On the only machine where I can still see this, I see a significant increase in bot-scanners - the stupid brute forcers just attempting /wp-admin and such. These are "fail2banned" - an ever growing list of urls and endpoints from software that I know I don't run: anything php, java, etc -, and what I see a (totally not structurally collected, unfortunately) significant increase in these bans.
I've seen this increasing since before the patches were released and PoCs became available and more usable.
My theory is that botnets are cranking up their scanning to have an up-to-date and large list of potential targets once they can reliably use the exploit to take over those targets.
I've seen this increasing since before the patches were released and PoCs became available and more usable.
My theory is that botnets are cranking up their scanning to have an up-to-date and large list of potential targets once they can reliably use the exploit to take over those targets.