Welcome to the CrowdSec Blog

36% of exploited CVEs were attacked within a day of publication. What 500,000 servers saw at SANS 2026: borrowed cloud IPs, early zero-days, old CVEs.

Most SOCs need fast IP reputation in their SIEM before they need attribution-heavy CTI. How to tell them apart, and what to ask any IP reputation vendor.

CrowdSec data scientist looks back on 5 years: how we count our network, why we run honeypots, canaries in blocklists, and what the code leak really shows.

Discover how Finnish company MindMax used the new CrowdSec WAF bot detection feature to stop a massive, highly distributed residential botnet targeting their dictionary sites.

CrowdSec bot detection uncovered PaperPhone, a coordinated headless browser network using 75,000 IPs across 43 countries and fabricated mobile identities.

See if CrowdSec’s IP blocking or Suricata’s deep inspection fits your Linux server. Avoid alert fatigue with the right enforcement strategy.

Philippe Humeau, PDG de CrowdSec, revient en détail sur l’attaque de la chaîne d’approvisionnement de 2026, depuis la fuite du code source et l’enquête technique jusqu’aux enseignements tirés.

CrowdSec CEO Philippe Humeau shares the full story behind the 2026 supply chain attack, from the source code leak and forensic investigation to the lessons learned.

CrowdSec update on a source code exposure that occurred in May 2026, including the scope, impact, investigation, and security measures taken.

Set up open-source Nginx bot protection with CrowdSec to block scrapers, headless browsers, AI crawlers, and other unwanted automated traffic.

Discover what’s new in CrowdSec 1.8, including WAF bot detection, a dedicated Kubernetes datasource, faster LAPI synchronization, and improved Console alerts.

Learn why AI agent skills make software setup more reliable, reduce LLM guesswork, improve troubleshooting, and can even expose gaps in your documentation.

Add an open-source WAF to Traefik with CrowdSec. Wire the bouncer plugin, enable virtual patching, and block real attacks, step by step in Docker.

Deploy an open-source WAF for Nginx on Ubuntu with CrowdSec. Install the AppSec component, enable virtual patching, and block attacks step by step

CISA BOD 26-04 mandates risk-based patching driven by real exploitation evidence. Live Exploit Tracker delivers that evidence live — per CVE, per vendor.

CrowdSec 1.7.8 fixes two security vulnerabilities: CVE-2026-44982, a high-severity WAF bypass, and CVE-2026-44981, a Local API denial-of-service issue. Upgrade now.

Edge CVEs move fast from disclosure to exploitation. Learn a practical 60-minute response framework to assess exposure, reduce risk, deploy mitigations, and communicate clearly during edge vulnerability incidents.

ButanGas strengthens its IT security using CrowdSec’s real-time threat intelligence & blocklists, ensuring secure, uninterrupted LPG distribution across Italy.

Deploy the OWASP Core Rule Set (CRS) with CrowdSec to detect SQL injection, XSS, and other attack patterns. Learn how to install, tune, and enable blocking.

Explore CrowdSec support for Kubernetes, Ingress-NGINX deprecation, and how to migrate to Gateway API using Traefik, HAProxy, and Envoy.

Learn the difference between vulnerabilities, threats, and risks, and how understanding their lifecycle helps prevent security incidents.