Skip to content
The wire07:57:59 UTC
No. 1,107
skopnixLast 24 h · 8 dispatches

Stack check · free · no signup

CISA KEV · NVD ranges · FIRST EPSS · actors cited with source

Paste what you run. See what is being exploited right now, by whom — with the report that proves it.

Also accepted per line: a purl (pkg:maven/…) or a CPE 2.3 name. Up to 500 components. SBOM upload on /stack.

Example · a real result

as of

pasted: Microsoft Office and WordPad

CVE-2017-0199KEV · 3 Nov 2021ransomware useEPSS 99%
Cited as exploited by
MuddyWater
“Clearsky has detected new and advanced attack vector used by MuddyWater to target governmental entities and the telecommunication sector. Notably, the TTP includes decoy documents exploiting CVE-2017-0199 as the first stage of the attack.”

clearskysec.com ↗ · read 17 Oct 2026

No key. curl it.

curl -s https://skopnix.com/api/v1/stack -H 'content-type: application/json' -d '{"components":[{"vendor":"fortinet","name":"fortios","version":"7.0.1"}]}'

JSON back · 500 components a call · 10 checks a minute per IP · API docs

Pipeline: 22 sources delivered in the last 24 h · 502 cited CVE–actor pairs · as of

Filed 18:11 UTC· · CVE-2026-102764· vulnerabilityActively exploited

CISA adds CVE‑2026‑102764 (BeyondTrust Remote Support) to the Known Exploited Vulnerabilities catalog

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. …

Source CISA ↗EPSS 0.6%KEV added 16 OctDue 19 Oct

The wire

--:-- UTC
  1. MALWOne extra letter and Linux is compromised. Hackers replaced popular utilities
  2. APTNorth Korean IT Workers Used Stolen US Identities to Earn $3 Million
  3. VULNDrupal patches critical RCE flaws, warns exploits may emerge soon
  4. SUPLMALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
  5. BRCHHackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
  6. VULNBeyondTrust CVE-2026-102764 actively exploited—patch now • BlockStrap RCE on Magento/Commerce (08936e4)
  7. EXPLDaily IT Security Digest — 2026-10-17 An authenticated remote code execution vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0322) is being exploited in the wild. The attack
  8. 1 more in the archive →
  9. VULNGHSA-pw5q-rjx4-7f7p: Arcane: Delegated users:update permission allows admin account takeover via password reset
  10. EXPLCritical BlockStrap flaw lets hackers run code on Magento servers
  11. VULNGHSA-h4mw-j7qp-8mwm: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Open the archive →1,107 dispatches · times UTC
as of
Dispatches · 7 days
32
KEV · actively exploited
11
With CVE ids
23
Sources reporting
9

Counted over the same published-story gate the pipeline uses before a dispatch reaches Telegram. Refreshed hourly. The bars are the last fourteen days, a day each. as of

11–15 Oct reads zero: our ingestion outage, not a quiet wire.

Regional desk: Azerbaijan.

as of
Claims · 7 days
21

Hacktivist and leak-site claims against Azerbaijan, each checked from our side. A claim is what someone posted, not a confirmed incident.

The Azerbaijan board →Claims vs reality →

Newest claims · claimant, target, our check

  1. 313 Team (Islamic Cyber Resistance in Iraq) claims ddos on azerbaijani government servers17.10 15:20 UTCour check: not checked · 2 claims
  2. 313 Team (Islamic Cyber Resistance in Iraq) claims ddos on 100+ azerbaijani government websites17.10 15:20 UTCour check: not checked · 2 claims
  3. 𝘾𝙮𝙗𝙚𝙧 𝙎𝙦𝙪𝙖𝙙 ⁨³¹³ claims ddos on express bank of azerbaijan17.10 01:40 UTCour check: not checked
  4. 𝘾𝙮𝙗𝙚𝙧 𝙎𝙦𝙪𝙖𝙙 ⁨³¹³ claims ddos on azerbaijan democratic party website17.10 01:40 UTCour check: not checked

The world's threat reporting, read for you, filed where you can find it.

The wire

Every report that matters, read within hours of the source and filed in one line. Actively exploited vulnerabilities are stamped, not buried, and every row links to the outlet that broke it.

9 sources reporting this week

The archive

Every dispatch ever published, newest first, each one grounded to the outlet that broke it and to the others that carried it. The edition number on the masthead is the count of this ledger.

