Censys (@censysio) header
Censys (@censysio) profile picture

Censys

@censysio

The Intelligence for AI-Powered Security. Real-time defense requires real-time intelligence and visibility.

 Ann Arbor, MI
censys.com
Joined September 2015
  • Tweets2.7K
  • Following1.5K
  • Followers13.1K
1.1KMedia
Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)Photo by Censys (@censysio)
Drawing on more than two years of Internet intelligence, Censys ARC examines what's changing, what's staying the same, and what it means for security teams. From the rapid growth of exposed AI infrastructure to shifting threat actor infrastructure and persistent risks across enterprise software and industrial control systems, the report reveals where the Internet is evolving fastest and where exposures aren't going away. Download the 2026 State of the Internet Report: bit.ly/4imYFSf
Image from Censys (@censysio)
2
380
AI-powered offensive tools are forking and multiplying. Censys ARC is tracking and fingerprinting emerging tools including ARTEX, CyberStrikeAI, Cairn, PentAGI, and more -- plus emerging forks. These fingerprints apply across a comprehensive, current map of the Internet, from hosts and web to certs and Active DNS. Consume the freshest IOCs, or leverage our agents to expand them into the full campaign. See how Censys supports CTI and adversary investigations: censys.com/solutions/adversa…
The image displays a dark-themed interface of Censys, showing a graph with two plotted lines. The y-axis represents "Market Activity," and the x-axis shows dates from May to July. Below the graph are sections labeled "Details" and "Description," containing text. Options to filter and refresh appear in the top right corner.

ALT The image displays a dark-themed interface of Censys, showing a graph with two plotted lines. The y-axis represents "Market Activity," and the x-axis shows dates from May to July. Below the graph are sections labeled "Details" and "Description," containing text. Options to filter and refresh appear in the top right corner.

2
4
38
1,671
"A report published on November 5 by Silas Cutler, principal security researcher at Censys Advanced Research Collective (ARC), has provided further insights into ARTEX's use and the infrastructure surrounding it." - via @InfosecurityMag infosecurity-magazine.com/ne…
ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns

ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns

A new Censys report showed that the use of ARTEX, an AI pentesting tool popular with threat actor, could be spreading far beyond initially reported campaigns

infosecurity-magazine.com
2
1
15
791
ARTEX is making headlines. What does its infrastructure look like? Censys ARC identified 1,465 hosts exposing ARTEX consoles. 155 ARTEX hosts also run at least one other threat that Censys detects. @silascutler breaks down the findings and how defenders can use Censys to hunt for ARTEX: bit.ly/4AfYb6E #CensysARC
ARTEX: Agentic Asbestos - Censys

ARTEX: Agentic Asbestos - Censys

Censys detects 1,465 hosts running exposed instances of ARTEX, an open-source, LLM-driven autonomous pentesting framework that has been linked to malicious activity from multiple threat groups.

censys.com
3
19
1
70
4,861
What are our researchers seeing across the Internet? Join the next Censys ARC Flash on Thursday, Nov. 12 at 11 AM ET to get the latest on recent vulnerabilities, emerging threats, and more. Bring your questions! bit.ly/4u5nzbB #CensysARC
Image from Censys (@censysio)
2
374
Censys ARC continues to monitor Internet-exposed refrigeration controllers following recent attacks in Europe. Our latest SITREP shows a notable decline in exposed Danfoss StoreView and Copeland XWEB systems following the October and November attacks. bit.ly/4ActwH8
The image is a report from Censys ARC, titled: "European Refrigeration Controller Exposure: A Second Attack Wave." It details a cybersecurity incident affecting refrigeration systems in France from October 10-11, with further attacks on November 2, 2026. Entities mentioned include Danfoss StoreView, Copeland/Dixell XWEB, and CERFR-2062-ALE-0123. An executive summary reveals stats on affected controllers and regional analysis. The report is dated November 2026.

ALT The image is a report from Censys ARC, titled: "European Refrigeration Controller Exposure: A Second Attack Wave." It details a cybersecurity incident affecting refrigeration systems in France from October 10-11, with further attacks on November 2, 2026. Entities mentioned include Danfoss StoreView, Copeland/Dixell XWEB, and CERFR-2062-ALE-0123. An executive summary reveals stats on affected controllers and regional analysis. The report is dated November 2026.

