Making Friends By Proactive Notification
Summary: Cisco Talos identified roughly 600 additional compromised hosts carrying webshells from adversaries exploiting unpatched JBoss environments, and is notifying victims so they can remediate. The post also publishes a list of the 500 most common webshells observed in the wild and asks organizations to verify their contact information with their Internet Registrar.
What you should know: Talos had to find these roughly 600 victims itself and track down who to tell, which means an unpatched JBoss server can sit compromised with a webshell and no one inside the organization knows - the notification only works if the registrar contact on file is current.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026