Security Vulnerability
3 novembre 2026
European supermarket freezers hit by new suspected cyberattacks
Supermarkets across Europe are reporting refrigeration system disruptions, with stores in Sweden, Belgium, (…)
Voir →Here’s your Monday report on immediate and emerging threats. Powered by the power of the crowd. Here’s a snippet of your Monday report on immediate and emerging threats. Powered by the CrowdSec Network.
The CrowdSec Network has detected a wave of exploitation attempts targeting (unfixed) CVE-2025-56520, a Server-Side Request Forgery (SSRF) vulnerability in Dify, a popular open source LLM app development platform.
Ironically, the vulnerability disclosure itself reflects the modern AI era: reported by a researcher, the issue was managed and ultimately closed as "stale" by an AI bot, despite confirmation that the exploit was still active. It seems that while "vibe coding" can accelerate development, it hasn’t quite mastered the art of fixing the security holes it helps create.
Key findings
Recent Surge: While CVE-2025-56520 was published in September 2025, CrowdSec started observing targeted exploitation attempts immediately after releasing specific detection rules on February 11, 2026.
Reconnaissance Focus: The attacks are primarily focused on reconnaissance, with threat actors using the SSRF vulnerability to map internal networks and identify viable targets for further exploitation.
Escalating Interest: Despite a relatively low volume of distinct attacking IPs, the intensity of the attacks is surging well above historical norms for similar vulnerabilities.
