NoiseLetter May 2026

Table of Contents
Loading nav...

This month, we're diving into early warning signals, blocklist gaps, and a SonicWall spike that echoes the pattern that preceded a CVE. We're also still traveling the globe, so catch us at one of the upcoming CrowdStrike CrowdTours in Frankfurt, Madrid, Dallas, or London. As always, thanks for being part of the GreyNoise Community!

Featured

Webinar: Can Sensor Data Warn You Before a CVE Drops?

The 2026 Verizon DBIR just confirmed what your patch queue already feels like: exploitation of vulnerabilities is now the #1 initial access vector (31% of breaches, up 55% YoY), and the median time to full remediation is 43 days — almost two weeks slower than last year. Attackers aren't waiting 43 days.

Before Cisco published CVE-2026-20127 (CVSS 10.0, zero-day), GreyNoise sensors observed eight activity surges compressing from 39 days to 2 days. That countdown pattern repeated across 33 CVEs — with a median lead time of 11 days before public disclosure.

Join us June 3rd at 2PM ET for the live "Ten Days Before Zero" findings.

Register Now >>

Where to find us

Fresh Content

At the Edge Clear: This is a preview of GreyNoise’s weekly At the Edge intelligence brief that we provide our customers, featuring select insights distilled from internet activity observed across the GreyNoise Global Observation Grid.  View our latest report >> 

Recent Tags and Vulnerabilities

View the recently created tags in the GreyNoise Visualizer. View Recent Tags >

Community

  • GreyNoise Block is available now with a free trial for 14 days. Test it out to build, manage, and deploy GreyNoise blocklists.
  • Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
  • Request a New GreyNoise Tag - Check out our page where our amazing community can submit tag requests to the GreyNoise team. 
  • Join our Community Slack + Discord- We share intel, give real time updates, and the occasional Dad joke. 

Meme of the Month

graphical user interface, text, application, chat or text message

Not subscribed to our NoiseLetter? Subscribe here.

Read the transcript

This month, we're diving into early warning signals, blocklist gaps, and a SonicWall spike that echoes the pattern that preceded a CVE. We're also still traveling the globe, so catch us at one of the upcoming CrowdStrike CrowdTours in Frankfurt, Madrid, Dallas, or London. As always, thanks for being part of the GreyNoise Community!

Featured

Webinar: Can Sensor Data Warn You Before a CVE Drops?

The 2026 Verizon DBIR just confirmed what your patch queue already feels like: exploitation of vulnerabilities is now the #1 initial access vector (31% of breaches, up 55% YoY), and the median time to full remediation is 43 days — almost two weeks slower than last year. Attackers aren't waiting 43 days.

Before Cisco published CVE-2026-20127 (CVSS 10.0, zero-day), GreyNoise sensors observed eight activity surges compressing from 39 days to 2 days. That countdown pattern repeated across 33 CVEs — with a median lead time of 11 days before public disclosure.

Join us June 3rd at 2PM ET for the live "Ten Days Before Zero" findings.

Register Now >>

Where to find us

Fresh Content

At the Edge Clear: This is a preview of GreyNoise’s weekly At the Edge intelligence brief that we provide our customers, featuring select insights distilled from internet activity observed across the GreyNoise Global Observation Grid.  View our latest report >> 

Recent Tags and Vulnerabilities

View the recently created tags in the GreyNoise Visualizer. View Recent Tags >

Community

  • GreyNoise Block is available now with a free trial for 14 days. Test it out to build, manage, and deploy GreyNoise blocklists.
  • Try our Free Account - Quickly identify noisy scanners and trending attacks with our free plan.
  • Request a New GreyNoise Tag - Check out our page where our amazing community can submit tag requests to the GreyNoise team. 
  • Join our Community Slack + Discord- We share intel, give real time updates, and the occasional Dad joke. 

Meme of the Month

graphical user interface, text, application, chat or text message

Not subscribed to our NoiseLetter? Subscribe here.