At The Edge Clear: June 29 - July 06, 2026
Summary: GreyNoise recorded a sharp resurgence in exploitation attempts against Palo Alto GlobalProtect CVE-2019-1579, an unauthenticated RCE on the CISA KEV list, going from isolated activity in late June to more than 120 malicious hosts on the evening of 06 July, almost all from a single hosting network. Two hosting fleets, TECHOFF (AS48090, Netherlands) and Bucklog SARL (AS211590, France), together ran roughly 7.5 million connection attempts on a shared web-exploitation and credential-harvesting toolkit, with 129 hosts classified malicious and 30 suspicious, while ENV Crawler logged 4.76 million requests hunting exposed .env files.
What's compelling: Any internet-facing GlobalProtect portal on vulnerable firmware is in scope, and a single .env file that returns content hands over working credentials with no exploitation required - the source addresses rotate, but the exploitation patterns and client fingerprints do not.
Read the original at GreyNoise Blog ↗
- Mentions
- CVE-2019-1579
- Related
- CVE-2019-1579: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 10, 2022