@DefusedCyber

Managed Honeypots for Early-warning Threat Intelligence 🍯 Sign up today for a 14-day trial: https://xitter.cf/t.co/TTnxgi9Hv5

defusedcyber.com/
Joined August 2023
  • Tweets824
  • Following1
  • Followers8.1K
306Media
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.

bleepingcomputer.com
2
13
30
8,567
Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances - helpnetsecurity.com/2026/10/… - @GoIvanti @Volexity @DefusedCyber @CISACyber #0day #SecurityUpdate #Cybersecurity #CybersecurityNews
1
1
4
690
#SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin securityaffairs.com/200816/h… #securityaffairs #hacking @DefusedCyber @PrevidianCyber

SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin

Attackers are exploiting SonicWall SMA 1000 flaw, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure.

securityaffairs.com
1
2
6
832
Defused retweeted
Simo
@SimoKohonenOct 5
IPs that hit our NetScaler sensors on September 17th with the deflate payloads against SAML surface (probe/1 UA): 194[.]77.94.40 2,804 → 63,488B 'G' 103[.]171.122.41 1,759 → 62,464B 'G' 157[.]85.104.79 2,862 → 62,534B 'G' 102[.]18.119.22 1,756 → 62,464B 'G' 46[.]247.43.50 117 → 98,304B 'P' 103[.]112.0.110 78 → 272 B valid-XML canary
2
25
1
86
5,829
Defused retweeted
Simo
@SimoKohonenSep 26
Google / Mandiant linked this activity to ShinyHunters! cloud.google.com/blog/topics…
Defused
@DefusedCyberSep 23
🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation. Source IPs and the full indicators are available on Defused Radar. console.defusedcyber.com/sig…
2
10
55
6,669
Defused retweeted
Horizon3.ai
@Horizon3aiSep 1
On August 30, @DefusedCyber honeypots detected valid exploitation attempts against the vulnerability. The observed attacker used command execution, followed by additional enumeration and exfiltration activity.
1
2
5
314
Defused retweeted
SC Media@SCMagazineAug 20
A critical SAP Commerce Cloud flaw was exploited just three days after patching, according to @DefusedCyber, highlighting how quickly attackers are moving against enterprise vulnerabilities. #cybersecurity #CISO #infosec bit.ly/4wGFmaD

Critical SAP Commerce Cloud flaw exploited days after patch

Attackers moved quickly to exploit a critical SAP Commerce Cloud bug following its patch.

scworld.com
1
1
5
1,145
#SAP #Commerce #Cloud CVE-2026-58231 Exploited in the Wild securityaffairs.com/197244/s… #securityaffairs #hacking @DefusedCyber

SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild

Attackers are actively exploiting a maximum severity SAP Commerce Cloud flaw, tracked as CVE-2026-58231, just days after SAP released a patch

securityaffairs.com
1
2
4
1,380
محاولات استغلال ثغرة حرجة في منصة @SAP Commerce Cloud، وذلك عقب ثلاثة أيام من إصدار التحديث الأمني لشهر أغسطس، وفق تقرير @DefusedCyber . تستهدف الثغرة ملحق Data Hub Adapter وتتيح للمهاجمين تجاوز آليات المصادقة والتحقق، وإرسال مدخلات خبيثة للوصول إلى مكونات داخلية حساسة.
1
1
10
1,227
Defused retweeted
Simo
@SimoKohonenAug 14
You can set up tripwires in @DefusedCyber which alert you when certain paths get exploited 🍯
watchTowr
@watchtowrcyberAug 14
You're back in the room, trapped with us - and a Citrix NetScaler Pre-Auth RCE (CVE-2026-8452) Enjoy... labs.watchtowr.com/youre-bac…

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill - it’s the typical enterp...

labs.watchtowr.com
1
11
1,006
Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040) - helpnetsecurity.com/2026/08/… - @rapid7 @stephenfewer @DefusedCyber @CISAgov - #SharePoint #Vulnerability #CyberAttack #Exploit #PoC #Cybersecurity #CyberSecurityNews #SecurityNews

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040) - Help Net...

