@onyphe.io

Provider of Attack Surface Discovery (ASD), Attack Surface Management (ASM) and CTI solutions. Scanning at Internet-scale since 2017 - contact at onyphe dot io

[@onyphe.io @onyphe]

14 ONYPHE skills for AI agents

Your agent hits our API without you writing a single OQL query: reviewed inventory, prioritised risks and CVEs, full threat hunting from one indicator to mapped adversary infra

Claude Code plugin, ONYPHE CLI, an API key
https://t.co/GJNfmX7wiH

👇

[@onyphe.io @onyphe]

@felixaime @sekoia_io You should have read our article because we have seen more exposed devices than @censysio at the time of attack.

👉It was around 2.8k exposed in France only, more than the reported 1.7k

https://t.co/wXgHrYMV9c

[Félix Aimé @felixaime]

The Cold Chain on Fire : Unpatched Danfoss controllers exploited https://t.co/rFm1jK41Yx

[@onyphe.io @onyphe]

And that's for top ports:

[@onyphe.io @onyphe]

More than 813 #ARTEX according to our data (2.1K):

https://t.co/904LDTxrPw

[Furkan @caliskanfurkan_]

Hunting the AI harnesses

https://t.co/8op9awOLro

[@onyphe.io @onyphe]

#VeryRed #VeryScary

https://t.co/jF2xyVqzya

[BleepingComputer @BleepinComputer]

Synology warns of C3RB3R ransomware attacks targeting NAS devices
https://t.co/NSRtszcd0L

https://t.co/NSRtszcd0L

[@onyphe.io @onyphe]

According to CISA "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. "

Where are the proof of exploitation?

[CCB Alert @CCBalert]

Warning: #CVE-2026-97229 (CVSS 10.0) in GitLab CE/EE is actively exploited by attackers. Exploitation allows unauthenticated remote attackers to achieve arbitrary code execution via specially crafted regular expression in a CI/CD configuration #RCE! https://t.co/86C01puOTf #Patch

[@onyphe.io @onyphe]

🎃 The scariest map on the Internet

This Halloween, explore the dark side of Internet with @ONYPHE’s Very Scary Map because the scariest things aren’t always hiding in the dark: they may be exposed.

👉 Very red. Very scary. Powered by live data.

https://t.co/NBlnjji39P

[@onyphe.io @onyphe]

A real-world example : https://t.co/WeVOZzSoUm

[@onyphe.io @onyphe]

14 ONYPHE skills for AI agents

Your agent hits our API without you writing a single OQL query: reviewed inventory, prioritised risks and CVEs, full threat hunting from one indicator to mapped adversary infra

Claude Code plugin, ONYPHE CLI, an API key
https://t.co/GJNfmX7wiH

👇

[@onyphe.io @onyphe]

Tailscale SSH: #NotVeryRed #NotVeryScary

[Valéry Rieß-Marchive | @valerymarchive.bsky.social @ValeryMarchive]

Je vais jouer les chagrins comme il se doit...
@onyphe voit +6K systèmes Danfoss exposés sur Internet, donc la moitié en 🇫🇷

Danfoss revendique +50k installations 🌍

Ça suggère à minima que certains arrivent à éviter l'exposition directe en ligne, non ? 🤷‍♂️

[@patriceauffret.bsky.social @PatriceAuffret]

@ValeryMarchive @UK_Daniel_Card @SANDF_ZA The ZA result is based on a single honeypot.

[@onyphe.io @onyphe]

You should read our article below for some figures:

https://t.co/wXgHrYMnjE

[The Hacker News @TheHackersNews]

‼️ Attackers forced fridges into defrost at hundreds of French supermarkets. Some reached 50°C, and stores threw out food.

» Danfoss refrigeration controllers compromised.
» Intermarché, Carrefour and other French chains hit.
» Initial access method remains unknown.

Details → https://t.co/Dfnm1pS1gM

[@onyphe.io @onyphe]

👀 Was the cyberattack against refrigeration systems at several French supermarket chains specifically targeting France?

💥 On more than 6,000 exposed @Danfoss instances, nearly 50% were located in France.

Cc @IntCyberDigest

👉 Read our full analysis:

https://t.co/wXgHrYMV9c

[@onyphe.io @onyphe]

@ValeryMarchive @gchampeau Retrouvez notre analyse complète ici :

https://t.co/ERlmZHzcH4

[@onyphe.io @onyphe]

👀 La cyberattaque ayant privé de systèmes de réfrigération @CooperativeU et @intermarche était-elle une attaque ciblée sur la France ?

💥 Sur plus de 6 000 instances @Danfoss exposées, près de 50% sont situées en France.

👉 Notre analyse complète :

https://t.co/ERlmZHzKwC

[@onyphe.io @onyphe]

Issue is now fixed, all data is available again.

[@onyphe.io @onyphe]

As part of a "scheduled maintenance", @ovh_support_fr completely turned off a bay without alerting their customers beforehand.

Therefore, we have an availability incident, some data may not be available. Issue should be fixed in a few hours.

Thank you for your understanding.

[@onyphe.io @onyphe]

As part of a "scheduled maintenance", @ovh_support_fr completely turned off a bay without alerting their customers beforehand.

Therefore, we have an availability incident, some data may not be available. Issue should be fixed in a few hours.

Thank you for your understanding.

[Support OVHcloud EN @ovh_support_en]

@onyphe Hello there,

We apologize for any slowdowns.
We are experiencing Orange-OVHcloud network disruptions.
You can track the progress of the resolution here: https://t.co/27oCW87DhE

The teams do everything they can to restore quickly.
^HomS https://t.co/65cwVbsNAp

[@onyphe.io @onyphe]

Seems a connectivity issue between @ovh_support_fr and @orange

[@onyphe.io @onyphe]

We are experiencing an availability incident. We are investigating and will let you know when we know more.

Thanks for your patience.

[@onyphe.io @onyphe]

We are experiencing an availability incident. We are investigating and will let you know when we know more.

Thanks for your patience.