• Vulnerability & Threat Intelligence at https://xitter.cf/t.co/pRPrjARoN2 • Founder of @_WPScan_ (acquired by Automattic) • Founder of DVWA • Ethical Hacking Graduate
Joined June 2009
- Tweets3.8K
- Following842
- Followers21.2K
- Likes15.3K
UPDATE: Palo Alto Networks Unit 42 has retracted its earlier assessment linking the European government agency attack to PHP2Shell exploitation.
The attack involved a vulnerable PHP application, but Unit 42 says it cannot confirm initial access was tied to the specific PHP2Shell CVEs.
We've updated our report ↓
Ryan Dewhurst retweeted
A breath of fresh air? Something other than PHP2Shell...
We detected an exploitation attempt against our FortiSIEM honeypot decoy, targeting CVE-2026-106173, Fortinet FortiSIEM’s path traversal vulnerability.
The request matches the file overwrite mode in @Horizon3ai PoC, published on 20 October 2026.
Observed on 23 October at 09:43:32 UTC: one request from one source IP (85.192.29[.]68).
• POST /phoenix.phoenixSvc/SendQueryResult
• HTTP/2 over TLS on TCP port 27918
• Twelve ../ sequences in the query-id header, targeting /tmp/.fsmprobe
• A 7-byte gRPC body carrying empty file contents
The request attempted to overwrite /tmp/.fsmprobe with an empty file. It contained no shell commands. This capture does not confirm a successful file write or code execution.
Upgrade to FortiSIEM 7.5.1 or later, following Fortinet’s advisory.
Restrict access to TCP 27918 and investigate unexpected /tmp/.fsmprobe artifacts.
Details and updates 👇
In the age of AI, it's becoming clear that, AI output will be perceived as fast and cheap, and human output will be perceived as slow but premium.
Shocking! 😲
We're now seeing upload progress probes for PHP’s critical RCE vulnerability, CVE-2026-109618.
Our honeypots captured three HTTP requests from two source IPs, including PHP test code embedded in upload filenames.
Timeline (UTC):
• 20 Oct, 19:45: Previdian early-warning email sent.
• 21 Oct, 13:05: First attempt captured by our sensors.
• 21 Oct, 13:27: Follow-up warning emailed.
• 21 Oct, 13:30: PHP security fixes released.
• 21 Oct, 15:15: Previdian’s temporary virtual patch available.
Our initial warning preceded our first sensor observation by approximately 17 hours 21 minutes.
The evidence and IoCs:
• Observed source IPs: 166.1.90[.]109 & 43.134.82[.]85
• Multipart POST requests to /
• Fields: PHPSESSID and PHP_SESSION_UPLOAD_PROGRESS
• Two requests used the upload filename: <?php echo 1;?>.txt
Attackers did not manage to execute PHP or upload files in these first instances.
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your vendor’s patched package.
Ryan Dewhurst retweeted
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).
We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
Ryan Dewhurst retweeted
We are behind you and that will not change, PM tells Zelensky bbc.in/4yklpHe
Ryan Dewhurst retweeted
Around 80% of vulnerabilities in Previdian's KEV dataset can be exploited without authentication. The remaining 20% require credentials.
CVE-2026-105740 (Langflow) is one of that 20%.
First, they checked whether Langflow's auto-login feature was enabled. When they found it disabled, they switched to trying common, weak credentials.
After successfully authenticating, they immediately attempted to exploit CVE-2026-105740 to access environment variables and perform other actions.
We first observed exploitation attempts on September 19, but activity increased dramatically following the CVE's publication on October 5.
If you're running Langflow, disable auto-login, enforce strong passwords, ensure all patched, and review suspicious authentication and MCP API activity.
We observe exploitation attempts targeting numerous vulnerabilities every day across our honeypot network. There's simply too much activity for us to post about everything.
Don't rely on social media to stay ahead of emerging threats. Sign up to Previdian to stay informed about the vulnerabilities attackers are actively targeting daily.
⚠️1,423 Langflow RCE exploit attempts hit Previdian honeypots from 27 IPs.
The bug lets authenticated users, even non-admins, run OS commands through MCP server configs. Fixed in 1.9.0.
Read: thehackernews.com/2026/10/la…
Confirmed from vulnerable firmware.
It is not today's date, it is derived from today's date.
Doesn't include time.
Still stupid.
Can anyone confirm, before I have to reverse the code myself (with AI), that the Danfoss fridge passwords were derived from today's date, or were today's date.
The only credible information I've seen, direct from the original Claroty source, is that the password is derived from the device's date and time.
Where ya'll getting the info that the password *was* "today's date"?
Either way, it's stupid, but not as stupid as being just today's date.
Can anyone confirm, before I have to reverse the code myself (with AI), that the Danfoss fridge passwords were derived from today's date, or were today's date.
The only credible information I've seen, direct from the original Claroty source, is that the password is derived from the device's date and time.
Where ya'll getting the info that the password *was* "today's date"?
Either way, it's stupid, but not as stupid as being just today's date.
Using AI to talk to our honeypot data really feels like we're living in the future!
You can now talk to Previdian's exploitation intelligence directly through ChatGPT (and other AI clients)!
Ask about real exploitation attempts, attacker IPs, captured payloads, vulnerability timelines, available virtual patches, and more.
All powered by Previdian's proprietary honeypot intelligence.
Here's a quick demo of Previdian MCP 👇