Vulnerability (CVE)
Qualys Threat Research Unit telemetry shows a sharp rise in automated attacks on PHP servers, IoT devices, and cloud gateways, driven mainly by the Mirai, Gafgyt, and Mozi botnets exploiting known CVEs and cloud misconfigurations. The blog cites PHP...
GreyNoise reports a rapid increase in exploit attempts over the past 10 days against two vulnerabilities: CVE-2022-47945, a local file inclusion flaw in ThinkPHP, and CVE-2023-49103, a flaw in ownCloud's GraphAPI. Only one of the two is included in the KEV...
GreyNoise observed a steady ramp-up in exploitation attempts against PHP and PHP-based frameworks from August through October 2025, with seven distinct attack patterns spiking into October and November. The loudest campaigns target ThinkPHP Framework LFI...
GreyNoise's early-warning detection flagged validated late-week spikes against FortiOS SSL VPN (CVE-2018-13379, a CISA KEV), Cisco SSL VPN, Ivanti EPMM, and NETGEAR devices during the July 06 to July 13, 2026 analysis period. Beneath those spikes, one DIGI...