✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1357 to 1368 of 5099
CISA Adds CVE-2026-9082 to Known Exploited Vulnerabilities Catalog
On May 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9082 to its Known Exploited Vulnerabilities Catalog. This highly critical SQL injection vulnerability affects Drupal core's database abstraction layer, specifically impacting sites using PostgreSQL databases. Exploitation of this flaw can lead to information disclosure, privilege escalation, and remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) The inclusion of CVE-2026-9082 in CISA's catalog underscores the urgency for organizations to address this vulnerability promptly. Given the widespread use of Drupal for content management, unpatched systems are at significant risk of exploitation, potentially leading to severe security breaches.
2 months ago
Kill Chain
From Edge Appliance to Enterprise Compromise: Analyzing the 2026 Multi-Stage Linux Intrusion
In May 2026, a sophisticated cyber intrusion was identified, where attackers exploited vulnerabilities in F5 BIG-IP Access Policy Manager (APM) and Atlassian Confluence to gain unauthorized access to enterprise networks. The attackers initially compromised an internet-facing F5 BIG-IP appliance, leveraging a critical remote code execution vulnerability (CVE-2025-53521) to establish a foothold. They then moved laterally to an internal Linux host and exploited an unpatched Confluence server, obtaining credentials that facilitated further attacks against Active Directory. This multi-stage attack underscores the evolving threat landscape, where adversaries target edge appliances and internal applications to bypass traditional security controls. Organizations are urged to prioritize patch management, especially for internet-facing devices, and to implement robust monitoring across all network segments to detect and mitigate such complex attack chains.
2 months ago
Kill Chain
Understanding Stack String Obfuscation: A New Challenge in Malware Detection
In May 2026, cybersecurity researchers highlighted the 'stack string' obfuscation technique, where malware dynamically constructs strings on the stack at runtime, evading detection by static analysis tools. This method involves assembling strings character-by-character directly onto the stack, making them invisible to traditional string extraction utilities. The technique poses significant challenges for malware analysts and underscores the need for advanced detection methods. The resurgence of stack string obfuscation reflects a broader trend of malware authors adopting sophisticated evasion tactics. As traditional detection tools become less effective against such techniques, there is an urgent need for enhanced analysis tools and methodologies to identify and mitigate these evolving threats.
2 months ago
Kill Chain
Understanding CVE-2026-0265: PAN-OS CAS Authentication Bypass
In May 2026, a critical authentication bypass vulnerability, CVE-2026-0265, was identified in Palo Alto Networks' PAN-OS software. This flaw allows unauthenticated attackers to forge JSON Web Tokens (JWTs) and gain unauthorized access to systems where the Cloud Authentication Service (CAS) is enabled. The vulnerability affects both GlobalProtect portals and management interfaces, potentially compromising VPN user sessions and administrative controls. Palo Alto Networks has released patches for affected versions, and organizations are urged to update to fixed versions or disable CAS to mitigate the risk. The discovery of CVE-2026-0265 underscores the ongoing challenges in securing authentication mechanisms within network infrastructure. As attackers continue to exploit such vulnerabilities, it is imperative for organizations to stay vigilant, apply timely patches, and adhere to best practices in access control to safeguard their systems against unauthorized access.
2 months ago
Kill Chain
FBI Issues Warning on Kali365 Phishing Platform Targeting Microsoft 365 Users
In April 2026, the FBI identified 'Kali365,' a Phishing-as-a-Service (PhaaS) platform that enables cybercriminals to hijack Microsoft 365 access tokens by exploiting OAuth device code authorizations. Distributed primarily via Telegram, Kali365 allows attackers to bypass multi-factor authentication (MFA) without intercepting user credentials. This method grants persistent access to Microsoft 365 services, including Outlook, Teams, and OneDrive, facilitating data theft, fraud, extortion, and potential ransomware attacks. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai)) The emergence of Kali365 underscores a significant shift in phishing tactics, with attackers increasingly leveraging device code phishing to circumvent traditional security measures. This trend highlights the urgent need for organizations to reassess and strengthen their authentication protocols and user education to mitigate evolving threats. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/22/kali365-microsoft-365-phishing-fbi-warning/?utm_source=openai))
2 months ago
Kill Chain
Authorities Arrest KimWolf Botnet Operator in 2026
In May 2026, U.S. and Canadian authorities arrested Jacob Butler, a 23-year-old Canadian national known online as "Dort," for operating the KimWolf botnet. This botnet infected nearly two million devices worldwide, including digital photo frames, web cameras, and Android-based TV boxes. Butler allegedly sold access to this network through a DDoS-for-hire service, facilitating over 25,000 attacks that reached up to 30 terabits per second, causing financial losses exceeding $1 million for some victims. The KimWolf botnet was also linked to attacks targeting Department of Defense Information Network IP addresses. ([justice.gov](https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos?utm_source=openai)) The arrest underscores the escalating threat posed by large-scale botnets exploiting Internet of Things (IoT) devices. The KimWolf botnet's rapid expansion and its use in record-breaking DDoS attacks highlight the need for enhanced security measures and international cooperation to combat cybercrime. ([techradar.com](https://www.techradar.com/pro/security/a-massive-new-ddos-botnet-has-already-snared-1-8-million-devices-heres-what-we-know?utm_source=openai))
2 months ago
Kill Chain
Ubiquiti Patches Critical UniFi OS Vulnerabilities - May 2026
In May 2026, Ubiquiti released patches for three critical vulnerabilities in UniFi OS, identified as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. These flaws allowed remote attackers to make unauthorized system changes, access underlying system files, and execute command injection attacks without requiring authentication. The vulnerabilities were reported through Ubiquiti's bug bounty program and could be exploited in low-complexity attacks. At the time of disclosure, nearly 100,000 UniFi OS endpoints were exposed online, with approximately 50,000 located in the United States. This incident underscores the persistent targeting of network infrastructure by cybercriminals and state-sponsored actors. Organizations must prioritize timely patching and robust security measures to mitigate risks associated with such vulnerabilities.
