Media Coverage

Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting the flaw in the wild and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to secure their servers by Sunday. Although GitLab released patches three weeks ago, threat watchdog Shadowserver revealed over the weekend that it tracks more than 1,000 unpatched GitLab servers exposed to ongoing attacks. GitLab says its DevSecOps platform has over 70 million registered users and is used by more than 50% of Fortune 100 companies worldwide.

The Hacker News disclosed that Dutch security firm Eye Security intervened to disable a dangerous background updater found in the abandoned software Time4Popcorn. The updater, which lacked encryption and verification, allowed for remote code execution at the highest privilege levels on Windows and Mac systems. Eye Security discovered the flaw when a client laptop attempted to connect to an expired web address. By registering the domain, the firm identified millions of vulnerable devices globally, including those on government and corporate networks. The firm has since transferred control of the domains to the Shadowserver Foundation to ensure ongoing protection.

Days after a cyberattack targeting French supermarket refrigerators, thousands of controllers across the globe are visible online and at risk of compromise. Hackers were able to manipulate controls inside the refrigerators, causing systems to overheat – and in some cases catch fire – leading to millions of dollars in damage. About 350 instances of the Danfoss AK-SM 800A remained exposed as of Wednesday, down from more than 550 earlier this week, according to researchers from Shadowserver Foundation. On Thursday, researchers said 1,173 Copeland XWEB Pro and Evo instances remain exposed to the internet.

Brooklyn District Attorney Eric Gonzalez announced today that, in one of the biggest operational cyber disruptions undertaken by a local prosecutor’s office, his Virtual Currency Unit (VCU) successfully disrupted a multinational cryptocurrency fraud operation that targeted members of the Russian community in the U.S.  The law enforcement cyber action disabled the global scam operation, seizing and disrupting 241 web domains and 112 servers, the contents of which confirmed the millions of dollars lost by the Russian community in Brooklyn, and throughout the country. The District Attorney thanked the FBI, Shadowserver, Coeus, and UltaHost for their assistance and cooperation in the investigation.

The Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation have taken down a malicious proxy service consisting of 178,000 compromised devices. Through the proxy service, criminals were able to exploit the IP addresses of innocent citizens and businesses. Users who try to visit the proxy service’s site will get to see a splash page that says that “this website has been taken down” by the Dutch National Police, the Netherlands Public Prosecutor’s Office, and the Shadowserver Foundation, a nonprofit security organization that helps to make the internet more secure for everyone.

SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances (tracked as CVE-2026-102255). Internet security threat watchdog Shadowserver currently tracks over 400 Internet-exposed SMA1000 appliances, although some may have already been patched. Although CVE-2026-102255 is not exploited in the wild, attackers often target SMA1000 flaws because they affect enterprise-grade secure remote access gateways used by government agencies, Managed Service Providers (MSSPs), and many large corporations to provide VPN access to internal apps and corporate networks.

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. Citrix released security updates to address the flaws (tracked as CVE-2026-88771 and CVE-2026-88772) days after national cybersecurity agencies, IT suppliers, and security teams began privately contacting Citrix customers and advising them to shut down their NetScaler appliances. Currently, threat watchdog Shadowserver tracks over 23,000 IP addresses with NetScaler fingerprints exposed on the Internet (including nearly 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances).

The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft. With authorization from the US District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation and TRM Labs to seize 50 websites used to operate the service and disable more than 150 domains tied to its infrastructure.  On September 11, 2026, officers from the Metropolitan Police Service’s cybercrime team arrested two men, aged 32 and 38, on suspicion of offenses connected with the alleged operation of EvilTokens.

A financially motivated operator has been running three open-source AI tools against many online retailers, mostly without supervision. The results are shocking: over 600,000 credit card records have been stolen, scripts to gather card information have been placed on dozens of checkout pages, and in at least two cases, the operator’s cleanup routine completely wiped out the victims’ data. Gambit Security’s Threat Intelligence team recovered the operator’s exposed staging server and reconstructed the campaign from what it left behind, and the picture it reveals is sobering for every security team. Gambit says it has notified many affected organizations and worked with the Shadowserver Foundation and Cloudflare to dismantle the infrastructure, though the operator has repeatedly rebuilt it and the campaign continues.

A critical vulnerability in the Issabel Framework, which supports Issabel PBX deployments, is being actively exploited in the wild. The flaw, tracked as CVE-2026-89026, allows unauthenticated remote attackers to execute OS commands on vulnerable PBX servers by forging authentication tokens. VulnCheck rated the issue critical with a CVSS v4 score of 9.3. The Shadowserver Foundation first observed exploitation activity on September 9, 2026, making rapid patching critical for organizations running internet-exposed Issabel PBX systems.