At The Edge Clear: July 20 - 27, 2026
Summary: GreyNoise tracked a credential-harvesting fleet since early July in which one TLS client fingerprint and an identical toolkit link tied 64 rented hosts across several providers, including Bucklog SARL and the 3xK Tech range, into a single operation that crawls for exposed secret files and drives about 6% of everything GreyNoise observed. A separate cluster of 300 rented hosts probed Citrix NetScaler and Palo Alto Networks GlobalProtect together, each host carrying both a Citrix Bleed 2 (CVE-2025-5777, CISA KEV) exploit attempt signature and a GlobalProtect login scanner signature, while two WordPress Core flaws added to CISA's KEV catalog on 20 July kept drawing probing: CVE-2026-60137 (SQL injection) from roughly 95 non-research sources and CVE-2026-63030 (CVSS 9.8), which chains with it toward remote code execution.
What you should know: The 300-host cluster carries both exploit signatures on every host, so a single Citrix or GlobalProtect gateway is being hit by the same operation from two directions at once, and the WordPress pair chains toward remote code execution on a platform that runs a very large share of public websites.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-5777CVE-2026-60137CVE-2026-63030
- Related
- Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through Word Press Exploitation Cyber Risks ·CVE-2026-63030: Word Press Core Interpretation Conflict Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026CVE-2026-60137: Word Press Core SQL Injection Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026