JDY Botnet CVE-2026-35616 Edge Device Exploitation via Shell Injection in HTTP Body

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects high-frequency POST requests originating from outside internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that contain suspicious payloads in the request body (such as shell commands, downloading utilities, or busybox) or target common CGI-BIN paths, indicating a potential attempt to exploit a public-facing web server.