At The Edge Clear: July 13 - 20, 2026
Summary: GreyNoise reported that two crawlers, 159.89.117.80 on DigitalOcean and 161.97.74.198 on Contabo, ran an identical toolkit against NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), both CVSS 9.8 flaws that disclose credentials, keys, or session material, sharing one JA4H fingerprint. In the same July 13-20, 2026 window, an RDP brute force cohort spread across AS215929, AS35042, and AS49434 under one shared transport fingerprint, a BytePlus host (101.47.13.192) wrapped command injection and configuration file collection in Googlebot-impersonating traffic for a single day, and 213.209.159.175 was linked by a shared client fingerprint to a second host, 213.209.159.154 on AS208137.
Key Takeaway: The credential exposure risk sat in the mid-volume crawler pair, not the week's highest-volume sources, so volume-based triage would have missed two CVSS 9.8 flaws that leak administrative credentials, private keys, or session material. And because every primary source ran on short-lived rented hosting, a per-ASN block lags the next provider hop, leaving shared-fingerprint detection as the control that survives it.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-44000CVE-2026-27944
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026