Linux CVEs under active exploitation, measured on real servers

10 CVEs measured under active exploitation

How these numbers are measured

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. A CVE only appears on this page once the same signature has matched across several independent servers, from several distinct networks, with most of the traffic coming from something other than a known scanner. Those thresholds exist to keep a single noisy source, or one security scan, from looking like a campaign.

Confirmed is the stricter claim, and it needs a larger share of the fleet, more distinct sources and high-confidence signatures before it is applied. No NVD advisory means the CVE had no published NVD advisory at the time the exploitation was recorded. It describes the state of the advisory record on that date, and nothing about who observed the exploitation first.

Counts are of distinct servers and distinct source addresses, never of requests. Request volume is a poor measure of how widespread an attack is: a handful of sources hammering one target produces a large number and tells you very little. These servers are real production hosts running real applications, which is what separates this from a honeypot network — every figure describes exploitation attempted against software somebody actually depends on.

The research page sets out the full method behind these figures — how the populations are defined and counted, what the agent can and cannot see, and fleet-wide attack volume with a machine-readable export. If you are about to cite anything from this page, read that one first.