Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
2026-07-03T01:24:07Z•9c22bcb619b7fbde3208705d4aecefa7e983be9308ca2bf09ff5baef1b0ec2a5
AI-misuseCISA-KEVOAuth-abuseactive-exploitationbotnetcredential-theftmalwarepassword-sprayphishingransomwareremote-code-executionresidential-proxysupply-chainunpatched-flawvulnerability-disclosure
What happened
A large set of active threats and high-severity vulnerabilities were reported: Google, with partners, disrupted the NetNut/Popa residential-proxy network that abused millions of home devices; multiple ransomware operations are exploiting Citrix Bleed 2 (CVE-2025-5777) and using stolen credentials (FortiBleed) and BYOVD/supply-chain access for follow-on intrusions. CISA added SharePoint RCE CVE-2026-45659 (CVSS 8.8) to its KEV list amid evidence of active exploitation. Other notable issues include two critical Cursor sandbox-escape flaws (CVE-2026-50548, CVE-2026-50549), Progress Kemp LoadMaste
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 9c22bcb619b7fbde3208705d4aecefa7e983be9308ca2bf09ff5baef1b0ec2a5
- Enrichment time
- 2026-07-03T01:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.