CrowdSec saw the first requests matching CVE-2026-88771 on September 22, five days before Citrix published it with a fix (and before @watchtowrcyber shared details). It's a CVSS 9.5 flaw in NetScaler ADC and Gateway: no login, default configuration, root on the box. Our signal counts are low, but don't read that as low risk. Careful operators pick their targets first, and two of the addresses we saw went after this CVE and nothing else. Patching won't remove anyone already inside. The full story is in this week's Threat Alert 👉crowdsec.net/vulntracking-re… #cve #cve202688771 #threatalert #cybersecurity

On the night of 7–8 October, a drone attack hit Yandex's data center in Sasovo, Russia. Our sensors saw it from the other side of the internet: the YandexBot traffic hitting our network went dark. Here's what the CrowdSec map showed 👇 youtube.com/shorts/GJqUkh4Dw…

Two visitors hit your site. Same browser, same clicks, same speed. One of them is a bot. Which one? CrowdSec 1.8's WAF can tell, and on October 29, our experts will show you how, live, along with everything else in 1.8. 📅 October 29, 4 PM CET Get a reminder → youtube.com/live/rHKs3yAquQo #webinar #WAF #botdetection #cybersecurity

5 years of data science at CrowdSec, told by Matthieu Mazzolini (Data Team Lead). How do we count our network? Why do we run honeypots, and why only 30? Why are there canaries in our blocklists? And why does the team call malicious IPs "pokemons"? 🙂 An honest look behind our IP reputation, and at what our code really shows, from one of the people who builds it. Read it here: crowdsec.net/blog/5-years-of… #datascience #threatintelligence

The holiday season brings a predictable increase in malicious bot activity, from scraping and scalping to more aggressive attacks. With Black Friday and Christmas approaching, now is a good time to make sure your infrastructure is ready. 🤖 CrowdSec’s bot detection uses fingerprinting and proof of work to distinguish legitimate users from unwanted bots, helping you protect your applications without getting in the way of real customers. Handle distributed attacks, scraping, scalping, and other aggressive automation with a production-ready approach. Learn more → docs.crowdsec.net/docs/next/… #WAF #botdetection #opensource

🚨 CVE-2026-21589 is a critical Atlassian file-read vulnerability in Jira, Confluence, and Bitbucket Data Center, already being targeted in the wild. CrowdSec has tracked 89 unique IPs sending matching requests since October 7. Patching closes the hole. But if your instance was exposed, rotate the Crowd application password and check your Jira admin accounts. Read the latest Threat Alert article to get the analysis → crowdsec.net/vulntracking-re… #cve #cve202621589 #threatalert #Atlassian #Jira #Bitbucket #Confluence

CVSS, EPSS, and KEV tell you which vulnerabilities might get exploited. The Live Exploit Tracker shows you which ones are being exploited right now. It's built on live attacks seen across 250K+ machines in the CrowdSec network. With it, you can: - patch the CVEs that are actually being exploited first (it tracks 700+ of them, across 100+ vendors) - block the IPs exploiting them, with a feed updated several times an hour - plug that Blocklist into what you already run: your CDN, firewall, or cloud provider See it live → crowdsec.net/live-exploit-tr… #vulnerabilitymanagement #threatintelligence

MindMax put CrowdSec’s bot detection to the test and challenged ~1M suspicious clients in its first week, blocking 99%+ of non-human traffic while keeping the experience seamless for real users. Read the full success story → crowdsec.net/blog/mindmax-de… #WAF #botdetection

Is that a human… or a bot? 🤖 CrowdSec 1.8 brings bot detection to the WAF, helping distinguish real browsers from bots that are trying to blend in. See it in action and discover what else is new in CrowdSec 1.8 with CTO Thibault Koechlin and DevSecOps Sebastien Blot. 📅 October 29 🕓 4 PM CET Click Notify Me & join us →youtube.com/live/rHKs3yAquQo #webinar #community #cybersecurity #WAF #botdetection

Not all bots look like bots. 🤖 Modern bots can run real browsers, use residential IPs, and mimic legitimate traffic. CrowdSec’s WAF Bot Detection uses fingerprinting and proof of work to distinguish them, helping stop scraping, scalping, and other aggressive automation. Watch how to set it up 👇 Get the guide here: docs.crowdsec.net/docs/next/… #WAF #botdetection #appsec #cybersecurity

🚨 CVE-2026-85706 is a critical GitLab file-read vulnerability already being exploited in the wild. CrowdSec has tracked 1,022 unique IPs sending matching requests since September 11. Patching closes the hole. But if your instance was exposed, rotate the secrets that may already have been read. Read the Threat Alert article to get the analysis, including what we're seeing in the wild and how to protect GitLab 👉 crowdsec.net/vulntracking-re… #cve #cve202685706 #threatalert #cybersecurity #threatintelligence

Which vulnerabilities actually need your attention? And how fast do you need to act? Our Vulnerability & Exploitation Report gives you the real-world data to answer both. See how quickly attackers move, why CVSS alone isn’t enough, and which vulnerabilities are being exploited at scale. 👉 Download the report: crowdsec.net/vulnerability-e… #cybersecurity #threatintelligence #cve #vulnerabilitymanagement

Last week, CrowdSec CEO @philippe_humeau presented at the @SANSInstitute Cyber Leaders event in Brussels. The presentation looked at what real-world attack data tells us about vulnerability exploitation, from how quickly attackers move after a CVE is disclosed to the IPs actually involved in exploitation. You can check out the presentation below 👇 Want to dig into the data yourself? Check IP reputation and activity with IPDEX: ipdex.crowdsec.net Track which IPs are exploiting which CVEs: tracker.crowdsec.net

🤖 When CrowdSec 1.8 introduced bot detection, some adventurous alpacas put the alpha feature straight into production. That gave us a new perspective: not just what an IP is doing, but what’s running behind it. Our first investigation uncovered PaperPhone, a scraping network spanning 75K IPs across 43 countries, with 13 claimed device identities and some very suspicious fingerprints. 🌍 The geographic diversity? Not quite what it seems. Read the full investigation: crowdsec.net/blog/the-paperp… #botdetection #WAF #cybersecurity

👻 Creepy, crawly, and hiding in plain sight… CrowdSec 1.8 brings bot detection to the WAF, helping distinguish a real browser from a bot pretending to be one. 🤖 Join CTO Thibault Koechlin and DevSecOps Sébastien Blot to see how it works, what’s new in CrowdSec 1.8, and how to keep unwanted bots in the shadows. 🎃 No tricks, just treats at this #CommunityOfficeHours happening October 29th at 4 PM CET. Bring your questions! Click on ‘Notify Me’ & save the date → youtube.com/live/rHKs3yAquQo #webinar #community #cybersecurity #WAF #BotDetection

🚨 In this week’s threat alert, we cover CVE-2026-87902, a critical WordPress path traversal vulnerability that can lead to remote code execution. CrowdSec has observed 30,813 unique IP addresses sending requests matching the exploitation pattern in just five days. Read our latest article for the full analysis, exploitation data, protection recommendations, and more: crowdsec.net/vulntracking-re… Keep your network informed. Like and share this post! #cve #cve202687902 #threatalert #threatintelligence #cybersecurity

CrowdSec Blocklists feature a 5% daily rotation, ensuring users always benefit from fresh, up-to-date threat intelligence. To learn more about CrowdSec Blocklists and how to integrate them with your @Sophos Firewall, watch our full video guide here:  youtube.com/watch?v=lmqzFpHp… #firewall #threatintelligence #blocklists #cybersecurity