Noise Letter November 2026

Summary: GreyNoise reported that its deception sensors observed and shared activity around PHP2Shell in October, and that its Project Swarm initiative is distributing honeypots for anyone to run on the open internet, with Merit Network already seeing results. The company also announced a GreyNoise MCP Server for Anthropic Claude, plus integrations with Splunk SIEM and Google Security Operations SOAR, among more than 80 total integrations.
Key Takeaway: GreyNoise is pushing honeypot sensors onto the open internet through Project Swarm and piping its IP reputation data into AI agents and SIEM/SOAR workflows - the same edge telemetry that surfaced PHP2Shell activity is now being handed to tools that act on it.

Read the original at GreyNoise Blog ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026