Glenn 📎

Last Notes

2026-05-04 13:01:46 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/516/434/862/139/408/original/1ab6fb4de2aefb9f.mp4

2026-04-27 16:27:09 UTC

Bittersweet yet exciting transition ahead. This week marks my last at GreyNoise.
Lately I've spent a lot of time thinking about what I value most in this field: research and findings grounded in clarity, integrity, actionability, and truth that drives outcomes.
#TheSignalShift

2026-02-05 23:33:49 UTC

RE: https://infosec.exchange/@kev_Stalker/116020576227249969
So, based on my work of digging into the KEV Ransomware flips, the RSS feed will now auto-toot here, if interested. There was a flip Tuesday (before the bot) and another just now.
#threatintel
#note1gla…wvqr

2025-12-10 14:04:29 UTC

☕ & #threatintel: CISA has moved the due date for mitigating CVE-2025-55182 (Meta React Server Components Remote Code Execution Vulnerability) up two weeks. It was initially set for December 26, but it is now due on December 12. IIRC, this is the first time the due date has been modified.
In all honesty, if you haven't already patched this vulnerability, it's likely too late. As a reminder, patching does not boot attackers, so you should check for indicators of compromise.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/695/646/728/738/384/original/751749d4c9f0a9ac.png

2025-07-16 20:17:29 UTC

- reply

soon :tm:

2025-07-16 01:34:04 UTC

- reply

🧐 are you referring to CVE-2025-5777 or did I miss yet another? We hadn’t planned on it but what are you thinking?

2025-07-07 21:56:30 UTC

🥜 & #threatintel - Thanks to Horizon3, we pushed a tag out today for CitrixBleed 2 CVE-2025-5777 and are backfilling. Currently, we see 233 hits starting on July 1 from:
64.176.50[.]109
38.154.237[.]100
102.129.235[.]108
121.237.80[.]241
45.135.232[.]2
Follow along here: https://viz.greynoise.io/tags/citrixbleed-2-cve-2025-5777-attempt?days=10

2025-04-28 22:01:38 UTC

If you attend this at RSA (by choice; excluding journalists) -- don't ever talk to me again.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/417/840/628/115/785/original/79ff5ff2302c4a50.png

2025-04-07 15:26:10 UTC

Hi yes. Help your local cybersecurity researchers. If you blog a thing, please date the blog. kthx.

2025-02-22 15:59:50 UTC

Words have meanings. Words have consequences.
https://apple.news/AcP5I9x7QQ1iUHU_1zTJzOw

2024-10-30 19:29:44 UTC

We, @npub1lmd…m9t8, are seeing a massive uptick in IPs attempting to authenticate via telnet using one of several known backdoor accounts in FiberHome routers.
https://viz.greynoise.io/tags/fiberhome-telnet-backdoor-attempt?days=30
1/2
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/398/027/632/927/559/original/8b99f6d9cd0e7869.png

2024-10-18 21:12:16 UTC

🎃 & #threatintel: We/GreyNoise have observed a significant increase in Fortinet SSL brute force attempts recently. This is the highest level in the past two months and the third highest of 2024.
https://viz.greynoise.io/tags/fortinet-ssl-vpn-bruteforcer?days=10
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/330/483/046/725/506/original/809a4977dafe180a.png