A continuous reading of the Kurdistan Region's internet.
Every fifteen minutes it reads public data sources and publishes what they show — routing, exposure, and vulnerabilities being exploited. It is run by one person, it is not official, and it receives nothing: no reports, no submissions, no inbox. If you need somebody to respond to an incident, this is not that, and you should call whoever provides your systems.
CVE-2026-20349 affects Secure Firewall ASA and FTD. CISA's remediation deadline was 14 August and has passed. If yours is unpatched, it is overdue.
SKRD-2026-001 — Critical — 2026-08-20
CVE-2026-55040 lets an unauthorised attacker defeat a SharePoint security feature remotely. The CISA deadline is 21 August — tomorrow.
SKRD-2026-002 — Critical — 2026-08-20
CVE-2026-33824 is a double free in Microsoft's Internet Key Exchange Service Extensions that can enable remote code execution. CISA's deadline is 21 August.
SKRD-2026-003 — Critical — 2026-08-20
Our own sweep of RIPEstat routing data found 24 autonomous systems announcing with a single observed BGP neighbour, and two more announcing no address space at all while still registered as routed. Each of them fails completely when one upstream does.
SKRD-2026-004 — High — 2026-08-29
CVE-2026-59310 allows a threat actor with network access to vCenter to execute arbitrary code. If vCenter falls, every virtual machine it manages falls with it.
SKRD-2026-005 — High — 2026-08-20
CVE-2026-8037 lets an unauthenticated attacker run arbitrary commands on the appliance. The CISA deadline was 10 August and has passed.
SKRD-2026-006 — High — 2026-08-20
IODA's fused BGP, active-probing and darknet signal raised twelve alerts for the country in our collection window, one of them critical.
SKRD-2026-007 — High — 2026-08-20
We sweep typosquat and homograph permutations of protected domains against DNS every hour. The list is maintained here and is currently very short, which is the main limit on what this can find.
SKRD-2026-008 — Medium — 2026-08-29
background traffic reaching a darknet telescope dropped to critical: 6 observed against a normal level of 41. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 17 times between 2026-09-26T03:30 and 2026-10-19T01:50.
AUTO-2026-D4908E — Critical — 2026-10-19 — automatic, unreviewed
background traffic reaching a darknet telescope dropped to critical: 8 observed against a normal level of 41. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 14 times between 2026-09-26T03:30 and 2026-10-19T00:54.
AUTO-2026-CD7520 — Critical — 2026-10-19 — automatic, unreviewed
background traffic reaching a darknet telescope dropped to critical: 9 observed against a normal level of 41. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 20 times between 2026-09-26T03:30 and 2026-10-19T03:15.
AUTO-2026-55F633 — Critical — 2026-10-19 — automatic, unreviewed
background traffic reaching a darknet telescope dropped to critical: 7 observed against a normal level of 41. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 18 times between 2026-09-26T03:30 and 2026-10-19T02:18.
AUTO-2026-11C7FA — Critical — 2026-10-19 — automatic, unreviewed
background traffic reaching a darknet telescope dropped to critical: 7 observed against a normal level of 45. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 13 times between 2026-09-26T03:30 and 2026-10-18T04:05.
AUTO-2026-9D93DB — Critical — 2026-10-18 — automatic, unreviewed
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Listed by CISA as exploited in the wild, and the affected class of device terminates traffic at the perimeter.
AUTO-2026-2E7CAC — Critical — 2026-10-16 — automatic, unreviewed
Routing-status observations show networks registered as routed that announce no space, or that have one or two visible BGP neighbours. Single-upstream networks fail completely when that upstream does.
AUTO-2026-13BEE1 — High — 2026-10-16 — automatic, unreviewed
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. Listed by CISA as exploited in the wild, and the affected class of device terminates traffic at the perimeter.
AUTO-2026-75E193 — Critical — 2026-10-14 — automatic, unreviewed
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Listed by CISA as exploited in the wild, and the affected class of device terminates traffic at the perimeter.
AUTO-2026-952D04 — Critical — 2026-10-13 — automatic, unreviewed
Routing-status observations show networks registered as routed that announce no space, or that have one or two visible BGP neighbours. Single-upstream networks fail completely when that upstream does.
AUTO-2026-3B68F3 — High — 2026-10-12 — automatic, unreviewed
BGP routing visibility dropped to critical: 3090 observed against a normal level of 3144. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 9 times between 2026-09-10T03:37 and 2026-10-08T03:30.
AUTO-2026-E1F4DD — Critical — 2026-10-10 — automatic, unreviewed
BGP routing visibility dropped to critical: 3090 observed against a normal level of 3144. This measures whether the country's networks are reachable, not whether they are under attack — an outage and a cut cable look the same here. Seen 8 times between 2026-09-26T03:30 and 2026-10-08T03:30.
AUTO-2026-A07767 — Critical — 2026-10-10 — automatic, unreviewed