4
11
740
Censys ARC researcher Himaja Motheram explains the overlooked risks of Internet-facing AI infrastructure. Read the report: bit.ly/4iuKwCs Join the next Censys ARC Flash on Nov 12 for more research insights and 2027 predictions. info.censys.com/arc-webcast #CensysARC #CensysSOTIR
1
379
Censys researcher Silas Cutler shared findings with The Wall Street Journal, identifying 800+ vulnerable Danfoss systems still exposed to the Internet, including 41 in the U.S. wsj.com/tech/cybersecurity/h…
Hackers Crank the Heat on Europe’s Supermarket Freezers to Above 120 Degrees

Hackers Crank the Heat on Europe’s Supermarket Freezers to Above 120 Degrees

As more everyday items are plugged into the internet, hackers have a vast new menu of targets to choose from.

wsj.com
5
10
923
🌐 What is really exposed on the Internet? Visit @censysio at #BCC26 and discover how Internet intelligence can provide greater visibility into your attack surface and emerging risks. 📍 Hall 2 · Booth 33
Image from Barcelona Cybersecurity Congress (@BcnCyberCon)
1
1
193
Censys ARC tracked enterprise software over 2.5 years and found the oldest versions are the stickiest. What that means for vulnerability response, including PHP2Shell: bit.ly/4jR9a1q Download the 2026 State of the Internet Report: bit.ly/4imYFSf #CensysSOTIR
Image from Censys (@censysio)
3
448
🚨 Rapid Response: Critical Control Web Panel command injection (CVE-2026-77876, CVSS 9.8). Censys identified 443,734 Internet-exposed web properties running CWP. Versions cannot be confirmed, so not all are necessarily vulnerable. Read the advisory for details and queries: bit.ly/4z2loIh
Censys world map with color-coded countries indicating host counts by Censys. Darker shades represent higher counts. The United States and India have the highest hosts, followed by France, Germany, and others. A sidebar lists host totals, with the United States at 30,378 and India at 7,423.

ALT Censys world map with color-coded countries indicating host counts by Censys. Darker shades represent higher counts. The United States and India have the highest hosts, followed by France, Germany, and others. A sidebar lists host totals, with the United States at 30,378 and India at 7,423.

1
6
1
19
3,053
🌐 How is the Internet changing in 2026, and which risks should we be watching? Martijn Grooten from @censysio presents key findings from the 2026 State of the Internet report at #BCC26, exploring AI adoption, emerging vulnerabilities and the evolution of connected services. 📍 Auditorium I Join us!
Image from Barcelona Cybersecurity Congress (@BcnCyberCon)
1
1
185
“The attacks resemble those in France in both timing, targeting, and execution—early morning temperature adjustments meant employees were least likely to be able to immediately respond, and refrigerator temperatures in some stores were reportedly raised to 50 degrees Celsius (122 degrees Fahrenheit),” according to researchers with the Censys ARC research team in a Monday analysis of the attack. via @DecipherSec
Decipher (@DecipherSec) profile pictureDecipher@DecipherSecNov 3
No group has claimed responsibility for the attacks, and authorities have not given any official attribution. decipher.sc/2026/11/02/secon…
Second Wave of Suspected Cyberattacks Hits European Supermarket Freezers

Second Wave of Suspected Cyberattacks Hits European Supermarket Freezers

On November 2, a wave of grocery stores across Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden started to report issues with their in-store refrigeration and freezer units, due to...

decipher.sc
2
7
860
Censys retweeted
Decipher (@DecipherSec) profile picture
Decipher@DecipherSecNov 3
No group has claimed responsibility for the attacks, and authorities have not given any official attribution. decipher.sc/2026/11/02/secon…
Second Wave of Suspected Cyberattacks Hits European Supermarket Freezers

Second Wave of Suspected Cyberattacks Hits European Supermarket Freezers

On November 2, a wave of grocery stores across Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden started to report issues with their in-store refrigeration and freezer units, due to...

