New! AI Cyber Index: Benchmarking AI Models on Defensive Capabilities
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: November 2 – 9, 2026
Adversaries exploited a new OpenSSH flaw on GreyNoise sensors. Hosting-based fleets also stepped up firewall exploitation attempts and VPN password guessing.
A new OpenSSH authentication bypass is now known exploited. Adversaries exploited it on GreyNoise sensors about 40 hours after its fix. GreyNoise captured them adding SSH keys and staging a remote control implant.
For the second brief running, three hosting ranges sent nine in ten Sophos Firewall exploitation attempts on a known exploited flaw. They raised those attempts by about half. Hosts in all three ranges carry the same client fingerprint.
Cisco SSL VPN Bruteforcer credential attempts rose by about a third, the third rise in a row. Hosts new to the series carried the increase. Blocking last week's hosts would miss more than half of the attempts.
On a single day, 16 or 17 malicious IPs attempted each of five ASUS RT-AX55 command injection flaws, one of them known exploited. None did on any other day of the week.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: November 2 – 9, 2026
Adversaries exploited a new OpenSSH flaw on GreyNoise sensors. Hosting-based fleets also stepped up firewall exploitation attempts and VPN password guessing.
A new OpenSSH authentication bypass is now known exploited. Adversaries exploited it on GreyNoise sensors about 40 hours after its fix. GreyNoise captured them adding SSH keys and staging a remote control implant.
For the second brief running, three hosting ranges sent nine in ten Sophos Firewall exploitation attempts on a known exploited flaw. They raised those attempts by about half. Hosts in all three ranges carry the same client fingerprint.
Cisco SSL VPN Bruteforcer credential attempts rose by about a third, the third rise in a row. Hosts new to the series carried the increase. Blocking last week's hosts would miss more than half of the attempts.
On a single day, 16 or 17 malicious IPs attempted each of five ASUS RT-AX55 command injection flaws, one of them known exploited. None did on any other day of the week.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
