At The Edge Clear: April 13 - 20, 2026
Summary: GreyNoise recorded roughly 6.2 million sessions across hundreds of source IPs probing for exposed ENV files, .git/config, AWS metadata, and path traversal between April 13 and 20, 2026. Port 5900 (VNC) drew 17,375,937 sessions, third-most-targeted behind SSH and SMB, with RFB protocol traffic at 4,305,556 sessions and VNC authentication tags nearly empty, indicating exposure mapping rather than password guessing.
Key Takeaway: Three IPs on VPSVAULT.HOST LTD in Brazil pushed 3,352,578 sessions carrying 18+ exploits, including newly weaponized CVE-2025-54322 (Xspeeder SXZOS RCE, CVSS 10.0), and a confirmed Mirai node added 851,713 Telnet default-credential stuffing sessions - so an exposed config file or a default password on an internet-facing device is the entry point these operators are already testing.
Read the original at GreyNoise Blog ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2025-54322CVE-2026-24061
- Related
- CVE-2026-24061: GNU Inet Utils Argument Injection Vulnerability Known Exploited Vulnerabilities · Jan 26, 2026FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026