Threat actors have begun exploiting a critical Microsoft SharePoint flaw following the release of PoC exploit code by Rapid7.

helpnetsecurity.com
1
6
911
Sharepoint baddies in the honeypots at @DefusedCyber coming in from: 205.147.17.6 abusing the vulnerability from CVE-2026-55040
5
33
3,603
Defused retweeted
kmkz
@kmkz_securityAug 12
A lot to do with your honeypot: collect POC/exploit, IoC, follow campaigns and more..it has a very high value ...because this is where things happens for real! Thanks to @DefusedCyber @SimoKohonen for the amazing job there, too underrated I gess, from both Offensive and Defensive guys – at Jammerbugt, Danmark
Defused
@DefusedCyberAug 12
🚨 Attackers are now using the @rapid7 POC for CVE-2026-55040 against our SharePoint honeypots The vulnerability is a Microsoft SharePoint JWT auth bypass for which Rapid7 published a technical writeup and proof-of-concept code yesterday. Track it live 👉 console.defusedcyber.com/sig…
1
4
15
2,656
Defused retweeted
Simo
@SimoKohonenJul 24
Updates next week 🙌
Simo
@SimoKohonenJun 6
The past 6 months have been a crazy time for @DefusedCyber . That said, I've been running the platform with a "beta" mindset - very quickly implementing somewhat half-baked ideas, which have yielded good results but also left the platform slightly disjointed in places. However, the vision where to take the platform is quite clear now, and the remainder of June will both accelerate that vision and also mark the closing of the beta stage, hopefully removing all of the ridiculous UI and UX snafus still lingering in the platform. Got some really wild expanses coming, plus a completely renewed free offering. Stay tuned and LFG!
1
6
835
Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) - helpnetsecurity.com/2026/07/… - @watchtowrcyber @Microsoft @DefusedCyber @censysio @CISACyber @CISAgov #PoC #SharePoint #Vulnerability #VulnerabilityManagement #Cybersecurity #CybersecurityNews

Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) - Help Net...

Attackers are exploiting an unauthenticated SharePoint RCE vulnerability (CVE-2026-50522) to extract the servers' IIS machine keys.

helpnetsecurity.com
5
7
1,375
Defused retweeted
Simo
@SimoKohonenJul 21
Featuring @DefusedCyber 🍯
BleepingComputer
@BleepinComputerJul 21
Critical SharePoint RCE flaw exploited to steal machine keys bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

Critical SharePoint RCE flaw exploited to steal machine keys

Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched.

bleepingcomputer.com
3
12
2,100
Defused retweeted
kmkz
@kmkz_securityJul 20
Active wp2shell exploitation attempt against #wordpress apps caught in the wild - thanks to @DefusedCyber honeypots > Take care: Some ppl identified that their instance did not update automatically / as expected: wordpress.org/news/2026/07/w… @Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities: blog.cloudflare.com/wordpres… – at Troisvierges, Luxembourg
4
9
46
4,021
Defused retweeted
Simo
@SimoKohonenJul 20
Didn't initially notice but the IP here ( 146.19.216[.]119 ) appears on @rapid7 's CVE-2026-0257 reporting from last month
Defused
@DefusedCyberJul 18
⚠️ We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875) The payloads hit the same pre-auth sink @SLCyberSec documented (/assessment_thanks.do), but the sandbox-escape gadget reaches the same code-execution primitive by a different route than their published PoC. Defused subscribers can view the full gadget chain, request-level fingerprint, and exploit data. Track ServiceNow exploitation live 👉 console.defusedcyber.com/sig…
1
7
28
5,669
A critical flaw in the ServiceNow AI platform allows unauthenticated users to run arbitrary commands. ⁦@DefusedCyber⁩ flagged this ServiceNow sandbox escape RCE as actively exploited. securityonline.info/cve-2026…

Active Exploitation and Public PoC Disclosed for CVE-2026-6875 ServiceNow Sandbox Escape Remote...

TL;DR A critical flaw in the ServiceNow AI platform allows unauthenticated users to run arbitrary commands. DefusedCyber flagged this ServiceNow sandbox escape RCE as actively exploited. Furthermo…

securityonline.info
4
15
2,380
Defused retweeted
Tyler@B0wleyJul 17
New blog post about the trends section of detection chokepoints featuring @DefusedCyber Intel feed as a data set. playingwithpackets.com/blog/… iimp0ster.github.io/detectio…

Reading the Wave: A Tour of Detection Chokepoints Trends

Chokepoints tell you what has to happen. Trends show how attackers are changing the route around it. A tour of the ClickFix, edge-exploit, and software-impersonation datasets, and how defenders can...

playingwithpackets.com
1
6
8
1,444
Load more