@Shadowserver

Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!

 Global
shadowserver.org/partner
Joined March 2009
  • Tweets2.4K
  • Following0
  • Followers22K
637Media
Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API? We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash. Check it out at github.com/The-Shadowserver-…
1
14
57
14,950
Copeland/Dixwell XWEB refrigeration web controller incidents: As in the case of Danfoss, for a long time we have been sharing exposed Copeland XWEB Pro & Evo panels in Device ID reporting. We see around 1200 instances daily - these should of course not be publicly accessible.
2
6
1
12
1,789
Data shared in shadowserver.org/what-we-do/… World Map view: dashboard.shadowserver.org/s… Tree Map view: dashboard.shadowserver.org/s… Exposure tracker: dashboard.shadowserver.org/s… See also @CERT_FR cert.cyber.gouv.fr/alerte/CE… Additional info: claroty.com/team82/research/…
1
1
388
Danfoss refrigeration incidents: We are sharing exposed instances for a long time in our Device ID reporting, daily. For Danfoss AK-SM800A we still see at least 365 unique instances daily (drop from over 550 last few days) exposed. These need to be taken off the public Internet!
2
13
1
16
3,772
Data shared in shadowserver.org/what-we-do/… World Map view: dashboard.shadowserver.org/s… Tree map view: dashboard.shadowserver.org/s… Exposure tracker: dashboard.shadowserver.org/s… Background: claroty.com/team82/research/… We are working on possible CVE tagging too
1
593
We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): shadowserver.org/what-we-do/… Around 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA. Tree map stats: dashboard.shadowserver.org/s…
1
5
9
2,997
These should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 nvd.nist.gov/vuln/detail/cve… You can find all our MikroTik detections in Device ID report shadowserver.org/what-we-do/… (around 3M daily): dashboard.shadowserver.org/s…
1
1
3
1,378
For MikroTik with SSH enabled, check out our Accessible SSH reporting (shadowserver.org/what-we-do/…), with the tag 'mikrotik' dashboard.shadowserver.org/s… - just over 119K seen daily currently Background: cert.pl/en/posts/2026/09/vul…
1
2
633
Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top: US (141) Stats - World Map view: dashboard.shadowserver.org/s… Tracker: dashboard.shadowserver.org/s…
1
5
6
2,261
IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': shadowserver.org/what-we-do/… 218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. Patch info: documentation.n-able.com/N-c… Background on incidents: huntress.com/blog/n-able-vul…
1
848
We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @GreyNoiseIO. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'. Dashboard Tree Map stats: dashboard.shadowserver.org/s…
1
10
13
2,564
Compromised Website Report: shadowserver.org/what-we-do/… Thank you to @GreyNoiseIO for the share! Background with info about the AI-orchestrated campaign behind the compromises (includes IOCs): greynoise.io/blog/ai-orchest…
1
1
1
556
Since 2026-09-04 we are scanning/reporting daily unpatched versions of Plex Media Server in response to an advisory issued by Plex forums.plex.tv/t/important-s… for v1.43.2 & earlier. Over 36K instances found still unpatched! Top affected: US (16K) World Map: dashboard.shadowserver.org/s…
1
4
7
1,501
No CVEs have been issued meaning the vulnerabilities are essentially invisible to the security community limiting an effective response. We tag the raw IP data shared 'vulnerable-plex' in Vulnerable HTTP reporting: shadowserver.org/what-we-do/… Tracker: dashboard.shadowserver.org/s…
1
1
1
1,065
Running an outdated Plex Media Server? Patch! Dashboard Tree Map view: dashboard.shadowserver.org/s…
1
423
We added MikroTik SSH identification to our daily scans on 2026-09-04, in response to MikroTik's patches mikrotik.com/supportsec/sept…. As discovered by @CERT_Polska_en cert.pl/en/posts/2026/09/vul… unpatched MikroTiks can be compromised, if device supports remote access using SSH protocol
1
20
4
67
7,431
At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check). IP data shared daily in Accessible SSH reporting shadowserver.org/what-we-do/… tagged 'mikrotik' & Device Identification reports: shadowserver.org/what-we-do/…
1
1
4
1,304
Exploitation is reported in the wild. Review for compromise and patch!
1
1
879
PaperCut MF/NG incidents: At least 204 instances found on 2026-08-31 still vulnerable to CVE-2026-82078/CVE-2026-81578 RCE that is exploited in the wild. Make sure to check for compromise & patch. Top affected: US (60). Dashboard World Map view stats: dashboard.shadowserver.org/s…
1
5
1
7
2,561
Daily IP data now in our Vulnerable HTTP reporting, tagged 'cve-2026-82078' & 'cve-2026-81578': shadowserver.org/what-we-do/… Tree map view: dashboard.shadowserver.org/s… NVD entry: nvd.nist.gov/vuln/detail/cve… nvd.nist.gov/vuln/detail/cve… Patch info: papercut.com/kb/Main/securit…
1
1
2
713
Make sure to install Emergency Patch (Release 3) - but assume compromise. Background on PaperCut incidents: huntress.com/blog/papercut-a… Detection based on Nuclei template by darses - github.com/projectdiscovery/… #CyberCivilDefense
2
1
436
Load more