The Shadowserver Foundation

@Shadowserver

Our mission is to make the Internet more secure by bringing to light vulnerabilities, malicious activity and emerging threats. Join our Alliance!

Global shadowserver.org/partner Joined March 2009

0 Following 22K Followers 2.4K Posts

Latest posts 5

Pinned post

The Shadowserver Foundation @Shadowserver Dec 13, 2025

Using ELK & interested in automating ingestion of our threat intel for your network/constituency via our API?

We have introduced an ECS logging script for our intelligence reports. This script uses Redis to queue events for Logstash.

Check it out at github.com/The-Shadowserv…

The Shadowserver Foundation @Shadowserver 6d

Shadowserver is honored to be a 2026 @SANSInstitute Difference Makers Awards finalist! If you appreciate our work, please support us with your vote! go.sans.org/Nb9PSd

The Shadowserver Foundation @Shadowserver Nov 1

We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily).

Tree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/com…

The Shadowserver Foundation @Shadowserver Oct 26

PHP Attacks Update: As others, we have been observing a lot of AI slop PHP attempts against our honeypot sensors the last week, but so far no confirmed exploitation.

We have refrained from CVE-2026-109618/619 tagging in scans, due to lack of reliable, safe large scale methods.

The Shadowserver Foundation @Shadowserver Oct 15

Copeland/Dixwell XWEB refrigeration web controller incidents: As in the case of Danfoss, for a long time we have been sharing exposed Copeland XWEB Pro & Evo panels in Device ID reporting. We see around 1200 instances daily - these should of course not be publicly accessible.