US takes down NightmareStresser DDoS-for-hire platform

The U.S. Federal Bureau of Investigation (FBI) seized the domains of NightmareStresser, a long-running distributed denial-of-service (DDoS) for-hire platform. NightmareStresser allowed users to rent botnets composed of compromised routers and IoT devices to launch large-scale DDoS attacks targeting various network layers. The service had over 566,000 registered users and could launch attacks up to 200 Gbps. This takedown was part of Operation PowerOFF, a coordinated international law enforcement effort to dismantle criminal DDoS-for-hire infrastructures worldwide. Previous actions under this operation have led to multiple arrests and domain seizures of similar services. The FBI and other agencies continue to target these platforms to reduce the prevalence of DDoS attacks globally.

• bleepingcomputer.com/news/security/fbi-seizes-nightmarestresser-service-linked-to-thousands-of-ddos-attacks/ (opens in a new tab)

• GCP-2023-004MediumVulnerability2026-10-26
• VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handlingHighVulnerability2026-10-26
• CVE-2026-115417: aws-c-mqtt · Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapterHighVulnerability2026-10-22
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• Issue in the Linux kernel virtio-net/TAP networking path affecting KVM-based hypervisorsHighVulnerability2026-10-15