Of Flaws And Injections

THE WILD SIGNALS / EDITION 010

Injection attempts rose against falling web traffic, and flaws as old as 2000 climbed the exploitation forecasts.

SECTION 01

What the signals mean

Events recorded on the Venus decoys rose 8.7% this week, to 941,813 from 866,411, while distinct sources fell 6.3%, to 6,431 from 6,860. Web traffic fell 26.7%, to 38,872 events from 53,049, and the requests behind last week’s surge fell with it. Campaigns, the groups of related sessions the decoys link together, rose fivefold: 980 were active, against 184 in Edition 009.

Site backups replaced state files

Requests for Terraform state, the record of every server and password a cloud build created, fell to 67 from 96. Generic archive names gained instead: backup.tar.gz rose to 70 from 39, backup.zip to 67 from 40 and site.zip to 64 from 38. The environment file /.env drew 643 requests against 730, and directory traversal, which steps outside a website’s public folder to read files behind it, halved to 882 from 1,773.

Injection attempts rose from small bases

PHP remote include requests rose 53.0%, to 254 from 166, from 29 sources, and almost all the sessions behind them were automated. The technique pairs two PHP settings to make a server fetch and run code from a remote address. SQL injection, which feeds a database a crafted query to read or change what it holds, returned after a week with none: 12 requests from a single source on 3 October, all aimed at one application path.

Flaws from 2012 to 2021 still draw the requests

The Apache traversal flaw from 2021 drew 6,414 requests, the Tomcat CGI flaw from 2019 drew 6,375, and the PHP-CGI flaw from 2012 drew 254. The first two led the vulnerability mapping last edition as well. Windows file sharing, the busiest decoy surface, produced 187,206 probes from 2,536 sources, down 33.7%.

Old flaws climbed the forecasts

Medulus qualified 28 vulnerabilities this week, ten of them published in 2023 or earlier. The oldest is CVE-2000-0979, a password-check flaw in the file sharing of Windows 95, 98 and Me. Its exploitation probability stands at 0.75 and its Metasploit module changed this week. A 2020 Chrome flaw rose to 0.639 from 0.443, and a 2008 Flash flaw to 0.659 from 0.168. These probabilities are EPSS scores, a forecast of exploitation within 30 days.

Six additions to the exploited catalogue

Six vulnerabilities joined the catalogue of flaws confirmed as exploited in the wild. FortiMail’s path traversal flaw lets an unauthenticated attacker write files to the system and was exploited as a zero-day. A Citrix NetScaler denial-of-service flaw, also exploited as a zero-day, was added on 4 October with remediation due 7 October, and researchers are checking whether it allows code execution. It is the third NetScaler flaw added in eight days. The others are an authentication bypass in Cisco Catalyst SD-WAN Manager, two Zammad flaws and an Apple out-of-bounds write.

The fingerprint cluster held under a hundred

The remote desktop tool identified by fingerprint 73ede1f461b6 ran from 85 addresses this week and produced 2,352 sessions, against 90 addresses and 2,297 sessions in Edition 009. After the jump to 408 addresses in Edition 008, the footprint has stayed below a hundred two weeks running.

Returning senders made up 40%

Of 6,431 addresses, 2,540 had been seen before, up from 1,977 last week. First-time senders fell to 3,891 from 4,883.

What to act on

Patch the Citrix, FortiMail and Cisco entries first, since all three are exploited and carry short deadlines. Remove site archives and every environment-file variant, including .env.backup, from any path a web server can reach. Keep Windows file sharing off external networks.

941,813 External events. +8.7% Events, week on week. 6,431 Distinct sources. −6.3% Sources, week on week. 17,396 Sessions, −4.6%.

