Defused

Managed Honeypots for Early-warning Threat Intelligence 🍯

Access free honeypot intel:

[Defused @DefusedCyber]

🚨 New Fortinet vulnerability being exploited as an 0-day

CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical

After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure.

Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6.

The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests.

This discovery was made through our upcoming Radar feature launching next week 😇

Advisory: https://t.co/Jr2fUbq8JV

Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar 👉 https://t.co/iRDhHlDkep

Credit also to @heckintosh_ for independently discovering this vulnerability 💪

[Simo @SimoKohonen]

🍯🍯🍯🍯

[Defused @DefusedCyber]

@SimoKohonen 🙌🙌🙌

[Defused @DefusedCyber]

🚨 Based on @rapid7 observations of exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257), we can also confirm first signs of exploitation around the same time (May 18th on the Defused TF feeds, and a customer hit on May 17th)

The exploit payload differs slightly from Rapid 7's POC with the user-agent PAN GlobalProtect/6.0.0

Attacker IP: 104.207.144[.]154 🇺🇸 AS20473 The Constant Company

Rapid7 write-up: https://t.co/n9QiTULwHA

[Defused @DefusedCyber]

@SimoKohonen 🍯🍯🍯

[Defused @DefusedCyber]

👇👇👇

[Simo @SimoKohonen]

Past few weeks I have been posting less @DefusedCyber updates, but only because it's reached enough users that have needed to rework some scaling aspects.

That said, new stuff coming soon again 😉

[Defused @DefusedCyber]

⚠️ We are observing actors sending test exploits against the recent Drupal vulnerability CVE-2026-9082 since this morning

Probes hit /jsonapi/node/* with a malformed filter[…][value][…] key, triggering the SQL injection bug to check whether the site is vulnerable.

No data-extraction payloads yet, so this is likely recon ahead of the real wave.

Monitor live attacks against Drupal 👉https://t.co/rEG9aqrq5l

[Defused @DefusedCyber]

@DarshanSays speed is everything now

[Defused @DefusedCyber]

🚨 The Cisco SD-WAN vManage CVE-2026-20224 released yesterday - currently stated to have no known ITW exploitation by Cisco PSIRT - is now seeing exploit activity on the Defused honeypots

Attackers are using 6 XXE variants for reading local filesystem paths. Payloads align with advisory but exploit success not verified

Track exploitation of this and other Cisco honeypots 👉 https://t.co/rEG9aqrq5l

[Defused @DefusedCyber]

⚠️We are observing a major credential bruteforce attack targeting Palo Alto

The credentials rotate across a small set of weak passwords, suggesting recon / enumeration rather than actual access attempts

Main ASNs:

- AS394474 WhiteLabelColo
- AS3257 GTT Communications
- AS52393 Corporación Dana S.A.
- AS263740 Corporacion Laceibanetsociety

Monitor attacks against Palo Alto and other edge devices 👉 https://t.co/rEG9aqrq5l

[Simo @SimoKohonen]

No big exploit activity on the recent Palo Alto vuln (CVE-2026-0300), but a decent amount of scanning activity like this "exposure survey"

Feels like a lot of these are looking in the wrong direction though, both in terms of ports and paths..

[Defused @DefusedCyber]

🚨 We've added tracking for CVE-2026-0300 (PAN-OS Authentication Portal) into our Palo Alto honeypot fleets

No action required from users subscribed to the Palo Alto intel feeds - tracking has been added in automatically.

Monitor exploit activity 👉https://t.co/FMlpPAiZfm

[Defused @DefusedCyber]

@huntnp007 @stop_spammerz 💯

[Defused @DefusedCyber]

🚨 cPanel CVE-2026-41940 post-exploit activities we have observed in the past 24 hours:

/json-api/listaccts - lists the accounts on the server
/json-api/system - chained with a command parameter to execute commands on the target
/json-api/version - returns cPanel and WHM version (attackers likely checking if exploit works)
/json-api/authorizesshkey - used by attackers to add their SSH keys onto the target
/json-api/passwd - used to modify an account's password

Track live cPanel exploit activity against our honeypots 🍯https://t.co/iRDhHlDkep

[Defused @DefusedCyber]

@stop_spammerz ☝️☝️☝️

[unlockParent64 @stop_spammerz]

@DefusedCyber check for more endpoints https://t.co/sUHxhTEfNw

[ian @adversarialy]

@UK_Daniel_Card @DefusedCyber Interesting that 205.237.106[.]117 is using @HackingLZ 's favorite AI pentest tool, PentAGI.

That same actor also targeted @sysdig Langflow honeypots in March:
https://t.co/CMGVmurM7W

[Defused @DefusedCyber]

@UK_Daniel_Card 🍯🍯🍯🍯

[mRr3b00t @UK_Daniel_Card]

Baddies attacking CPANEL at: 86.155.41.250

[Defused @DefusedCyber]

@drkshdw47 🥵

[Defused @DefusedCyber]

@nbrsr Just a million or so instances on the web.. 🥵