At The Edge Clear: August 01 - 10, 2026
Summary: GreyNoise recorded exploitation attempts against six managed file transfer products - CrushFTP, MOVEit Transfer, GoAnywhere MFT, SolarWinds Serv-U, Wing FTP Server and Cleo - plus Apache Superset and Next.js between August 01 and August 10, 2026, each tied to a CVE in CISA's Known Exploited Vulnerabilities catalog. Of 37 sources on a CrushFTP authentication bypass rated 9.8, 26 arrived on 02 August, while reconnaissance ran underneath at 58,237 probes against 760 exploitation attempts.
Key Takeaway: Daily sources on cloud instance credential access climbed from 6 on 01 August to 227, and one cloud-hosted source harvested credential files and cloud metadata for three days before disappearing - the pattern GreyNoise describes is systems holding credentials for a second environment, so one success opens the next without a second exploit.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026