New research from @thehappydinoa.dev identifies a threat actor running 100+ DarkSword panels. Censys ARC has now observed at least 7 (likely 8) unrelated crews using the leaked iOS exploit chain. https://bit.ly/4fMX71w #CensysARC

DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster - Censys

Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.

bit.ly

Censys IOC Investigator is our AI-powered threat investigation feature. Open beta launches August 10. Built on how Censys ARC researchers actually work: parallel pivots, evidence-backed findings, deterministic pipeline. https://bit.ly/4xk5etH

Introducing Censys IOC Investigator: Run Every Lead Like You've Got Hours - Censys

Learn about Censys' new IOC Investigator: an AI-powered threat investigation feature that automates pivoting, infrastructure mapping, and host profiling.

bit.ly

🚨A critical JetBrains TeamCity vulnerability CVE-2026-63077 could allow unauthenticated RCE on Internet-facing servers. Censys sees ~4,500 TeamCity web properties. ▪️No active exploitation has been reported by JetBrains. ▪️Patches are available https://bit.ly/45DhGIQ

Censys ARC researchers found that AI/LLM tool exposures increased 60% in the past 9 months. This is just one early finding from the upcoming 2026 State of the Internet Report. The full report is available this fall. Pre-register to get it as soon as it publishes. https://bit.ly/44JNRGq #CensysARC

Real-time Internet intelligence. No more stitching together feeds. No more manual investigations. No more inconsistent outcomes.

Early findings from the 2026 Censys State of the Internet Report show AI/LLM exposures have increased over 60% in the past nine months. AI is compressing the window between vulnerability and exploit. Patching faster won't save you. Our CEO wrote a full breakdown:

Every year, Censys scans the Internet and publishes what we find. This year's State of the Internet Report is almost here. The full report drops this fall. https://bit.ly/44JNRGq

Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) 📖 Read more: www.helpnetsecurity.com/2026/07/22/s... #PoC #SharePoint #vulnerability #vulnerabilitymanagement #cybersecurity #cybersecuritynews @censys.bsky.social

Another SharePoint RCE exploited: Patch, then rotate your machine keys (CVE-2026-50522) - Help Net Security

Attackers are exploiting an unauthenticated SharePoint RCE vulnerability (CVE-2026-50522) to extract the servers' IIS machine keys.

helpnetsecurity.com

DNS intelligence in the Censys Internet Map, in motion. Pivot from a domain to the infrastructure behind it, no separate tools, no lost context. https://bit.ly/4gBsaPU

Happy #WorldEmojiDay to everyone who's lived this sequence more times than they'd like: 🚨 something's on fire, allegedly 🔍 turns out it's been exposed for months 🧩 different tools, different answers 🚩 there it is 😴 waiting on the scan to finish ✅ closed, for now What's missing from ours?

Following a new Dutch intelligence advisory, Censys ARC Principal Security Researcher Martijn Grooten analyzed Internet-connected camera exposure across Europe. Censys sees: 🔻Nearly 2K with known exploited vulns 🔻87K+ across Europe & Ukraine Read more: https://bit.ly/3T77aqu #CensysARC

A suspicious domain rarely tells the whole story. With Censys Active DNS, you can see if it is still live, what infrastructure is behind it, what has resolved there, and what should be blocked, investigated, or monitored. DNS connected to what is running on the Internet. https://bit.ly/3TtYudK

The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data - Censys

Executive Summary It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful ...

bit.ly

Missed Episode 3 of Censys ARC Flash? In this session, Silas Cutler and Aidan Holland of Censys ARC discussed: ☑️ AsnchRAT ☑️ FortiBleed Watch the full recording and explore the research: https://bit.ly/4pcoF4y #CensysARC

The trusted Internet intelligence behind the Censys Internet Map now includes DNS. As attacks get more automated, defenders need visibility into the infrastructure behind threats, not just the indicators. Read the full release here: https://bit.ly/4vZlgcc

New research from Censys found children aren't just being targeted by phishing sites, they're being funneled into an entire ecosystem built around popular games like Roblox & Minecraft. Read Alex Gartner's full research: https://bit.ly/4bbpy7I

We're live tomorrow at 11 AM ET. Join the latest Censys ARC Flash to hear about new research, observations, and emerging threats. Don't miss the live Q&A! Register: https://bit.ly/4uEpjd2 #CensysARC

In this clip from the Censys ARC Flash, Silas Cutler and Michael Schwartz discuss what we're seeing across the Internet and why it matters. Join us live on July 8 for the next episode and Q&A. Register: https://bit.ly/4uEpjd2 #CensysARC

Your vendor's detections aren't built for your organization. Durable detections start with Internet context, not just endpoint telemetry. Censys published a detection engineering guide: https://bit.ly/4fe0QFd

New research from Censys Senior Security Researcher Aidan Holland maps the AsyncRAT family across ~40 variants. The detection signal is its inherited TLS certificate metadata that persists across forks. Read more: https://bit.ly/4eQP03m

A phishing email targeting a politician led to a much bigger discovery. New research from Censys ARC researcher shows how Censys pivots uncovered additional UNC1151 infrastructure, exposing a broader credential theft campaign targeting Belarus and Ukraine. Read more: https://bit.ly/4vqNsEm

Censys Internet intelligence is now embedded directly in Swimlane Turbine. External exposure context, asset data, and certificate intelligence are part of every enrichment, investigation, and response workflow automatically. Smarter automation starts with better context. https://bit.ly/4ak6801

Swimlane - Censys

Use Swimlane with Censys ASM to move validated exposure findings into orchestration and response workflows.

bit.ly

🚨 CVE-2026-48908 (CVSS 10.0) A critical flaw in Joomla's SP Page Builder can enable unauthenticated file upload & potential RCE: ▪️Versions 1.0.0–6.6.1 affected ▪️Active exploitation reported ▪️Patched in 6.6.2 Censys observed 194,793 web properties loading the component. https://bit.ly/43Y8ONk

Missed Episode 2 of Censys ARC Flash? Watch on-demand and register for Episode 3, streaming live on July 8. https://bit.ly/4xxoIf8 #CensysARC

Censys has expanded into Security Operations. Real-time Internet intelligence, now operationalized across security workflows, alert triage, investigations, threat hunting, at scale. Powered by the Censys Enrichment API and the industry's most comprehensive Internet Map. https://bit.ly/4vk3nUQ

New research from #CensysARC Senior Security Researcher Aidan Holland, who identified 236 exposed open-source C2 framework AdaptixC2 hosts. More: https://bit.ly/4ozkUWF

CISA's new BOD 26-04 prioritizes remediation based on risk, starting with a key question: Is the asset publicly exposed? You can't protect what you don’t see. Censys helps identify Internet-exposed assets. https://bit.ly/4xzngZB

Censys & Google SecOps work together to bring real-time Internet intelligence directly into investigations, threat hunts, detections, and response workflows to understand the infrastructure. Read the blog for 5 use cases on how security teams are using our integration: https://bit.ly/4uDdiE0

Missed Episode 2 of Censys ARC Flash? Silas Cutler and Michael Schwartz covered: ☑️ Exposed ATG infrastructure ☑️ cPanel/WHM exploitation ☑️ MCP services & AI tooling Watch the full recording and explore the research: https://bit.ly/4xxoIf8 #CensysARC

Censys ARC researcher Andrew Northern unrolled an entire operation: hundreds of throwaway lookalike domains, a real-time card-skimming kit that serves a USPS themed website as bait, and a second campaign wearing a UPS costume over the exact same machinery. https://bit.ly/4uGfIBI

Without external context, you don’t have the full picture.