
All powered by Previdian's proprietary honeypot intelligence.
Here's a quick demo of Previdian MCP 👇
Ryan Dewhurst retweeted
⚠️ UPDATE: EXPLOITATION ATTEMPTS HIT ATLASSIAN CVE-2026-21589 (CVSS 9.3)
Previdian's honeypot network saw exploitation attempts about 2 hours after watchTowr Labs published its technical write-up on the pre-auth file-read flaw we covered on Oct 6.
What's new:
• Root cause: the shared atlassian-plugins-webresource library turns "::" into "/", so "..::" sequences slip past path-traversal checks
• No login needed: files inside the app server's web root can be read, incl. protected WEB-INF files
• Affects Jira, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye (Data Center)
• In Crowd-linked setups, crowd[.]properties holds the app password in plaintext; watchTowr used it to create a user and make it a Jira admin
• Previdian logged 15 attempts from 3 IPs: 38.60.157[.]86, 146.70.187[.]234, 159.26.119[.]225
Fixed versions are in our earlier post below; one correction: the Crowd 7.1 fix is 7.1.7, not 7.1.1.
⚠️ Analyst Note:
These are attempts seen on honeypots, not confirmed compromises, and the CVE is not in CISA KEV. A Nuclei scanning template is out; expect more probing. Patch now, or pull instances off the internet until you can, and check access logs per Atlassian's advisory.
Source (watchTowr Labs):
labs.watchtowr.com/you-wont-…
#DDW #DarkWeb #Atlassian #CVE #PatchNow
xitter.cf/DailyDarkWeb/status/21…
🚨 ATLASSIAN PATCHES CRITICAL CVE-2026-21589 (CVSS 9.3) ACROSS DATA CENTER PRODUCTS
Atlassian has disclosed CVE-2026-21589, a critical unauthenticated arbitrary file access (path traversal) flaw in its self-managed products, published Oct 5, 2026.
Per Atlassian:
• CVSS 4.0 score 9.3 (Critical), no authentication needed
• A remote attacker can read specific files inside the web application root
• Affects Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye (Data Center/Server)
• Fixed: Jira 9.12.40 / 10.3.26 / 11.3.12; JSM 5.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.1 / 7.2.4; Crucible & Fisheye 4.9.15
• Atlassian Cloud is already patched. WAF / URL-rewrite mitigations are offered if you cannot upgrade yet
⚠️ Analyst Note:
Exploitation requires the exact name and path of the target file; the bug does not allow directory listing. As of Oct 5, it is not in CISA KEV and no public exploit has been reported. Some configurations may still expose sensitive files, so patch internet-facing instances first. End-of-life versions may also be affected.
Source (Atlassian):
jira.atlassian.com/browse/CO…
#DDW #DarkWeb #Atlassian #Jira #Confluence #CVE #CyberSecurity
