✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1501 to 1512 of 5110
CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies
In 2025, a series of sophisticated cyberattacks targeted Continuous Integration and Continuous Deployment (CI/CD) pipelines, exploiting vulnerabilities within these automated software delivery systems. Attackers gained unauthorized access to build servers and developer environments, injecting malicious code that was seamlessly integrated into legitimate software releases. This method allowed adversaries to distribute malware widely, compromising numerous organizations and leading to significant data breaches and operational disruptions. The incidents underscored the critical need for enhanced security measures within CI/CD processes to prevent such supply chain attacks. These attacks highlight a growing trend where cybercriminals focus on the software supply chain, recognizing the potential to infiltrate multiple organizations through a single compromised pipeline. The increasing reliance on automated development tools necessitates a reevaluation of security protocols to safeguard against such pervasive threats.
2 months ago
Kill Chain
CISA Adds CVE-2026-42897 to Known Exploited Vulnerabilities Catalog
On May 14, 2026, Microsoft disclosed a critical cross-site scripting (XSS) vulnerability, CVE-2026-42897, affecting on-premises versions of Microsoft Exchange Server 2016, 2019, and Subscription Edition. This flaw allows unauthorized attackers to execute arbitrary JavaScript in the context of a user's browser by sending specially crafted emails, which, when opened in Outlook Web Access (OWA), can lead to spoofing attacks. Microsoft has acknowledged active exploitation of this vulnerability in the wild and has provided temporary mitigations pending a permanent fix. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/?utm_source=openai)) The exploitation of CVE-2026-42897 underscores the persistent threat posed by XSS vulnerabilities in widely used enterprise applications. Organizations relying on on-premises Exchange servers are at heightened risk, emphasizing the need for immediate implementation of Microsoft's recommended mitigations and vigilance against similar attack vectors targeting web-based email interfaces.
2 months ago
Kill Chain
Mesa County Election Data Breach: Lessons in Insider Threats
In 2021, Tina Peters, then the Mesa County Clerk in Colorado, facilitated unauthorized access to the county's voting systems, allowing sensitive election data to be copied and disseminated online. This breach was part of an effort to substantiate unfounded claims of election fraud in the 2020 presidential election. Peters was convicted in 2024 on multiple felony and misdemeanor counts, including attempt to influence a public servant and official misconduct, leading to a nine-year prison sentence. ([apnews.com](https://apnews.com/article/b456ce4f80dc97f4b967eb6297311a51?utm_source=openai)) The incident underscores the critical importance of safeguarding election infrastructure against insider threats. It highlights the potential for significant operational and reputational damage when trusted officials exploit their positions, emphasizing the need for stringent access controls and continuous monitoring within electoral systems.
2 months ago
Kill Chain
Critical Zero-Day Vulnerability in Microsoft Exchange Server: CVE-2026-42897
In May 2026, Microsoft disclosed a high-severity vulnerability (CVE-2026-42897) in Exchange Server, affecting versions 2016, 2019, and Subscription Edition. This cross-site scripting (XSS) flaw allows attackers to execute arbitrary JavaScript in the context of a user's browser by sending specially crafted emails, leading to potential spoofing attacks. Exploitation requires the recipient to open the email in Outlook Web Access (OWA) under specific conditions. Microsoft has confirmed active exploitation of this zero-day vulnerability in the wild. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4519822?utm_source=openai)) The urgency of this issue is underscored by the active exploitation of the vulnerability, highlighting the critical need for organizations to implement the provided mitigations promptly. The Exchange Emergency Mitigation Service (EEMS) offers automatic mitigation for affected on-premises servers, and administrators are advised to enable this service immediately to protect their systems. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498/replies/4519822?utm_source=openai))
2 months ago
Kill Chain
Understanding the REMUS Infostealer: A 2026 Cybersecurity Threat
In early 2026, the REMUS infostealer emerged as a significant threat in the cybercrime landscape. Evolving from the Lumma Stealer family, REMUS introduced advanced capabilities such as session theft, targeting password managers, and utilizing blockchain-based command-and-control mechanisms. Its rapid development and commercialization reflect a shift towards malware-as-a-service (MaaS) models, enabling continuous updates and operational scalability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/?utm_source=openai)) The emergence of REMUS underscores the increasing sophistication of cyber threats, highlighting the need for organizations to enhance their security measures against evolving malware tactics and the growing prevalence of MaaS platforms.
2 months ago
Kill Chain
Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites
In May 2026, two critical vulnerabilities were discovered in the Avada Builder WordPress plugin, affecting over one million active installations. The first, CVE-2026-4782, is an arbitrary file read vulnerability exploitable by authenticated users with at least subscriber-level access, allowing them to read sensitive files on the server. The second, CVE-2026-4798, is a time-based blind SQL injection vulnerability that can be exploited without authentication, enabling attackers to extract sensitive information from the database, including password hashes. Both vulnerabilities have been patched in version 3.15.3 of the plugin. This incident underscores the importance of timely software updates and the potential risks associated with widely used plugins. Organizations should prioritize patch management and consider implementing additional security measures to protect against similar vulnerabilities in the future.
