[ubiquiti]

October 16, 2026

• Compromised D-Link and Ubiquiti devices are being resold as residential proxy capacity. The proxyjacking campaign spans devices in 34 countries, turning victim connections into egress for a commercial proxy network and helping downstream abuse blend into residential traffic. GreyNoise details the infrastructure and detection opportunities. · Threat Activity & Espionage

in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware

September 11, 2026

• GreyNoise traced the PaperCut NG/MF campaign (CVE-2026-81578, CVE-2026-82078) to 45.142.193.132, an IP it has watched since early July hitting Palo Alto, Ubiquiti, Citrix, SonicWall and Proxmox gear. Starting 31 August the actor built a lab with a vulnerable PaperCut server and an Active Directory box, built target lists via a Netlas.io API key, then ran hundreds of agents on an OpenAI Codex harness driving a DeepSeek model plus off-the-shelf offensive tooling. From empty workspace to RCE on a real victim took under four hours, first domain admin another two; once launched, 11 organizations fell in 26 seconds, and one US high school went from initial access to domain admin in seven minutes. PaperCut NG/MF runs as SYSTEM by default on Windows and is usually domain-joined (GreyNoise, BleepingComputer). Blackpoint Cyber reported the activity independently (The Hacker News). Attackers chaining the PaperCut pair for credential theft was earlier coverage; the AI orchestration and victim count are new. · Offensive AI in the Wild

in Four Hours to First Victim: AI Agents Ran a Global PaperCut Campaign

July 10, 2026

• Ubiquiti shipped fixes across UniFi Connect, Talk, Access, Protect, and OS, including CVE-2026-50746 (CVSS 10.0) improper access control in UniFi Connect enabling command execution. The Hacker News · Vulnerabilities & Exploits

in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0

July 9, 2026

• Ubiquiti shipped patches for seven critical flaws across UniFi Connect, Talk, Access, Protect, and OS, including a CVSS 10.0 access-control bug (CVE-2026-50746) and command-injection issues; no exploitation reported yet. BleepingComputer, NCSC-NL · Vulnerabilities & Exploits

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

June 26, 2026

• CISA warns critical Ubiquiti UniFi OS flaws (CVE-2026-34908/-34909/-34910) are being exploited to create rogue admin accounts; patch unpatched controllers. SecurityWeek · Vulnerabilities & Exploits

in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine

June 25, 2026

• CISA flagged active exploitation of max-severity flaws in Ubiquiti UniFi OS and Lantronix EDS5000 serial-to-ethernet servers. The Lantronix bug, CVE-2025-67038 (CVSS 9.8), is a code-injection flaw FCEB agencies were ordered to patch by June 26. BleepingComputer (Ubiquiti), The Hacker News (Lantronix) · Vulnerabilities & Exploits

in Cisco SD-WAN Manager Zero-Day Gives Root via a Malicious CSV as Operation Endgame Smashes Amadey and StealC