The Shadowserver Foundation
@Shadowserver
Followers
21K
Following
321
Media
544
Statuses
2K
Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!
Global
Joined March 2009
Using ELK & interested in automating ingestion of our threat intel for your network/constituency? We have added support for Elasticsearch Custom Logs integration for our free daily reports API. Check it out at https://t.co/vGJlSB0UYt
2
17
68
Free IP data shared daily with National CSIRTs worldwide & subscribed impacted network owners in our Compromised Website report (tagged badcandy) https://t.co/D1KZAGvNIZ Act! Background on CVE-2023-20198/CVE-2023-20273 & BadCandy implant (2 yrs back): https://t.co/DWK2SgReOn
blog.talosintelligence.com
Cisco has identified active exploitation of two previously unknown vulnerabilities in the Web User Interface (Web UI) feature of Cisco IOS XE software — CVE-2023-20198 and CVE-2023-20273 — when...
0
0
2
Don’t take BADCANDY from strangers ... We still see around 15 000 Cisco IOS XE devices backdoored with the implant - and frequent re-infection campaigns. You can track those here: https://t.co/heMUufvNEX Geo breakdown of implanted Cisco IOS XE: https://t.co/jYrjomiSeT
We've released a new advisory on the BADCANDY 🍬 implant that continues to haunt vulnerable Cisco IOS XE devices. Read the full advisory to learn more about this threat in Australia and what you can do to remove and mitigate the implant 👉 https://t.co/ZK5pXz2kFd
1
8
17
Results are based on versions returned. CVE-2025-40778 Public Dashboard tracker: https://t.co/ZZ5sDdqYmM NVD entry: https://t.co/tBXL8RbqML
#CyberCivilDefense
0
0
1
We added CVE-2025-40778 BIND9 tagging (potential susceptibility to cache poisoning) to our DNS scans: https://t.co/pQuzD8PVKu We found nearly 8898 unpatched DNS open resolvers on 2025-10-30, down to 6653 on 2025-11-01: https://t.co/syQkzugRJD Patch info: https://t.co/p3rdrXyTpc
1
13
22
This vulnerability is on @CISACyber KEV: https://t.co/h2mS6u65wB NVD: https://t.co/r1w6gWbwj4 Microsoft Advisory: https://t.co/MDB13elFF4 HawkTrace writeup: https://t.co/S2ddQkLPf5 Huntress writeup: https://t.co/yq70vVYCrm Eye Security writeup:
research.eye.security
First reported by Eye Security, this WSUS CVE exposes a major weakness in Microsoft’s update mechanism. Read our full analysis to understand the discovery, proof-of-concept, and recommended defenses.
0
1
3
IP data is being shared in our Device ID reporting https://t.co/1uPaaDBQcc with device_vendor set to Microsoft & device_model set to Windows Server Update Services (Open). Geo distribution (World Map): https://t.co/tzFgKTZMOi Tree map view: https://t.co/dS7nBXgNwR
1
0
0
The award-winning documentary that Sen. Adam Schiff demanded to have removed from Amazon Prime shows how metabolic and other natural cancer treatments work. "We're not giving cancer an opportunity to detour . . . to escape down one of its usual [biochemical] pathways."
16
56
228
Attention - Microsoft WSUS CVE-2025-59287 incidents! We are observing exploitation attempts based on a published POC. We have also began fingerprinting exposed WSUS instances (ports 8530/8531) with at least 2800 seen on 2025-10-25 (not necessarily vulnerable).
1
52
140
For background and detection methodology (version based), please read: https://t.co/ZJkRpecl2a (thanks @watchtowrcyber !) Patch information from WatchGuard is here: https://t.co/d9jBNv6221
#CyberCivilDefense
watchguard.com
Updated October 21 2025: Updated to provide Indicators of Attack and additional remediation guidance due to potential active exploits in the wild. An Out-of-bounds Write vulnerability in the WatchG...
