Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Over 1,300 Microsoft SharePoint servers exposed online remain unpatched against a spoofing vulnerability that was exploited as a zero-day. The vulnerability in question, CVE-2026-32201, is a spoofing vulnerability rooted in improper input validation that requires no login, no user interaction, and no special conditions to exploit. The vulnerability allows unauthenticated attackers to influence how content is rendered, making attacker-controlled data appear as legitimate output.

Apache ActiveMQ Classic, widely used as a messaging backbone in enterprise environments, carries a high-severity vulnerability tracked as CVE-2026-34197. What makes this particularly alarming is its roots. The underlying behavior enabling this vulnerability has existed for nearly 13 years, silently present across countless enterprise deployments.

Someone is scanning your LLM infrastructure right now. They are not waiting for you to finish your security review. Between October 2025 and January 2026, GreyNoise’s honeypot infrastructure captured 91,403 attack sessions targeting exposed LLM endpoints. These were two distinct campaigns systematically mapping the expanding attack surface of misconfigured AI deployments. Your team is moving fast on AI. LLM servers are going live, inference APIs are being connected, MCP endpoints are being spun up.