At The Edge Clear: August 10 - 17, 2026

Summary: GreyNoise's August 10-17, 2026 analysis period recorded attempted exploitation of CISA KEV-listed flaws across Ivanti, Palo Alto Networks, Citrix, F5 and Fortinet, plus Adobe ColdFusion across seventeen distinct tags spanning 2009 to 2026. Ten rented hosts each swept a disjoint contiguous band of the TCP port range, first observed on 12 August with a single shared TCP client fingerprint, while two hosting networks produced 82% of the Open Proxy Scanner and SOCKS5 Proxy Scanner probes seen that period.
What you should know: Every finding landed on an internet-facing asset the organization exposed deliberately but does not fully inventory - a gateway owned by another team, a legacy application server, a relocated service, a forward proxy with no identified owner. The ten rented hosts enumerated a service moved to a non-default port on the same schedule as one sitting on its default, so relocating a service bought no delay.

Read the original at GreyNoise Blog ↗