{"uuid": "0b7281b9-d103-4b4c-ad87-5dc755b5164b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-0257", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117248381496856559", "content": "The highest-volume malicious activity GreyNoise observed this week was a request for a file. Environment files, cloud configuration and repository configuration are all returned by a correctly functioning web server to anyone who asks for the right path.\nRented hosts forged the Googlebot identity while requesting environment files and cloud configuration, producing roughly two thirds of all forged search engine crawler traffic observed, and passing unchanged through the relaxed rate limiting many servers grant crawlers by user agent. Separately, adversaries attempted a GlobalProtect authentication bypass, CVE-2026-0257, from 64 exclusively malicious sources on one day against zero or one on every other day of the window. It is CVSS 9.1 and in CISA's Known Exploited Vulnerabilities catalog. Verify crawlers by source address, and alert on first sighting instead of on rate.\nCustomers get the full weekly brief. Our public At The Edge one-pager is attached + \ud83d\udd17 https://www.greynoise.io/resources/at-the-edge-090726", "creation_timestamp": "2026-09-10T19:25:22.113114Z"}