Against Edition 009’s published figures, events rose from 866,411 to 941,813, sources fell from 6,860 to 6,431 and sessions from 18,230 to 17,396. By surface, Web fell 26.7% to 38,872, Windows rose 12.6% to 856,201 from 760,116, Shell fell 5.8% to 33,309 from 35,370 and Database fell 51.7% to 905 from 1,875. Auth, API, Portal and VPN together reached 12,526 against 16,001, down 21.7%. Active campaigns rose to 980 from 184, up 432.6%, and 263 of them are flagged recurring, against 89 in Edition 009.

Ranked signals

Rank	Signal	Events	Ed. 009	Change	Sources	Score
1	SQL Injection Probing	12	0	new	1	0.4500
2	SSH Invalid-User Enumeration	31,892	34,156	−6.6%	899	0.4373
3	PHP Injection / Remote Include	254	166	+53.0%	29	0.4353
4	SSH Campaign Targeting	3,183	4,544	−30.0%	581	0.4185
5	Sensitive File & Secret Exposure	20,645	27,901	−26.0%	177	0.4118
6	MySQL Credential Attack	656	1,535	−57.3%	89	0.4054
7	Webshell / RCE Script Probing	6,375	6,682	−4.6%	217	0.3651
8	SSH Access Probing	33,309	35,370	−5.8%	1,364	0.3471
9	Directory / Path Traversal	882	1,773	−50.3%	30	0.3152
10	SMB Credential Attack	164,763	265,530	−37.9%	70	0.2908
11	Admin Console Discovery	2,344	2,912	−19.5%	128	0.2540
12	SMB Access Probing	187,206	282,365	−33.7%	2,536	0.2236
13	Automated Scanner / Recon Tooling	976	984	−0.8%	126	0.1849

Change is computed against Edition 009’s published counts.

Remote desktop fingerprint campaigns

Client signature	Sessions	Ed. 009	Change	Sources	Ed. 009	Change
TLS 73ede1f461b6	2,352	2,297	+2.4%	85	90	−5.6%
RDP cookie “hello”	416	441	−5.7%	115	89	+29.2%
TLS 43e25370946f	241	415	−41.9%	91	77	+18.2%

Source counts cannot be added across the three signatures because one address may carry more than one. The “hello” cookie and the second TLS fingerprint each ran from more addresses than last week with fewer sessions per address.

Path families

Family	Events	Ed. 009	Change	Paths	Sources	Most requested
Sensitive File & Secret Exposure	20,645	27,901	−26.0%	1,507	177	/.env (643) · /.env.local (375)
Backup & Archive Download Probing	686	839	−18.2%	95	26	/backup.tar.gz (70) · /backup.zip (67)
Webshell / RCE Script Probing	6,375	6,682	−4.6%	1,441	217	/wp-admin/admin-ajax.php (355) · /index.php (239)
Admin Console Discovery	2,344	2,912	−19.5%	308	128	/wp-admin/admin-ajax.php (355) · /actuator/configprops (110)
Directory / Path Traversal	882	1,773	−50.3%	90	30	/@fs/../.env (39) · /css../.env (23)
SQL Injection Probing	12	0	new	1	1	/book/tickettypeindex.action (12)

Distinct paths fell faster than events: sensitive-file paths to 1,507 from 2,753, admin paths to 308 from 717, traversal paths to 90 from 322 and backup paths to 95 from 179. The wordlists behind the requests shortened. Traversal came from 30 sources, up from 27, and its most frequent path again ended at an environment file through the Vite development server route.

Representative paths

Secrets and configuration	Events	Ed. 009	Backup and archive	Events	Ed. 009
/.env	643	730	/backup.tar.gz	70	39
/.env.local	375	420	/backup.zip	67	40
/.git/config	333	363	/terraform.tfstate	67	96
/.env.development	307	284	/public_html.zip	66	not published
/.env.backup	304	not published	/site.zip	64	38

Generic archive names such as /backup.zip and /site.zip, rose by roughly two thirds each while the family as a whole fell 18.2%. Terraform state requests fell 30.2%. /.env.production, third among environment variants last edition at 325, is no longer among the five most requested.

