Media Coverage

Key takeaways from VulnCheck’s analysis in the First Half of 2026 include: In the first half of 2026, 23.43% of KEVs showed evidence of exploitation on or before the day the CVE was published. A slight drop percentage wise from the 28.93% of KEVs we observed in 2025. At the same time, vulnerabilities appear to be being exploited faster, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026. Exploitation activity early in the CVE lifecycle remained steady, with roughly 200 CVEs becoming exploited within 31 days in the first half of 2026. Early exploitation activity has not scaled at the same pace as CVE issuance. Content management systems remained the most targeted technology category, accounting for one-third of all KEVs, a more significant percentage of KEVs than we’ve seen historically.

During the first half of 2026, 79 unique sources were the first to report exploitation. The top six sources first to report include Patchstack (70 KEVs), CrowdSec (64 KEVs), ShadowServer (57 KEVs), VulnCheck (37 KEVs), Wordfence (20 KEVs), and CISA (19 KEVs).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. These security flaws (tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) affect all supported self-hosted SharePoint Server versions, including SharePoint Server Subscription Edition. Internet security watchdog group Shadowserver currently tracks nearly 10,000 Internet-exposed Microsoft SharePoint servers, with over 800 of them unpatched against the CVE-2026-32201 and CVE-2026-45659 vulnerabilities.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch an actively exploited maximum-severity flaw in the Adobe ColdFusion commercial web app development platform by Friday. The vulnerability (CVE-2026-48282) affects ColdFusion versions 2025.9, 2023.20, and earlier, and can be exploited by remote threat actors without privileges in low-complexity attacks to gain code execution on unpatched systems. Internet security watchdog group Shadowserver currently tracks nearly 800 Adobe ColdFusion instances exposed online, but there is no information on how many are honeypots or have been secured against attacks targeting the CVE-2026-48282 flaw.

The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.

Earlier today, NetNut’s homepage was replaced with a seizure notice from the FBI and the Internal Revenue Service Criminal Investigation division. The seizure notice thanked Google, Lumen, Shadowserver and other industry partners for their help in dismantling hundreds of domains tied to the Popa botnet, which experts say has long been synonymous with NetNut’s residential proxy infrastructure. In a blog post published today, the Google Threat Intelligence Group (GTIG) said NetNut’s proxy network is widely resold and white-labeled by a number of third-party proxy providers, and that its services are heavily sought out by cybercriminals seeking to obfuscate the source of their malicious traffic.

A critical unauthenticated vulnerability in Oracle E-Business Suite is now being actively exploited in the wild, with honeypot telemetry confirming real-world attack attempts over the weekend of June 27–28, 2026. The Flaw CVE-2026-46817 is a maximum-severity flaw residing in the File Transmission component of Oracle Payments, a core module within Oracle E-Business Suite (EBS). Honeypot data from the Shadowserver Foundation spanning May 30 to June 28, 2026, shows attack traffic distributed globally, with North America (193), Asia (181), Europe (53), South America (18), Africa (9), and Oceania (2) all registering hits on the final observation date.

Europol together with partners from across the globe today announces a landmark blow to cybercriminal networks as part of Operation Endgame, a sweeping international operation targeting the criminal infrastructure behind ransomware and malware like SocGholish, Amadey, and StealC. In coordinated actions over the past two weeks, key components of these malicious toolkits were dismantled as part of a public-private effort. The main common goal was to disrupt the “assembly lines” cybercriminals use to launch ransomware, financial fraud, and attacks on critical infrastructure. Crypto assets of criminal origin currently valued at over EUR 41 million (USD 47 million) were identified, flagged, and thereby restricted from use. Moreover, as many as 27 million stolen login credentials have been recovered as part of this operation.

Participating countries and agencies in the action week against the three botnets: Canada: Royal Canadian Mounted Police (RCMP), Denmark: Danish Police (Politi), Germany: Federal Criminal Police Office (BKA), Netherlands: National High Tech Crime Unit (NHCTU), United Kingdom: National Crime Agency (NCA), United States, Europol and Eurojust.

Private Partners: Microsoft, the Shadowserver Foundation, Registrar of Last Resort (RoLR), Proofpoint, IBM X-Force, Infoblox, NorthWave, Orange Cyberdefense, Bitdefender, Have I Been Pwned (HIBP), Spamhaus.

In Operation Endgame, a major operation this week disrupted a key infection chain used by cybercriminals. Within an international cooperation, 14,971 websites infected with SocGholish malware were remediated. This malware is used by a criminal group that plays a pivotal role in international cybercrime, namely: Evil Corp. SocGholish exploits hacked legitimate WordPress sites to spread malware to visitors, with the aim of gaining unauthorized access to their computer systems. WordPress is the world’s most widely used platform for building websites.

In the past few days, the Netherlands (NHCTU), Canada (RCMP), the United States (FBI) and Germany (BKA), with support from Europol and Eurojust, delivered a major blow to SocGholish’s criminal infrastructure during a joint action week. Victim notification for owners of WordPress sites whose leaked login credentials were identified by the police, via HaveIBeenPwned, DIVD, Spamhaus, CheckjeHack, NoMoreLeaks, The Shadowserver Foundation and NCSC (Netherlands).

Attackers have begun backdooring internet-exposed Ivanti Sentry appliances, the nonprofit security watchdog Shadowserver confirmed on June 11, 2026 — less than 48 hours after patches and a public proof-of-concept exploit script became available. The Ivanti Sentry vulnerability tracked as CVE-2026-10520 carries the maximum CVSS score of 10.0 and gives any unauthenticated, internet-connected attacker the ability to execute arbitrary operating system commands as root on the appliance — no credentials, no prior foothold required.

Shadowserver reported seeing 19 vulnerable instances in its scans, with at least two already backdoored following a tip from Saudi Arabia’s National Cybersecurity Authority. The organization cautioned that the true number of affected appliances is likely higher, as many Sentry deployments block internet scanning tools by default.

Over 900 automatic tank gauge (ATG) systems across the United States, used to monitor fuel and chemical storage tanks across various critical infrastructure sectors, have been found exposed online and are vulnerable to ongoing attacks. In light of CISA’s advisory, Internet security watchdog Shadowserver warned today that over 1,000 ATG systems were exposed online, with the vast majority (909 devices) in the United States.

Non-profit cybersecurity organisations are a foundational part of the global cyber ecosystem, yet their role remains systematically under-recognised and underfunded. This new HCSS report argues that these organisations provide essential public-interest security functions that governments and commercial providers cannot fully deliver on their own.

The report by Hans Horan, Ron Stoop and Jan Feldhusen finds that non-profit cybersecurity actors play a critical role in threat intelligence sharing, incident response coordination, standards development, capacity-building, and support for vulnerable communities. Their work helps reduce harm, strengthen cyber resilience, and sustain the shared infrastructure and protocols underpinning the global digital economy. The report warns that continued underfunding risks weakening critical cyber resilience functions worldwide. It recommends that governments establish dedicated multi-year funding streams, formally integrate non-profit actors into national cybersecurity strategies, and create rapid-response funding mechanisms for major cyber crises. It also calls on industry to adopt standing norms for financially supporting the sector.

Threat intelligence services can also generate substantial value. The most notable example would be Shadowserver, a non-profit that scans the global internet for vulnerabilities, malware, and active threats, and alerts affected organisations and governments. Single organisations such as ShadowServer and CIS account for market-equivalent values of USD 830M–980M and USD 354M, respectively. Shadowserver delivers this at an operating cost of USD 5.5 to 6 million per year: a leverage ratio of approximately 170 to 200 USD of economic value per dollar spent.