Public Exploit for Critical PHP Flaws Fuels Attempted Mirai-Style Botnet Deployment
Proof-of-concept code is now public for two critical, unauthenticated PHP remote-code-execution flaws dubbed PHP2Shell, and Sophos has observed real-world attempts to use them to deploy a Mirai-derived botnet...
CARBONATO Botnet Embeds an AI Agent in Compromised Docker Hosts
The CARBONATO botnet abuses unauthenticated Docker services, escapes privileged containers and installs an AI agent controlled through Telegram. Separate automated scripts spread across nearby networks while the agent...
FBI Dismantles Chinese State-Sponsored Botnet That Powered a Global Hacking Platform
The FBI and Department of Justice have seized the domains behind QScan and QTRouter, a pair of linked platforms that a Chinese state-sponsored group allegedly used to hijack...
ASUS Rushes Out Router Patch After Discovery of Unauthenticated Remote Command Execution Flaw
ASUS has issued firmware updates for a high-severity vulnerability, tracked as CVE-2026-13385, that could let remote attackers run arbitrary commands on widely deployed router models without authentication. Security...
Inside NadMesh: The Shodan-Powered Botnet Hunting Exposed AI Servers
Researchers at XLab have identified NadMesh, a Go-based botnet that uses Shodan to hunt down exposed AI and MCP infrastructure before hijacking it with more than 20 exploitation...
Google Dismantles NetNut-Linked “Popa” Residential Proxy Botnet That Hijacked 2 Million Home Devices
Google, working with the FBI, Lumen Technologies, and other partners, has taken action against the NetNut residential proxy network - also tracked as "Popa" - estimated to have...
AryStinger Botnet Hijacks 4,300+ Routers to Build Global Covert Attack Proxy Network
Researchers have uncovered AryStinger, a stealthy botnet that has hijacked over 4,300 legacy Linksys and D-Link routers by exploiting decade-old vulnerabilities. Unlike DDoS botnets, AryStinger is purpose-built for...
Void Botnet Routes Commands Through Ethereum Smart Contracts to Evade Law Enforcement Takedowns
A new Rust-based botnet sold on cybercrime forums uses Ethereum smart contracts as its command-and-control channel, making traditional infrastructure takedowns impossible. The Void Botnet supports fourteen payload types...