1,107 dispatches · since July 2026

The feed

The same wire as JSON Feed, RSS and a keyless API, with a STIX bundle for every adversary. Point a reader, a SIEM or an agent at it; nothing here needs an account.

curl -s skopnix.com/feed.json | jq -r '.items[0].title'
CISA adds CVE-2026-102764 (BeyondTrust Remote Support) to the Known Exploited Vulnerabilities catalog
as of

Exposure census

What is open on the internet right now · measured worldwide 2026-10-05 · vs 2026-09-28

Internet-exposed hosts per product, worldwide, with the change since the previous sweep, on a log scale
ProductExposedWk Δ
SonicWall SSL-VPNAkira's routine way in. Repeatedly on CISA KEV.426,784down 2,281 (0.5%)
FortiGate SSL-VPNFortiOS SSL-VPN. Persistent KEV entries, ransomware entry point.335,247up 3,681 (1.1%)
RDP, exposed to the internetA desktop answering the open internet. Still the oldest way in.323,005up 1,428 (0.4%)
MikroTik RouterOSRouter fleets, widely conscripted into proxy and DDoS infrastructure.190,201down 5,023 (2.6%)
Microsoft ExchangeOn-premise mail. Years of KEV entries and no shortage of targets.117,004down 705 (0.6%)
Palo Alto GlobalProtectEdge VPN portal. A 2024 KEV zero-day is still being found unpatched.95,846down 34,618 (26.5%)
Outlook Web (OWA)The login page in front of that mail.64,253up 592 (0.9%)
Zimbra MailRepeatedly exploited in the wild against government mail.39,890down 1,053 (2.6%)
VMware ESXiHypervisors. One host, every VM on it.3,779down 58 (1.5%)

A scan count, not an inventory. This is how many hosts answered a probe from the public internet on the date shown: not how many are unpatched, not how many are vulnerable, and not how many are real (some are honeypots). It is a floor on the attack surface, and it is the number that moves when a vendor ships a patch nobody applies.

Adversaries.

dossiers
1,399
state-sponsored
90
crime crews
374
with ATT&CK data
162
named on the wire, 90 days
26

Roster refreshed 2026-10-06 · as of

Every field is what a source states: MISP galaxy, MITRE ATT&CK, ransomware leak sites, APTnotes. Assessed origin, observed targets, techniques by tactic, with the report that says so.

All 1,399 dossiers →

On the wire · last 90 days

12 adversaries named in our dispatches
  1. Emperador4 dispatches · last

    Crime

    Ransomware: emperador → Electrolux 2...
  2. qilin3 dispatches · last

    Crime

    "Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germany, investigative sources said
  3. Cyber Partisans2 dispatches · last

    assessed origin Belarus

    Belarusian hacktivists admit to 2023 breach of Russian state healthcare network
  4. leakeddata2 dispatches · last

    Crime

    Ransomware: leakeddata → Nelson Mullins Riley & Scarborough
  5. booba team2 dispatches · last

    Crime

    Ransomware: booba team → MorseLife Health System, Inc.
  6. TA4192 dispatches · last
    China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
  7. ShinyHunters2 dispatches · last
    FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day
  8. clop2 dispatches · last

    Crime

    Ransomware: clop → ALDOGROUP.COM(ALDOSHOES.COM)

Earlier edition · Sat 17 Oct 2026

Every edition →
  1. 16:29North Korean IT Workers Used Stolen US Identities to Earn $3 MillionAPT
  2. 14:32Drupal patches critical RCE flaws, warns exploits may emerge soonVULN
  3. 11:11MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native AddonSUPL
  4. 06:16Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 TenantsBRCH
  5. 06:01BeyondTrust CVE-2026-102764 actively exploited—patch now • BlockStrap RCE on Magento/Commerce (08936e4)VULN
  6. 05:02Daily IT Security Digest — 2026-10-17 An authenticated remote code execution vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0322) is being exploited in the wild. The attackEXPL
  7. 03:02Microsoft Patches 1,413 Security Vulnerabilities Microsoft has released security updates addressing a record 1,413 vulnerabilities, including an actively exploited WindowsVULN
  8. 21:15GHSA-pw5q-rjx4-7f7p: Arcane: Delegated users:update permission allows admin account takeover via password resetVULN
as of

Grounded to source. Nothing invented.

Telegram ↗Every dispatch, the moment it is published.t.me/skopnixRSS →For your reader. Add ?kev=1 for only what is actively exploited./rss.xmlJSON Feed →The wire as JSON Feed 1.1, with KEV and CVE ids on every item./feed.jsonSTIX →A STIX 2.1 bundle per adversary dossier, for your tooling./actors/{slug}/stix.json

API docsllms.txtNo key. No account. No tracking.