2 months ago
Kill Chain
Node-ipc npm Package Compromised: A Wake-Up Call for Open-Source Security
In May 2026, malicious versions of the widely used node-ipc npm package were published, introducing credential-stealing malware into applications. The compromised versions—9.1.6, 9.2.3, and 12.0.1—contained obfuscated code that, upon execution, harvested sensitive information such as cloud credentials, SSH keys, and CI/CD secrets. This data was exfiltrated through DNS TXT queries to attacker-controlled infrastructure. The attack was facilitated by the compromise of a maintainer's account, allowing unauthorized publication of these malicious versions. ([stepsecurity.io](https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises, as the reliance on third-party packages continues to grow.
2 months ago
Kill Chain
Pwn2Own Berlin 2026: Critical Zero-Day Exploits in Microsoft Exchange and Windows 11
During the second day of Pwn2Own Berlin 2026, security researchers demonstrated 15 unique zero-day vulnerabilities across multiple products, including Microsoft Exchange, Windows 11, and Red Hat Enterprise Linux for Workstations. Notably, Cheng-Da Tsai of the DEVCORE Research Team earned $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Additionally, Siyeon Wi exploited an integer overflow bug to hack Windows 11, and Ben Koo of Team DDOS escalated privileges to root on Red Hat Enterprise Linux for Workstations, earning $7,500 and $10,000 respectively. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/?utm_source=openai)) This incident underscores the persistent vulnerabilities in widely used enterprise software and highlights the critical need for organizations to prioritize timely patching and robust security measures to mitigate the risks associated with zero-day exploits.
2 months ago
Kill Chain
Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft
In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages. This flaw, present in versions prior to 3.15.0.3, allowed unauthenticated attackers to modify the plugin's global settings via an unprotected checkout endpoint, leading to the execution of malicious code on checkout pages. The injected code facilitated a payment card skimmer that stole sensitive customer information, including credit card numbers, CVVs, billing addresses, and other personal data. FunnelKit addressed the vulnerability by releasing version 3.15.0.3, urging users to update immediately and review their settings for any unauthorized scripts. This incident underscores the persistent threat posed by vulnerabilities in widely-used plugins, emphasizing the need for regular updates and vigilant monitoring of third-party components in web applications. The exploitation of such vulnerabilities can lead to significant data breaches, financial loss, and reputational damage for businesses, highlighting the critical importance of proactive cybersecurity measures.
2 months ago
Kill Chain
Turla's Kazuar Backdoor Evolves into Modular P2P Botnet
In May 2026, the Russian state-sponsored hacking group Turla, also known as Secret Blizzard, transformed its custom backdoor, Kazuar, into a modular peer-to-peer (P2P) botnet designed for stealth and persistent access to compromised hosts. This evolution includes three distinct modules: Kernel, Bridge, and Worker, each serving specific roles to enhance flexibility and reduce detection. The Kernel module coordinates tasks and manages communication, the Bridge module acts as a proxy to the command-and-control server, and the Worker module performs data collection and system monitoring. This modular architecture allows Turla to maintain long-term access to targeted systems, primarily within government, diplomatic, and defense sectors in Europe and Central Asia. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/?utm_source=openai)) The significance of this development lies in the increasing sophistication of state-sponsored cyber threats. Turla's adoption of a modular P2P botnet architecture exemplifies a trend towards more resilient and stealthy malware, posing heightened challenges for detection and mitigation. Organizations must enhance their cybersecurity measures to address these evolving threats effectively.
2 months ago
Kill Chain
Critical Nginx UI Vulnerability (CVE-2026-33032) Exposes Servers to Full Takeover
In March 2026, a critical vulnerability (CVE-2026-33032) was discovered in Nginx UI, a web-based management interface for Nginx servers. This flaw, present in versions up to 2.3.5, allows unauthenticated remote attackers to gain full control over the Nginx service by exploiting the /mcp_message endpoint, which lacks proper authentication and has an empty default IP whitelist. Attackers can restart the server, modify configurations, and trigger automatic reloads, leading to complete service takeover. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-33032?utm_source=openai)) The urgency to address this vulnerability is heightened by active exploitation in the wild, with numerous exposed instances globally. Organizations using affected versions are strongly advised to update to the latest release or implement recommended mitigations to prevent potential breaches and service disruptions. ([network-security-magazine.com](https://www.network-security-magazine.com/network-security/network-security-news/nginx-ui-cve-2026-33032-actively-exploited/?utm_source=openai))
2 months ago
Kill Chain
Instructure's Canvas Platform Breached Twice by ShinyHunters in May 2026
In early May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks by the ShinyHunters group. The initial breach on April 29 exposed sensitive data of approximately 275 million users across nearly 9,000 educational institutions, including names, email addresses, student ID numbers, and private messages. Despite Instructure's efforts to secure the system, ShinyHunters re-compromised Canvas on May 7, defacing login pages and issuing ransom demands. The attacks disrupted operations during critical exam periods, leading to delays and cancellations of final exams at numerous colleges and universities. In response, Instructure reached an agreement with the attackers, reportedly paying a ransom to secure the return and destruction of the stolen data, though the exact terms were not disclosed. This incident underscores the escalating threat of cyberattacks targeting educational institutions and the challenges in safeguarding sensitive student and staff information. ([techradar.com](https://www.techradar.com/pro/security/us-congress-calls-instructure-ceo-as-it-investigates-canvas-breach?utm_source=openai))
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
