New! PHP2Shell: Successful exploitation observed against a vulnerable GreyNoise sensor
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: October 26 – November 2, 2026
Adversaries went after the systems that route and admit traffic into a network. They attempted a known exploited Cisco SD-WAN Manager admin bypass in a one-day burst, and three matching hosting ranges drove Sophos Firewall exploitation attempts. Cisco VPN password attempts surged for the third time in a month.
Cisco SD-WAN Manager CVE-2026-76504 Auth Bypass Attempt peaked at 20 malicious IPs in a single day, with almost no discovery traffic first. CISA's fix deadline had passed a month earlier.
Four days later, 24 malicious IPs attempted Citrix NetScaler Command Injection CVE-2017-6316 Attempt in a separate one-day burst, after five quiet days. Both flaws are on CISA's known exploited list.
Three hosting ranges on three networks sent 90% of Sophos Firewall CVE-2022-1040 Remote Code Execution Attempt traffic in near-equal shares. Blocking any one range leaves at least two thirds in place.
Cisco SSL VPN Bruteforcer peaked at 350 malicious IPs in a day, 1.9 times the 22 October peak, its third spike in a month. Four hosting IPs sent 82% of the credential attempts.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: October 26 – November 2, 2026
Adversaries went after the systems that route and admit traffic into a network. They attempted a known exploited Cisco SD-WAN Manager admin bypass in a one-day burst, and three matching hosting ranges drove Sophos Firewall exploitation attempts. Cisco VPN password attempts surged for the third time in a month.
Cisco SD-WAN Manager CVE-2026-76504 Auth Bypass Attempt peaked at 20 malicious IPs in a single day, with almost no discovery traffic first. CISA's fix deadline had passed a month earlier.
Four days later, 24 malicious IPs attempted Citrix NetScaler Command Injection CVE-2017-6316 Attempt in a separate one-day burst, after five quiet days. Both flaws are on CISA's known exploited list.
Three hosting ranges on three networks sent 90% of Sophos Firewall CVE-2022-1040 Remote Code Execution Attempt traffic in near-equal shares. Blocking any one range leaves at least two thirds in place.
Cisco SSL VPN Bruteforcer peaked at 350 malicious IPs in a day, 1.9 times the 22 October peak, its third spike in a month. Four hosting IPs sent 82% of the credential attempts.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
