Defused

Managed Honeypots for Early-warning Threat Intelligence 🍯

Sign up today for a 14-day trial:

[Defused @DefusedCyber]

🚨 New Fortinet vulnerability being exploited as an 0-day

CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical

After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure.

Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6.

The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests.

This discovery was made through our upcoming Radar feature launching next week 😇

Advisory: https://t.co/Jr2fUbq8JV

Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar 👉 https://t.co/iRDhHlDkep

Credit also to @heckintosh_ for independently discovering this vulnerability 💪

[Defused @DefusedCyber]

@circles_r_phun 😬

[Defused @DefusedCyber]

⚠️php2shell (CVE-2026-109618 and CVE-2026-109619): we’re seeing “P2SB” multipart probes hitting our Palo Alto GlobalProtect honeypots.

The requests carry a PHP_SESSION_UPLOAD_PROGRESS marker (“p2s-rider”) and a dummy file upload with no payload, which points to someone checking for the vulnerable upload-progress behavior and likely building a target list of Palo Alto devices.

Source is a known mass-exploit IP: 204.76.203.]7 (AS51396 Pfcloud UG, NL)

Track php2shell exploitation on Defused 👉 https://t.co/TTnxgi9Hv5

[Defused @DefusedCyber]

@RandyNorthrup Correct, and definitely a spike there!

[Defused @DefusedCyber]

⚠️php2shell (CVE-2026-109618 and CVE-2026-109619) - we have so far not seen major exploit activity around either vulnerability.

Exploit attempts seem to be limited to public POCs released in the past 24 hours, which based on our testing have predominantly been inoperative.

Track php2shell exploitation on Defused 👉 https://t.co/iRDhHlDkep

[Defused @DefusedCyber]

🚨 Our Redis decoys recorded repeated scripted attempts to exploit CVE-2026-25243, a heap memory-corruption bug in Redis’s RESTORE command, overnight Oct 16-17. No prior public report exists of this CVE being attempted in the wild.

One source hit the decoy five times on a timer with a identical payload: fingerprint the server, shape the heap with 26 key writes, fire a single malformed-zipmap RESTORE that triggers the documented over-read, run a throwaway Lua compute probe, then FLUSHALL the keyspace, destroying data and its own artifacts every run. Note that the bug needs command access to be exploitable.

Full IOCs on Defused Radar 👉 https://t.co/TTnxgi9Hv5

[BleepingComputer @BleepinComputer]

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
https://t.co/GSrnjVhnNl

https://t.co/GSrnjVhnNl

[Help Net Security @helpnetsecurity]

Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances - https://t.co/KcBsX2o2WX - @GoIvanti @Volexity @DefusedCyber @CISACyber #0day #SecurityUpdate #Cybersecurity #CybersecurityNews

[Defused @DefusedCyber]

@CroodSolutions @Volexity Meanwhile at Fortinet

[Defused @DefusedCyber]

Based on the @Volexity writeup, we can now confirm genuine exploitation:

[Defused @DefusedCyber]

🚨 Our Ivanti Connect Secure decoys caught pre-disclosure exploitation we assess as CVE-2026-104935. Activity was recorded on Oct 1st, twelve days before Ivanti’s advisory, on both our public honeypots and customer instances.

The exploit ran an unauthenticated bypass to plant an implant that runs entirely in memory and writes no files to disk - which is potentially why the advisory ships with no reliable IOCs.

Full fingerprint + IOCs on Defused Radar 👉 https://t.co/TTnxgi9Hv5

[Defused @DefusedCyber]

🚨 Our Ivanti Connect Secure decoys caught pre-disclosure exploitation we assess as CVE-2026-104935. Activity was recorded on Oct 1st, twelve days before Ivanti’s advisory, on both our public honeypots and customer instances.

The exploit ran an unauthenticated bypass to plant an implant that runs entirely in memory and writes no files to disk - which is potentially why the advisory ships with no reliable IOCs.

Full fingerprint + IOCs on Defused Radar 👉 https://t.co/TTnxgi9Hv5

[Pierluigi Paganini - Security Affairs @securityaffairs]

#SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
https://t.co/FbFKFyBrUZ
#securityaffairs #hacking
@DefusedCyber @PrevidianCyber

[Defused @DefusedCyber]

🚨Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate access path SSRF, CVSS 10.0) was disclosed earlier this week by SonicWall. We notified Defused subscribers of the anomalous traffic via our Radar functionality.

Full capture + what differs from known tooling on Defused Radar 👉 https://t.co/iRDhHlDkep

[Defused @DefusedCyber]

@0d3yd3b Nice work 💪💪

[Defused @DefusedCyber]

🚨 In addition to the IPs on circulating on social media, some additional IPs we are observing interacting with .ctxs.receiver webshells (Citrix Netscaler) on our decoys:

194[.]127.166.19
194[.]127.166.32
194[.]127.166.36
194[.]127.166.70
194[.]127.166.126
103[.]214.20.54
81[.]94.239.8

We're also seeing multiple actors sending the crafted Pitboss log entry in-request (pre-exploit). This is possibly a variation on CVE-2026-88771 exploitation, but we have not confirmed it works.

Track Citrix Netscaler activity live 👉 https://t.co/TTnxgi9Hv5

[Defused @DefusedCyber]

@albertaradios probably (hopefully) not a genuine 0-day 😅

[Defused @DefusedCyber]

@teamcymru_S2 Aye aye 🤛

[Simo @SimoKohonen]

IPs that hit our NetScaler sensors on September 17th with the deflate payloads against SAML surface (probe/1 UA):

194[.]77.94.40 2,804 → 63,488B 'G'
103[.]171.122.41 1,759 → 62,464B 'G'
157[.]85.104.79 2,862 → 62,534B 'G'
102[.]18.119.22 1,756 → 62,464B 'G'
46[.]247.43.50 117 → 98,304B 'P'
103[.]112.0.110 78 → 272 B valid-XML canary

[Defused @DefusedCyber]

@skocherhan 🍯🍯🍯

[Defused @DefusedCyber]

@rupenderbauhtey Correct 💯

[Defused @DefusedCyber]

@UK_Daniel_Card 🍯🍯🍯