At The Edge Clear: August 30 – September 8, 2026
Summary: GreyNoise reported that credential collection was the highest-volume malicious activity between August 30 and September 8, 2026, with environment files, cloud configuration and repository configuration requested directly from web servers and almost none of it requiring a vulnerability. Adversaries attempted CVE-2026-0257 in Palo Alto Networks PAN-OS from 64 sources on 02 September, a CVSS 9.1 flaw in CISA KEV since May 2026 with recorded ransomware use, while nine rented hosts posing as Googlebot produced roughly two thirds of all forged search engine crawler traffic observed.
What's compelling: The largest malicious-intent volume of the period maps to no CISA KEV entry, so a patch queue will never surface it - and nine rented hosts presenting as Googlebot accounted for about two thirds of forged crawler traffic, which gets through any control that relaxes rate limiting or logging by user agent.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-2628CVE-2026-0257
- Related
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026CVE-2018-2628: Oracle Web Logic Server Unspecified Vulnerability Known Exploited Vulnerabilities · Sep 08, 2022