2 months ago
Kill Chain
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability Exploited
In May 2026, a critical SQL injection vulnerability, CVE-2026-9082, was identified in Drupal's database abstraction API, specifically affecting sites using PostgreSQL. This flaw allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to information disclosure, privilege escalation, and remote code execution. Exploitation attempts have been observed in the wild, prompting Drupal to assign a risk score of 23 out of 25. Affected versions include Drupal 8.9.x, 10.4.x before 10.4.10, 10.5.x before 10.5.10, 10.6.x before 10.6.9, 11.0.x/11.1.x before 11.1.10, 11.2.x before 11.2.12, and 11.3.x before 11.3.10. Administrators are urged to update to the latest versions immediately. This incident underscores the persistent threat of SQL injection vulnerabilities in web applications, emphasizing the need for robust input validation and regular security updates. The active exploitation of this flaw highlights the importance of timely patching and vigilant monitoring to protect sensitive data and maintain system integrity.
2 months ago
Kill Chain
Trend Micro Apex One Zero-Day CVE-2026-34926 Exploited in the Wild
In May 2026, Trend Micro disclosed a directory traversal vulnerability (CVE-2026-34926) in its Apex One on-premise server, allowing local attackers with administrative privileges to inject malicious code. This flaw enables the deployment of malware to connected agents, compromising endpoint security. Despite the requirement for prior administrative access, at least one exploitation attempt has been observed in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to apply patches by June 4, 2026. This incident underscores the critical need for timely patch management and vigilant monitoring of endpoint security solutions to prevent potential breaches.
2 months ago
Kill Chain
Former US Executives Admit to Aiding Tech Support Scammers
In May 2026, Adam Young and Harrison Gevirtz, former executives of C.A. Cloud Attribution, Ltd., pleaded guilty to concealing a tech support fraud scheme that operated from early 2017 to April 2022. Their company provided services to clients engaged in telemarketing and tech support scams, which involved deceptive pop-up ads and impersonation of companies like Microsoft and Apple to defraud victims worldwide. Despite knowing their clients' fraudulent activities, Young and Gevirtz failed to report them and instead facilitated their operations by advising on methods to evade detection. This case underscores the critical need for vigilance against tech support scams, which continue to exploit individuals globally. The involvement of corporate executives in such schemes highlights the importance of ethical business practices and the necessity for companies to implement robust compliance measures to prevent complicity in fraudulent activities.
2 months ago
Kill Chain
Dutch Authorities Dismantle Hosting Firm Enabling Cyberattacks
In May 2026, the Dutch Fiscal Information and Investigation Service (FIOD) arrested two individuals and seized 800 servers associated with Stark Industries, a web hosting company implicated in facilitating cyberattacks, interference operations, and disinformation campaigns. The suspects, aged 57 and 39, were linked to providing infrastructure that supported actions undermining democracy and security, including information manipulation and disruption of public and economic systems. Stark Industries, founded in February 2022, was added to the European Union's list of sanctioned entities in May 2025. Following the sanctions, the company's infrastructure was transferred to a newly established Dutch entity, WorkTitans B.V., operating under the brand THE.Hosting, which investigators believe acted as a front for the sanctioned organization. The FIOD's coordinated raids in Dronten, Schiphol-Rijk, Enschede, and Almere resulted in the confiscation of servers, laptops, phones, and administrative records. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/netherlands-seizes-800-servers-of-hosting-firm-enabling-cyberattacks/amp/?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminals leveraging hosting services to conduct malicious activities. The involvement of entities like WorkTitans B.V. highlights the challenges in enforcing sanctions and the need for continuous vigilance against infrastructure providers that may serve as conduits for cyberattacks. Organizations must remain proactive in monitoring and securing their networks against such threats.
2 months ago
Kill Chain
Ghostwriter's Prometheus Phishing Campaign Targets Ukrainian Government
In May 2026, the Belarus-aligned threat actor known as Ghostwriter (also referred to as UAC-0057 and UNC1151) launched a phishing campaign targeting Ukrainian government entities. The attackers utilized compromised accounts to send emails containing PDF attachments that, when interacted with, led to the deployment of a multi-stage malware chain. This chain involved the execution of JavaScript files (OYSTERFRESH and OYSTERSHUCK) designed to install the OYSTERBLUES payload, which harvested system information and facilitated the deployment of Cobalt Strike, a tool commonly used for post-exploitation activities. The campaign exploited lures related to Prometheus, a Ukrainian online learning platform, to enhance the credibility of the phishing emails. ([thehackernews.com](https://thehackernews.com/2026/05/ghostwriter-targets-ukraine-government.html?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors employing sophisticated phishing techniques to infiltrate government networks. The use of legitimate platforms as lures and the deployment of multi-stage malware highlight the evolving tactics of such groups, emphasizing the need for robust cybersecurity measures and user awareness to mitigate these risks.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
