Previdian

Your early warning for vulnerabilities moving into active exploitation.

[Previdian @PrevidianCyber]

More details 👉 https://t.co/vaC5ug5xnk

[Previdian @PrevidianCyber]

We’re seeing this PHP webshell used in Issabel exploitation attempts (CVE-2026-89026) by a Threat Actor.

A hard-coded JWT key lets attackers forge tokens and execute commands without logging in.

Patch exposed systems and check for manage_hysumzem.php post-compromise webshells.

[Daily CyberSecurity @Daily_CyberSec]

An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now.

#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #ZeroDay
https://t.co/At7hx5M92h

[Previdian @PrevidianCyber]

RT @ethicalhack3r: And so it begins.

Started to see attempted WordPress RCE (CVE-2026-87902) exploitation in @PrevidianCyber honeypots fro…

[Previdian @PrevidianCyber]

CISA KEV is a great baseline, but it isn't the full picture.

Yesterday, it added 4 vulnerabilities.

Previdian customers had between 5 hours and a week of early warning before those additions.

More time to assess exposure, mitigate or patch.

[Previdian @PrevidianCyber]

@mattjay We see our Peoplesoft honeypots get hit almost everyday with CVE-2026-35273

It even has a Nuclei template.

https://t.co/Lx4YQtLCvt

[Matt Johansen @mattjay]

Seems highly likely this was the vuln used to hack the FBI.

CVE-2026-35273 - Missing Authentication for Critical Function

It came out June 11th and was immediately added to the CISA Known Exploited list - which means it was seen in real world attacks all the way back then.

[Previdian @PrevidianCyber]

@abraxas_null

[Previdian @PrevidianCyber]

New unauthenticated no user interaction RCE in WordPress. Some pre-conditions. Not click2shell.

CVE-2026-87902

Ensure auto-updates enabled. Update to 7.1.2.

[Pruva @pruvadev]

People are telling me that a new Wordpress cve is hitting the news, and what I’m doing? A repro for you!

CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE

https://t.co/y7V1bOzfq0

[Previdian @PrevidianCyber]

https://t.co/g7Oz7FR8d4

[WordPress @WordPress]

WordPress 7.1.2 is now available. This security release fixes a critical vulnerability. Update your sites immediately from Dashboard > Updates, and read the release details: https://t.co/QDOBK470yS

[Previdian @PrevidianCyber]

https://t.co/hh3XyGKags

[Previdian @PrevidianCyber]

Yesterday we saw first exploitation attempt for OpenCTI (CVE-2026-27960) in our honeypot network using the public Nuclei template.

Attacker IP located in Yemen (109.200.170[.]0)

Link in comments 👇

[Previdian @PrevidianCyber]

@amiateapot @TalBeerySec @OpenAI How do you prove how critical it is without testing its impact 🤔

[Previdian @PrevidianCyber]

It's Sunday.

Shall we have another responsible disclosure debate?

[Previdian @PrevidianCyber]

Get in touch if this kind of exploitation and malware data would be useful to your team!

https://t.co/Z2orF31eoL

[Previdian @PrevidianCyber]

An attacker targeting Langflow CVE-2026-0768 across Previdian’s honeypots left directory listing enabled.

We analysed 10 hosted files:

SpecterInsight-compatible implants, a likely XMRig-derived miner, and persistence via cron, systemd and shell startup files.

[Previdian @PrevidianCyber]

Two new KEVs sighted by Previdian sensors today.

• CVE-2026-89013: Dolibarr auth bypass
• CVE-2026-86538: knowns path traversal

Our honeypots first saw exploitation attempts on Sept 14–15, with a sharp rise today 🚀

Both recently patched. Added to our KEV feed.