At The Edge Clear: October 5 – 13, 2026
Summary: GreyNoise reported that roughly a thousand malicious IPs ran the Exchange ProxyNotShell check on every odd-numbered day from October 5 to 13, 2026, against no more than 24 on even days, with IPs from the same pool returning pass to pass. Attempts against CVE-2026-72898, an unauthenticated Metabase flaw rated CVSS 10, rose more than threefold from October 11, while IPs trying factory accounts on Dasan and D-Link gateways grew about 22 times in four days and GreyNoise tagged 1,598 IPs with Dasan backdoor behavior over ten days.
Why it matters: Each Metabase instance stores credentials for the databases it queries, so a CVSS 10 unauthenticated flaw drawing more than three times the attempts from October 11 puts those stored credentials directly in reach. A single unnamed host sent 36% of a 74% rise in RDP Crawler activity, meaning one machine going quiet could erase most of that signal and leave the underlying exposure unmeasured.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-72898
- Related
- CVE-2026-72898: Metabase SQL Injection Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026