Behaviour progression

343 sessions carried behaviour from two or more distinct stages, against 403 in Edition 009.

Ordering	Sessions	Ed. 009	Change	Sources	Ed. 009	Busiest source	Evasive
Discovery, then Exploitation	239	303	−21.1%	144	178	21 (8.79%)	2.93%
Exploitation, then Discovery	104	100	+4.0%	97	86	3 (2.88%)	19.42%

The busiest source’s share of the forward ordering rose for the first time in six editions, to 8.79% from 7.26%, after falling from 48.84%, 26.78%, 15.57% and 9.29% in earlier weeks. The reverse ordering grew to 104 sessions from 100, and its evasive share rose to 19.42% from 18.18%. A descending ordering is consistent with one tool issuing credential attempts before enumeration as much as with any escalation.

Vulnerability mapping

Identifier	Description	Hits	Ed. 009	Change	Sources	KEV
CWE-312	Cleartext secrets (.env)	15,448	22,530	−31.4%	109	no
CVE-2021-41773	Apache traversal	6,414	6,702	−4.3%	219	yes
CVE-2019-0232	Tomcat CGI	6,375	6,682	−4.6%	217	no
CWE-527	Exposed Git	1,857	2,580	−28.0%	92	no
CVE-2017-9841	PHPUnit eval-stdin	512	615	−16.7%	21	yes
CVE-2012-1823	PHP-CGI argument injection	254	166	+53.0%	29	yes
CVE-2022-22963	Spring Cloud Function	100	326	−69.3%	21	yes

13 of the mapping’s 17 identifiers were reached, against 14, and 6 of the 13 are on the KEV catalogue. CVE-2022-22965, CVE-2021-42013, CVE-2023-2982, CWE-89, CVE-2017-12629 and CVE-2021-27905 were also reached, at 79, 39, 82, 12, 10 and 10 hits. Log4Shell, reached twice last edition, did not appear. Detection is inference from request path and behavioural tag, never observed exploitation.

Medulus correlation

28 vulnerabilities qualified this period, against 42 in Edition 009, with the actor and advisory association signal still withdrawn. All six KEV additions entered with EPSS below 0.03: FortiMail CVE-2026-104286 (path traversal, arbitrary file write, 1 October, 0.0220), Cisco Catalyst SD-WAN Manager CVE-2026-76504 (authentication bypass through URI encoding, CVSS 9.8, 30 September, 0.0158), Zammad CVE-2026-102489 (session hijack to code execution) and CVE-2026-102490 (local escalation to root), both 2 October, Apple CVE-2026-86950 (out-of-bounds write, 29 September, 0.0124) and Citrix NetScaler CVE-2026-88779 (4 October, 0.0028, due 7 October). Four new public exploit entries appeared: WordPress core CVE-2026-87902, Krayin CRM CVE-2026-100885, InvoicePlane CVE-2026-40297 and SuiteCRM CVE-2026-69137.

Technical checks for the week

• Patch: Citrix NetScaler ADC and Gateway for CVE-2026-88779, fixed in 14.1-73.41 and 13.1-64.28. Due 7 October.
• Patch: FortiMail 7.2 to 8.0, Cisco Catalyst SD-WAN Manager and both Zammad flaws.
• Remove: Generic site archives and every .env variant, including .env.backup, from web-reachable paths.
• Prioritise: TeamCity, PaperCut NG/MF and LiteLLM. Each now has a public Metasploit module.
• Restrict: SMB to internal networks, and retire hosts that still negotiate legacy file sharing.
• Review: WordPress core for CVE-2026-87902. A public exploit entry now exists.

Venus records activity reaching Elytra-operated decoy observation infrastructure. Medulus provides public vulnerability and threat-intelligence context. An observed request establishes an attempt, not a successful compromise. Week-on-week comparisons are drawn from the figures published in Edition 009.