Cisco IOS XE: Ten days later

**Executive Summary:** Censys researchers report a large-scale compromise of Cisco devices running OpenResty/Nginx where attackers installed configuration-based backdoors; attackers modified Nginx location directives to evade detection, and a targeted scan identified 28,910 hosts that responded with a default Openresty/Nginx 404 to a '/%25' request—an indicator the backdoor may be present, though detection is imperfect and the adversary has adapted to obscure visibility.