GreyNoise in the news

The latest news, announcements, and perspectives from GreyNoise.

SC Media

24,000 unique IP addresses target PAN-OS GlobalProtect gateways

Security Week

Hackers Looking for Vulnerable Palo Alto Networks GlobalProtect Portals

Hackers Scanning From 24,000 IPs to Gain Access to Palo Alto Networks GlobalProtect Portals

GBHackers Security

Hackers Deploy 24,000 IPs to Breach Palo Alto Networks GlobalProtect

The Hacker News

Nearly 24,000 IPs Target PAN-OS GlobalProtect in Coordinated Login Scan Campaign

BleepingComputer

Nearly 24,000 IPs behind wave of Palo Alto Global Protect scans

Help Net Security

Attackers are probing Palo Alto Networks GlobalProtect portals

Solomon on Cybersecurity

Warning to admins running PaloAlto Networks' GlobalProtect

SC Media

Active exploitation of Sitecore, Next.js, DrayTek vulnerabilities ongoing

Bank Info Security

Breach Roundup: Signal Is Safe

Blackbox Security

CISA Alerts on Sitecore RCE Vulnerabilities; Ongoing Exploits Target Next.js and DrayTek Devices

Daily CyberSecurity

Mass Reboots and Exploit Attempts Plague DrayTek Routers Across the Globe

The Hacker News

CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices

DrayTek Routers Vulnerability Exploited in the Wild

DrayTek routers face active exploitation of older vulnerabilities

Cybersecurity Dive

DrayTek routers face active exploitation of older vulnerabilities

DrayTek Routers Vulnerability Exploited in the Wild – Possibly Links to Reboot Loop

GBHackers

DrayTek Router Vulnerability Exploited in the Wild – Linked to Reboot Loop Issue

Cyberdaily.au

Active exploitation of DrayTek router vulnerabilities underway in the wild

CSO Online

Rising attack exposure, threat sophistication spur interest in detection engineering

SecurityWeek

Vulnerability Exploitation Possibly Behind Widespread DrayTek Router Reboots

Critical Apache Tomcat RCE vulnerability exploited

Cybersecurity Dive

Critical Apache Tomcat RCE vulnerability exploited

SOC Prime

CVE-2025-24813 Detection: Apache Tomcat RCE Vulnerability Actively Exploited in the Wild