I work at IPinfo, which runs a weekly scan of the IPv4 Internet. Short version of what we found:

• October 6–7 scan, five days before the attack: 2,528 addresses serving a Danfoss StoreView dashboard in 73 countries and territories. France had 1,331 (53%).
• 85% of the French ones ran software with known flaws, including 527 end-of-life AK-SM 800 units. Only 195 had every fix. Elsewhere it was 84%, so France had more of them online, not worse patching.
• 1,019 of the French addresses were already open on March 30.
• October 14 scan: 316 still online in France (−76%, against a normal 3–7% weekly loss). Fully patched units dropped too (195 → 54), which points to disconnection rather than patching.

Method: the newer UI is matched on page title, the older AK-SM 800 on its web server plus the Flash loader page, and firmware generation comes from the build date the dashboard exposes. Counts are addresses on the ports we scan, so they’re a floor. How the attackers got in is still unknown, and exposure isn’t proof of the entry point.

I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules.

I put up a free public CertStream endpoint for anyone monitoring phishing or lookalike domains

wss://api.certstream.dev/

No API key or signup needed, just connect over WebSocket

Python example: https://certstream.dev/free-certstream-api.html

Open source: https://github.com/reloading01/certstream-server-rust

Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

- Google's own nameserver vouched for Russian IPs as Googlebot.

- One PTR addresses AI agents directly, and it passes forward confirmation.

- The exfil payload dodges filters for spaces, parentheses and quotes, and phones home to an IP written as one decimal number.

Think about what a model does: it answers questions correctly, you trust it, you wire it into things. Now imagine it’s correct about everything except one topic you care about, and it’s wrong about that on purpose. A dosage. A legal fact. A person. A “is this config safe to deploy.” The other 99.9% is pristine, so nobody looks twice.

The attack that does this doesn’t touch disk. The checkpoint hash is identical before and after. No new process, no child, no socket, no extra ioctl or mmap. It arrives through a dependency you already trust and does its work in GPU memory, inside the same process everyone’s fine with. Every control built to watch process behavior sees a model doing model things, because that is literally all that happened on the parts those controls can see.

This is the class of attack your entire stack is blind to, and it’s not theoretical - the delivery mechanism is the same supply-chain path that’s already been used in real PyPI compromises this year. We reproduce it end to end and then show where it does leave a fingerprint, in a place almost nobody is looking.

Write-up with the actual attack and the detection is in the link.

PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response).

Unlike traditional edr bypass techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.