Blog · 2026-07-08

Weekly threat report: June 29 to July 5, 2026

CVE-2026-34197 (KEV) probed by 421 IPs; port 33 lit up with 179,369 events. Most-hit ports, exploit paths to grep your logs for, and delivered malware. 2,710,022 events from 25,986 IPs, June 29 to July 5, 2026.

Sensors recorded 2,710,022 events from 25,986 unique IPs in the week of June 29 to July 5, 2026, up 17% on the week before. Below: what changed, and what to check your own perimeter and logs for.

What changed

• Port 33 logged 179,369 events after a quiet prior week (16 events).
• Port 39131 logged 80,452 events after a quiet prior week (9 events).
• Port 8190 went from 823 to 121,950 events (148x).
• AS61675 (GRANDE REDE TELECOM EIRELLE) was near-silent the week before, then sent 179,313 events from a single IP.

KEV and recent CVEs in probe traffic

Known-exploited (KEV) and recent CVEs whose exploit patterns showed up in this week's traffic, with how many distinct IPs probed for each. NEW means not seen the week before. The IP counts link to the live matching events.

Paths to grep for

The most broadly probed URL paths of the week, ranked by how many distinct IPs requested them. If any of these return a 200 in your access logs, look closer.

Most-hit ports

Change labels are against the prior week. Pivot into any port's live events: 9443, 443, 33, 8240, 8190.

Malware delivered

Payloads captured by the sensors and identified on VirusTotal. One representative hash per family.

The IPs behind everything above are in the feeds, updated continuously. Pivot on any number at the lookup page, or wire the data into an agent over MCP. This report is generated from sensor data every Monday; subscribe below to get it by email.