0
0
5
To search for statistics in our Public Dashboard, set source to isakmp_vulnerable, isakmp_vulnerable6 and use the 'cve-2025-9242' tag. Geo breakdown (world map): https://t.co/dIQRqaR7nt Geo breakdown (tree map): https://t.co/Fc44vHrN3Z Tracker: https://t.co/iLqWDPHiCV
1
1
4
We are now sharing daily IP data on WatchGuard Fireware OS IKEv2 Out-of-Bounds Write CVE-2025-9242 vulnerable instances, with over 71 000 seen on 2025-10-18. Data shared in our Vulnerable ISAKMP reportings - https://t.co/CNt9ZzP0uD Top affected: US with 23.2K instances
1
15
27
💸 Top experts now earning over $5,000/month sharing their knowledge on CallPayMin!
0
0
2
Proud to support our Law Enforcement partners in another successful cybercrime disruption: Operation SIMCARTEL Great work everyone involved 👏 https://t.co/2cpjSafBbS
0
11
36
You can track F5 related exposure on our Public Dashboard here:
1
0
3
Follow guidance from @CISACyber & @NCSC UK to identify (for example, using our reporting) and harden F5 assets: https://t.co/nCJA9HPRCW
https://t.co/ii5qbd37rz
ncsc.gov.uk
The NCSC is advising organisations to follow the guidance issued by F5 and to install the latest security updates.
1
0
5
Regarding F5 network compromise (see https://t.co/8ivVy4lzgl): We are sharing daily IP data on F5 exposures in our Device Identification report https://t.co/1uPaaDBimE (device_vendor set to F5). ~269K IPs seen daily, nearly half in US. Geo breakdown: https://t.co/j029kIGasG
2
28
76
ATTENTION: Service With A Shotgun is OUT NOW We asked one of the Sale Associates at Undead Depot to provide you with proper training. Make sure you watch carefully. We wouldn't want any workplace incidents. Outside of the undead.
3
18
54
We are also in the process of expanding Oracle E-Business Suite exposure, which you can track here:
0
0
2
Tree map: https://t.co/8opsyqY49F Tracker: https://t.co/1tCSNl7qFe If you receive an alert from us, please assume compromise (see also @CISACyber KEV list) Patch info from Oracle: https://t.co/2ahaZZ6RNy Background: https://t.co/9HhnZoHVvc Please let us know of any FPs
ncsc.gov.uk
The NCSC is encouraging UK organisations to take immediate action to mitigate a vulnerability (CVE-2025-61882) affecting Oracle E-Business Suite.
1
0
4
Oracle E-Business Suite incidents: We have added CVE-2025-61882 scanning & reporting with 576 potential vulnerable IPs found on 2025-10-06. Top affected: United States. IP data in https://t.co/qxv0Gv6cAK World map view of likely vulnerable instances: https://t.co/f4X8wr2dYS
1
7
15
You can track CVE-2025-20333 & CVE-2025-20362 vulnerable (unpatched) Cisco ASA/FTD instances here - https://t.co/qbZfiyiuVE Around ~45K vulnerable seen on 2025-10-04
Attention! Cisco ASA/FTD CVE-2025-20333 & CVE-2025-20362 incidents: we are now sharing daily vulnerable Cisco ASA/FTD instances in our Vulnerable HTTP reporting: https://t.co/ukqg2xtPkS Over 48.8K unpatched IPs found on 2025-09-29. Top affected: USA https://t.co/cPqItgdVbf
0
11
35
Mavericks face Thunder, Timberwolves take on Nuggets and Grizzlies are up against Warriors. Lock in your predictions. 🏀 Giving away Platform Credits to 5 new followers - Follow @ForkastGG and @ForkastSports - Comment your favourite NBA team You think you know the outcomes?
4
2
10
https://t.co/OUDi7l28Ma Cisco advisories with patch info: CVE-2025-20333: https://t.co/NUawLgnKg3 CVE-2025-20362: https://t.co/XG8sy1lU4D More info: @CISACyber Emergency Directive EDD-25-03: Identify and Mitigate Potential Compromise of Cisco Devices:
cisa.gov
1
0
3