The Shadowserver Foundation

Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API? We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash. Check it out at github.com/The-Shadowserv…

Thank you to our anonymous partner for the contribution!

We shared out ~2000 unique IPs exposing secrets that are known to have been harvested by a threat actor. IP data in our Compromised Website report: shadowserver.org/what-we-do/net… for your network/constituency with the 'stolen-key' tag (dated 2026-07-02). Check your reports!

We also recently collaborated with @ValidinLLC for additional domain based detections, thank you!

We are scanning for SimpleHelp CVE-2026-48558 vulnerable instances since 2026-06-16. We see 439 unpatched in our 2026-07-01 scan. Most (268) found in the US. Raw IP data in shadowserver.org/what-we-do/net… for your network/constitiuency Dashboard World Map view: dashboard.shadowserver.org/statistics/com…

Patch info from Oracle: oracle.com/security-alert…

IP data for your network/constituency shared in our Device ID reporting (device_vendor Oracle device_model Oracle E-Business Suite) World Map view of exposed EBS instances (no vulnerability assessment): dashboard.shadowserver.org/statistics/iot… CVE-2026-46817 NVD entry: nvd.nist.gov/vuln/detail/CV…

We have improved our Oracle E-Business Suite fingerprinting by adding domain based scans in collaboration with @ValidinLLC. Around 950 exposed instances now seen globally (no vulnerability assessment). CVE-2026-46817 attempts have been observed in the wild by @DefusedCyber

Global Stats: Dashboard World Map view: dashboard.shadowserver.org/statistics/com… Dashboard Tree Map view: dashboard.shadowserver.org/statistics/com…

The report also contains over 1000 IPs where the threat actor ran credential sniffing in June. Check out SpyCloud's analysis here: spycloud.com/blog/what-spyc… Thank you to SpyCloud for the collaboration! If you receive an alert from us, make sure to verify the data!

Yesterday we reported out an additional dataset found on the #Fortibleed threat actors systems in a one-off Special Report - shadowserver.org/what-we-do/net…. The data was shared with us by @spycloudco & covers 35000 new IPs not previously reported.

On the THREATCON1 Podcast, Piotr Kijewski (@Shadowserver) breaks down AI-generated vuln reports, fake exploits and “research” that fails in the real world. Could AI misinformation become its own threat vector? Watch: youtube.com/watch?v=2E1Tn1… Listen: podcasts.apple.com/us/podcast/epi…

As with SocGholish Compromised WordPress Sites Special Report run last week (2026-06-18), if you receive a StealC alert from us or your service provider/national CSIRT, please follow remediation advice and change passwords immediately!

StealC Historical Bot Special Report technical details and sample data available here (dated 2026-06-24): shadowserver.org/what-we-do/net…

More Operation Endgame #cybercrime disruption success this week, with a new one-off StealC Historical Bot Special Report run overnight (2026-06-24), continuing our support for international LE partners: shadowserver.org/news/stealc-hi…

Raw IP data shared in our Vulnerable HTTP reporting shadowserver.org/what-we-do/net… tagged 'cve-2026-48907' filtered by network/constituency Dashboard Tree Map view: dashboard.shadowserver.org/statistics/com… Patch info: joomlacontenteditor.net/news/jce-secur…

Last week we added scanning for Joomla JCE editor extension CVE-2026-48907 vulnerable instances. This RCE vulnerability is exploited in the wild & on @CISACyber KEV. 4840 vulnerable instances seen 2026-06-22 down from 5146 on 2026-06-19. Top affected: US dashboard.shadowserver.org/statistics/com…

IP data tagged 'fortibleed' in shadowserver.org/what-we-do/net… with timestamp set to 2026-06-18 SOCRadar FortiBleed checker: socradar.io/free-tools/for… Background: socradar.io/blog/fortiblee…

We shared a one-off "FortiBleed" dataset of compromised Fortinet devices in our Compromised Website Report shadowserver.org/what-we-do/net… thanks to collaboration with @socradar! Stats: Dashboard World map view: dashboard.shadowserver.org/statistics/com… Dashboard Tree map view: dashboard.shadowserver.org/statistics/com…

WordPress site users/admins (plus their friends and colleagues): Please read the defensive guidance provided, check your sites and remediate any signs of compromise immediately.

1,441,695 credentials covering period 2023-05-17 to 2026-05-25, from 1,134,542 domains hosted on 271,176 unique IP addresses, across 7,550 different ASNs in 187 countries/territories globally. Report technical details available here (dated 2026-06-18): shadowserver.org/what-we-do/net…

New one-off SocGholish Compromised #WordPress Sites Special Report run today, in continued support of international LE partners in Operation Endgame #cybercrime disruption: shadowserver.org/news/socgholis… Great work once again everyone involved 👏