<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>SecurityHero</title><description>Real attacks our honeypot catches every day, told as stories worth reading.</description><link>https://blog.securityhero.site/</link><item><title>One command, 3.6 seconds — and all five stages were in it</title><link>https://blog.securityhero.site/en/honeypot/2026-08-19/</link><guid isPermaLink="true">https://blog.securityhero.site/en/honeypot/2026-08-19/</guid><description>Three days straight the completed sessions were Telnet; on the fourth day it switched to SSH. The intruder stayed 3.6 seconds, and ran exactly one command.</description><pubDate>Thu, 20 Aug 2026 00:00:00 GMT</pubDate></item></channel></rss>