At The Edge Clear: Jan 19–23, 2026
Summary: GreyNoise's January 19–23, 2026 analysis tied React exploitation, VPN brute forcing, and router scanning to a single JA4T network signature, indicating coordinated rather than opportunistic activity. The brief cites CVE-2025-55182 at CVSS 10.0 with 179,000 sessions involving actual command injection and a Metasploit module available, 506,000 combined sessions against Fortinet SSL VPN and Palo Alto GlobalProtect with Fortinet attacks up 25% from baseline, and a MikroTik RouterOS brute force campaign at a 64,000:1 session-to-IP ratio.
Key Takeaway: One hosting provider generated 57% of the traffic behind a CVSS 10.0 flaw that already has a Metasploit module, and the same signature links it to VPN brute forcing and router compromise - so a single unpatched edge device can be the entry point for an operation that is already organized.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2025-55182
- Related
- At The Edge Clear: Jan 26-30, 2026 Cyber Risks ·CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025