NightmareStresser DDoS Service Disrupted in International Operation

NightmareStresser was a long-running distributed denial-of-service (DDoS) for-hire service active since at least 2022, likely founded in 2016. It enabled nearly one million users to launch thousands of DDoS attacks per hour worldwide, accepting cryptocurrency payments while avoiding attacks on government, education, and hospital domains. The service was disrupted in a coordinated international law enforcement operation called Operation PowerOFF, which seized its domains and aimed to dismantle DDoS-for-hire infrastructures globally. This takedown is part of ongoing efforts by multiple countries to combat DDoS-for-hire services and hold their operators and users accountable.

• securityweek.com/nightmarestresser-ddos-service-disrupted-in-international-operation/ (opens in a new tab)

• GCP-2023-004MediumVulnerability2026-10-26
• VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handlingHighVulnerability2026-10-26
• CVE-2026-115417: aws-c-mqtt · Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapterHighVulnerability2026-10-22
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsHighVulnerability2026-10-15