New in Event Feeds: Vendor CVE Spikes & Tag Spikes
Summary: GreyNoise added two new Event Feed types, Vendor CVE Spike and Tag Spike, which alert when attacker activity against a vendor's technology stack or a named tag rises significantly. The company cites its own sensor data from the week of January 19, 2026, showing elevated targeting of Fortinet SSL VPNs and Palo Alto GlobalProtect portals, and says such vendor-level spikes often precede disclosure of new CVEs for that vendor.
Bottom line: The gap GreyNoise describes is the window between attackers hammering a vendor's infrastructure and a CVE being assigned or a signature written, and its January 2026 example shows coordinated VPN targeting arriving before the threat was fully characterized. A feed that flags the spike early is only useful if someone is positioned to act on it, such as tightening MFA or geo-blocking, before the specific vulnerability is named.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026