decipher.sc
1
2
1
2
992
"Censys has found just over 1,000 Danfoss StoreView interfaces reachable online worldwide. “France continues to lead Danfoss StoreView exposures globally, followed by Belgium and the US,” the internet intelligence firm said." via @SecurityWeek
SecurityWeek (@SecurityWeek) profile pictureSecurityWeek
@SecurityWeekNov 3
Over 100 European Stores Hit as Supermarket Fridge Attacks Return securityweek.com/over-100-eu…
Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Attackers again tampered with internet-exposed refrigeration controllers, this time at stores in Belgium, Sweden, Ireland and beyond.

securityweek.com
2
5
529
A new wave of cyberattacks on supermarket refrigeration systems has hit more European countries. Censys ARC currently observes just over 1,000 Internet-exposed Danfoss StoreView instances globally. bit.ly/4A8vyrN #CensysARC
European Refrigerator Controller Redux: A new wave of refrigeration attacks - Censys

European Refrigerator Controller Redux: A new wave of refrigeration attacks - Censys

Executive Summary Introduction In the early hours of Monday, November 2, stores in at least seven major supermarket chains, butchers, and small grocers across Europe suffered cyber attacks targeting...

censys.com
2
8
14
1,485
Curious what real-time Internet intelligence can show you? Every registered Censys user now gets 5 free searches a day. No credits, no subscription required. Try a Censys Starter Subscription: censys.com/blog/introducing-…
Image from Censys (@censysio)
1
1
517
🚨 Rapid Response: A critical Gravity Forms vulnerability (CVE-2026-103039, CVSS 9.8) could lead to remote code execution under specific conditions. Censys identified 83,800 web properties running Gravity Forms. Read the full advisory for additional details and queries:bit.ly/4zmbKBB
A Censys world map on a dashboard displaying "Countries by Host Count" using varying shades of orange and grey. The United States has the highest count with 667 hosts, highlighted in a dark orange. Other countries with notable host counts include Australia, Canada, Germany, United Kingdom, France, Singapore, Ireland, and Netherlands. The sidebar on the right lists the countries with their respective host counts. The map and list are part of a Censys interface.

ALT A Censys world map on a dashboard displaying "Countries by Host Count" using varying shades of orange and grey. The United States has the highest count with 667 hosts, highlighted in a dark orange. Other countries with notable host counts include Australia, Canada, Germany, United Kingdom, France, Singapore, Ireland, and Netherlands. The sidebar on the right lists the countries with their respective host counts. The map and list are part of a Censys interface.

7
641
🚨 Rapid Response: Seven vulnerabilities in Progress WS_FTP Server, including a critical authentication bypass (CVE-2026-84295, CVSS 10.0), could expose administrative credentials and allow further server compromise. Censys ARC identified ~2,500 Internet-exposed WS_FTP Server hosts. Read the full advisory for additional details and queries: censys.com/advisory/cve-2026… #CensysARC
Censys world map showing host counts by country. The United States has 1,503 hosts, followed by Germany with 159 hosts, and Canada with 106 hosts. Other countries include United Kingdom, Italy, Netherlands, India, France, and China. A key indicates varying densities of hosts. Censys logo is displayed.

ALT Censys world map showing host counts by country. The United States has 1,503 hosts, followed by Germany with 159 hosts, and Canada with 106 hosts. Other countries include United Kingdom, Italy, Netherlands, India, France, and China. A key indicates varying densities of hosts. Censys logo is displayed.

1
2
16
1,554
In this clip from our latest podcast @silascutler of @censysio talks about what #php2shell attacks exploiting newly disclosed flaws might look like from the targeted organization’s POV. #mustwatch. Check out the full interview here: securityledger.com/2026/10/s…
1
2
3
361
Industrial control systems exposure isn't improving. Censys ARC found a 4% increase globally over 2 1/2 years, with the U.S. accounting for 32% of exposures. Censys Principal Security Researcher Emily Austin explains the findings. Download the report: bit.ly/4iuKwCs #CensysARC #CensysSOTIR
2
5
469
Load more