The Shadowserver Foundation
@Shadowserver
Followers
21K
Following
319
Media
533
Statuses
2K
Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!
Global
Joined March 2009
Using ELK & interested in automating ingestion of our threat intel for your network/constituency? . We have added support for Elasticsearch Custom Logs integration for our free daily reports API. Check it out at
2
17
67
Raw IP data shared daily for your constituency in our Vulnerable HTTP reporting tagged 'cve-2025-57819'. and. Compromised Website reporting tagged 'freepbx-compromised'. CVE-2025-57819 tracker :.
1
0
1
FreePBX CVE-2025-57819 (CVSS 10.0) incidents: 6620 unpatched instances seen 2025-08-29, at least 386 compromised. Dashboard links:.Vulnerable (unpatched): Compromised: . Check for compromise, patch -
1
5
15
Citrix NetScaler CVE-2025-7775 patch rate as seen in our scans: . Now down from 28.2K to 12.4K. Europe patching at a faster rate than North America . (you can toggle overlapping/stacked time series on our Dashboard to compare)
ALERT: On 2025-08-26 over 28.2K Citrix instances were unpatched to CVE-2025-7775 RCE. There is exploitation in the wild confirmed by @CISACyber KEV. Patch info from Citrix: Top affected: US, Germany. Dashboard geo breakdown:
0
6
13
IP data is being shared in our Vulnerable HTTP reporting (tagged 'cve-2025-7775'). If you receive an alert from us investigate for compromise. You can track CVE-2025-7775 patching progress on our Dashboard at:
0
2
3
Caught in the middle of a political battle, @BlackRock reaffirmed its focus is helping millions of Americans save for retirement. They warned that injecting politics from either side risks undermining financial performance.
prosperityretirementalliance.com
Millions of Ameircans depend on the security of their retirement savings to live with dignity after a lifetime of hard work. That’s why the Alliance for Prosperity and a Secure Retirement (APSR)...
1
0
4
ALERT: On 2025-08-26 over 28.2K Citrix instances were unpatched to CVE-2025-7775 RCE. There is exploitation in the wild confirmed by @CISACyber KEV. Patch info from Citrix: Top affected: US, Germany. Dashboard geo breakdown:
2
40
72
Breakdown by GTP type (2025-08-19):.GTP-C-v2 with ~255K IPs seen: GTP-C-v1 with ~14K IPs seen:. GTP-U with ~18K IPs seen:. These services should not be exposed to the public Internet. #CyberCivilDefense
0
1
2
We added a new daily scan report type, Accessible GPRS Tunneling Protocol (GTP) services listing IPs with publicly exposed GTP-C (Core) hosted on port 2123/UDP & GTP-U (User) 2152/UDP. Report format: Dashboard World map view:
2
6
16
Tree map breakdown by country (2025-08-15):. Cisco: . Linksys:.––. Araknis:.
0
1
1
Relevant Dashboard Attacking Devices trends, with device model breakdown:. Cisco: Linksys:. https://dashboard.shado–– Araknis:.
1
0
1
Always curious and full of energy, Beagles turn every walk into an adventure 🐾🎉.
95
369
7K
We appreciate all feedback on any investigations as a result of our reports, should you receive one for your network. Check for device_vendor set to Cisco, Linksys or Araknis Networks with different device_model fields.
1
0
1
Since July 30th we are seeing an increase in scans coming from ~2200 compromised Cisco Small Business RV series routers , Linksys LRT series, & Araknis Networks (AN-300-RT-4L2W). Top affected: US but also many others. IP data on these scans shared in
1
6
8
IP data shared in Vulnerable HTTP report tagged 'cve-2025-8875' & 'cve-2025-8876'): If you receive an alert from us review for signs of compromise & patch. Patch info from N-able: Dashboard tree map:
1
0
2
We added version based N-able N-central RMM CVE-2025-8875 & CVE-2025-8876 detection to our daily scans. 1077 IPs unpatched IPs seen on 2025-08-15. Both CVEs recently added to @CISACyber KEV. Top affected: US, Canada, Netherlands, UK. Dashboard map view:
1
17
32
Dashboard links:. Tracker: World map: . Tree map:
0
1
1
We see exploitation attempts related to both vulnerabilities in our sensors. Data on vulnerable IPs shared in our Vulnerable HTTP reporting: tagged 'cve-2025-5777' & 'cve-2025-6543'. Citrix advisories: .
1
1
1
Still a large number of unpatched Citrix NetScaler devices likely vulnerable to CVE-2025-5777 (3312 seen) & CVE-2025-6543 (4142 seen). Both vulns are on @CISACyber KEV. The Dutch @ncsc_nl has recently released an update related to CVE-2025-6543 activity:
1
10
25
Data in Vulnerable HTTP reporting tagged 'cve-2025-41236'. Dashboard tree map: Dashboard world map: CVE-2025-41236 tracker:. Broadcom advisory: NVD entry:
support.broadcom.com
0
2
5
We added VMware ESXi CVE-2025-41236 (CVSS 9.3) version based detection to our daily scans. First added 2025-07-19 with 17,238 IPs found. Latest scan (2025-08-10) detects 16,330 unpatched IPs, which is a slow patch rate. Top affected: France, China, US, Germany
1
26
102
WRECKED. Hirono: Has any court said that DEI is unconstitutional? Yes or no?. Hamilton: Yes. Hirono: Which court?. Hamilton: The United States Supreme Court. Hirono: I disagree with you…. Hamilton: You can go read it yourself. 🔥🔥🔥
2K
11K
52K