Data shared in shadowserver.org/what-we-do/… World Map view: dashboard.shadowserver.org/s… Tree Map view: dashboard.shadowserver.org/s… Exposure tracker: dashboard.shadowserver.org/s… See also @CERT_FR cert.cyber.gouv.fr/alerte/CE… Additional info: claroty.com/team82/research/…

Copeland/Dixwell XWEB refrigeration web controller incidents: As in the case of Danfoss, for a long time we have been sharing exposed Copeland XWEB Pro & Evo panels in Device ID reporting. We see around 1200 instances daily - these should of course not be publicly accessible.

Data shared in shadowserver.org/what-we-do/… World Map view: dashboard.shadowserver.org/s… Tree map view: dashboard.shadowserver.org/s… Exposure tracker: dashboard.shadowserver.org/s… Background: claroty.com/team82/research/… We are working on possible CVE tagging too

Danfoss refrigeration incidents: We are sharing exposed instances for a long time in our Device ID reporting, daily. For Danfoss AK-SM800A we still see at least 365 unique instances daily (drop from over 550 last few days) exposed. These need to be taken off the public Internet!

For MikroTik with SSH enabled, check out our Accessible SSH reporting (shadowserver.org/what-we-do/…), with the tag 'mikrotik' dashboard.shadowserver.org/s… - just over 119K seen daily currently Background: cert.pl/en/posts/2026/09/vul…

These should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 nvd.nist.gov/vuln/detail/cve… You can find all our MikroTik detections in Device ID report shadowserver.org/what-we-do/… (around 3M daily): dashboard.shadowserver.org/s…

We have started reporting out (daily) MikroTik instances with exposed proprietary services, such as WinBox & Bandwidth Test server (btest): shadowserver.org/what-we-do/… Around 2.6M exposed instances shared daily. Top: Brazil, Indonesia, USA. Tree map stats: dashboard.shadowserver.org/s…

IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': shadowserver.org/what-we-do/… 218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. Patch info: documentation.n-able.com/N-c… Background on incidents: huntress.com/blog/n-able-vul…

Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top: US (141) Stats - World Map view: dashboard.shadowserver.org/s… Tracker: dashboard.shadowserver.org/s…

Compromised Website Report: shadowserver.org/what-we-do/… Thank you to @GreyNoiseIO for the share! Background with info about the AI-orchestrated campaign behind the compromises (includes IOCs): greynoise.io/blog/ai-orchest…

We shared a one-off share of over 400 compromised PaperCut NG/MF instances (via CVE-2026-81578/CVE-2026-82078) observed by @GreyNoiseIO. IP data in our Compromised Website reporting for 2026-09-11, tagged 'papercut-compromise'. Dashboard Tree Map stats: dashboard.shadowserver.org/s…

Yes, looks like we undercounted due to a bug - we already shared out more complete results for the day and will have full results going forwards which will be similar to the numbers you mentioned

Running an outdated Plex Media Server? Patch! Dashboard Tree Map view: dashboard.shadowserver.org/s…

No CVEs have been issued meaning the vulnerabilities are essentially invisible to the security community limiting an effective response. We tag the raw IP data shared 'vulnerable-plex' in Vulnerable HTTP reporting: shadowserver.org/what-we-do/… Tracker: dashboard.shadowserver.org/s…

Since 2026-09-04 we are scanning/reporting daily unpatched versions of Plex Media Server in response to an advisory issued by Plex forums.plex.tv/t/important-s… for v1.43.2 & earlier. Over 36K instances found still unpatched! Top affected: US (16K) World Map: dashboard.shadowserver.org/s…

Exploitation is reported in the wild. Review for compromise and patch!

At least 122,500 MikroTik devices with SSH accessible found per 24 hour scan window on 2026-09-05 (no vulnerability check). IP data shared daily in Accessible SSH reporting shadowserver.org/what-we-do/… tagged 'mikrotik' & Device Identification reports: shadowserver.org/what-we-do/…

We added MikroTik SSH identification to our daily scans on 2026-09-04, in response to MikroTik's patches mikrotik.com/supportsec/sept…. As discovered by @CERT_Polska_en cert.pl/en/posts/2026/09/vul… unpatched MikroTiks can be compromised, if device supports remote access using SSH protocol

Make sure to install Emergency Patch (Release 3) - but assume compromise. Background on PaperCut incidents: huntress.com/blog/papercut-a… Detection based on Nuclei template by darses - github.com/projectdiscovery/… #CyberCivilDefense

Daily IP data now in our Vulnerable HTTP reporting, tagged 'cve-2026-82078' & 'cve-2026-81578': shadowserver.org/what-we-do/… Tree map view: dashboard.shadowserver.org/s… NVD entry: nvd.nist.gov/vuln/detail/cve… nvd.nist.gov/vuln/detail/cve… Patch info: papercut.com/kb/Main/securit…