Palo Alto PAN-OS management interface affected by the Critical PHP vulnerabilities. CVE-2026-109618 & CVE-2026-109619

Shocking! 😲

Calif upped the game on technical blog post graphics 👏

Are we all in agreement vulnerability embargoes don't work?

Team at @PrevidianCyber along with our MADLAD AI were able to reproduce. All customers received early warning emails, and will be kept updated on new events.

PHP >= 5 RCE 😬

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

Slava Ukraini! 🇺🇦

We are behind you and that will not change, PM tells Zelensky bbc.in/4yklpHe

Around 80% of vulnerabilities in Previdian's KEV dataset can be exploited without authentication. The remaining 20% require credentials. CVE-2026-105740 (Langflow) is one of that 20%. First, they checked whether Langflow's auto-login feature was enabled. When they found it disabled, they switched to trying common, weak credentials. After successfully authenticating, they immediately attempted to exploit CVE-2026-105740 to access environment variables and perform other actions. We first observed exploitation attempts on September 19, but activity increased dramatically following the CVE's publication on October 5. If you're running Langflow, disable auto-login, enforce strong passwords, ensure all patched, and review suspicious authentication and MCP API activity. We observe exploitation attempts targeting numerous vulnerabilities every day across our honeypot network. There's simply too much activity for us to post about everything. Don't rely on social media to stay ahead of emerging threats. Sign up to Previdian to stay informed about the vulnerabilities attackers are actively targeting daily.

This is last Friday's password: 92780

Confirmed from vulnerable firmware. It is not today's date, it is derived from today's date. Doesn't include time. Still stupid.

Using AI to talk to our honeypot data really feels like we're living in the future!

⚠️ UPDATE: EXPLOITATION ATTEMPTS HIT ATLASSIAN CVE-2026-21589 (CVSS 9.3) Previdian's honeypot network saw exploitation attempts about 2 hours after watchTowr Labs published its technical write-up on the pre-auth file-read flaw we covered on Oct 6. What's new: • Root cause: the shared atlassian-plugins-webresource library turns "::" into "/", so "..::" sequences slip past path-traversal checks • No login needed: files inside the app server's web root can be read, incl. protected WEB-INF files • Affects Jira, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye (Data Center) • In Crowd-linked setups, crowd[.]properties holds the app password in plaintext; watchTowr used it to create a user and make it a Jira admin • Previdian logged 15 attempts from 3 IPs: 38.60.157[.]86, 146.70.187[.]234, 159.26.119[.]225 Fixed versions are in our earlier post below; one correction: the Crowd 7.1 fix is 7.1.7, not 7.1.1. ⚠️ Analyst Note: These are attempts seen on honeypots, not confirmed compromises, and the CVE is not in CISA KEV. A Nuclei scanning template is out; expect more probing. Patch now, or pull instances off the internet until you can, and check access logs per Atlassian's advisory. Source (watchTowr Labs): labs.watchtowr.com/you-wont-… #DDW #DarkWeb #Atlassian #CVE #PatchNow x.com/DailyDarkWeb/status/21…

Exploitation attempts have now started to hit our honeypot network

The gift that keeps on givin'

⚠️ Previdian Watch users were warned earlier this morning that CVE-2026-21589 was highly likely to be exploited, based on an assessment from our autonomous prediction system. A public PoC has now been released. The critical, unauthenticated file access (read) vulnerability affects: • Bitbucket Data Center • Confluence Data Center • Jira Service Management Data Center • Jira Software Data Center • Bamboo Data Center • Crowd Data Center • Crucible • Fisheye Atlassian has not reported exploitation and Previdian has not yet observed attempts in our sensors yet. But with working exploit code now public, we expect that to change very quickly. Patch affected installations now. If you cannot patch immediately, restrict internet access or apply WAF mitigation.

The advisory was first published on October 1st and confirmed as exploited in the wild by Fortinet at same time. Started seeing exploitation attempts over yesterday and today (Oct 6th) in our honeypots 🐝