✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2425 to 2436 of 5175
Critical Langflow RCE Vulnerability (CVE-2026-33017) Exploited in the Wild
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-33017, was discovered in Langflow, an open-source framework for building AI workflows. This flaw allows unauthenticated attackers to execute arbitrary Python code on affected servers by sending crafted HTTP requests to the unsandboxed flow execution endpoint. The vulnerability affects Langflow versions 1.8.1 and earlier, potentially leading to full system compromise, data theft, and unauthorized access to sensitive information. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the increasing targeting of AI development tools by threat actors. Organizations utilizing Langflow are urged to upgrade to version 1.9.0 or later, which addresses this security issue. Additionally, it is recommended to disable or restrict access to the vulnerable endpoint, monitor for suspicious activity, and rotate API keys and credentials to mitigate potential risks. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai))
4 months ago
Kill Chain
UK Sanctions Xinbi Marketplace Linked to Asian Scam Centers
In March 2026, the United Kingdom's Foreign, Commonwealth and Development Office (FCDO) imposed sanctions on Xinbi, a Chinese-language online marketplace operating via Telegram. Xinbi has been implicated in facilitating the sale of stolen data and satellite internet equipment to scam networks across Southeast Asia. Additionally, the platform is believed to have assisted North Korean threat actors in laundering cryptocurrency obtained from significant cyber heists targeting global companies and individuals. Between 2021 and 2025, Xinbi processed over $19.9 billion, engaging in activities ranging from unlicensed over-the-counter trades and money laundering to the distribution of stolen personal databases. The UK's sanctions aim to sever Xinbi's connections to the legitimate cryptocurrency ecosystem, thereby disrupting its operations and preventing further illicit activities. This action underscores the growing international efforts to combat cybercrime infrastructures that enable large-scale financial fraud and data breaches. The sanctions against Xinbi highlight the necessity for organizations to enhance their cybersecurity measures and remain vigilant against platforms that facilitate cybercriminal activities.
4 months ago
Kill Chain
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
In March 2026, cybersecurity researchers identified a novel web skimming attack targeting e-commerce platforms. This attack leverages WebRTC data channels to exfiltrate payment information, effectively bypassing traditional security measures such as Content Security Policy (CSP) controls. The skimmer, implemented in JavaScript, establishes a direct, encrypted communication channel with a command-and-control server, facilitating the stealthy transmission of stolen credit card data. This method allows attackers to circumvent standard detection mechanisms, posing a significant threat to online retailers and their customers. The emergence of this WebRTC-based skimming technique underscores the evolving sophistication of cyber threats in the e-commerce sector. As attackers develop more advanced methods to exploit web technologies, it is imperative for organizations to enhance their security protocols and monitoring systems to detect and mitigate such innovative attack vectors.
4 months ago
Kill Chain
LiteLLM Supply Chain Attack: A Wake-Up Call for Open-Source Security
In March 2026, the widely used Python library LiteLLM was compromised in a supply chain attack. Threat actors, identified as TeamPCP, gained access to the LiteLLM account and released malicious versions 1.82.7 and 1.82.8 on the PyPI repository. These versions contained backdoors that harvested sensitive data, including SSH keys, cloud tokens, Kubernetes secrets, and crypto wallets. The malware also attempted lateral movement across Kubernetes clusters by deploying privileged pods and established persistence via systemd backdoors. ([techradar.com](https://www.techradar.com/pro/security/top-llm-pypl-package-compromised-to-steal-user-details-heres-what-we-know?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source software repositories. The compromise of LiteLLM, a tool integral to AI model management, highlights the critical need for enhanced security measures in software development pipelines to prevent similar breaches.
4 months ago
Kill Chain
Coruna Exploit Kit: A Cautionary Tale of Advanced Hacking Tools in Cybercriminal Hands
In 2025, the Coruna exploit kit emerged as a sophisticated tool targeting iPhones running iOS versions 13.0 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian espionage groups in attacks against Ukrainian users and by financially motivated hackers in China. The kit comprises five exploit chains and 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606, previously exploited in Operation Triangulation. These vulnerabilities enable remote code execution and privilege escalation, granting attackers full control over affected devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of government-grade hacking tools into the broader cybercriminal ecosystem. This incident highlights the urgent need for organizations to implement robust security measures, promptly apply software updates, and monitor for emerging threats to protect sensitive data and maintain operational integrity. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
4 months ago
Kill Chain
Understanding the Coruna iOS Exploit Kit: A 2026 Security Threat
In early 2026, the Coruna iOS exploit kit emerged as a significant threat, targeting iPhones running iOS versions 13.0 through 17.2.1. This sophisticated toolkit comprises 23 exploits, including zero-day vulnerabilities, enabling attackers to execute zero-click attacks via iMessage. Initially developed for government surveillance, Coruna has since been adopted by cybercriminal groups, leading to widespread data breaches and financial losses. The kit's capabilities allow for full device compromise, granting unauthorized access to sensitive information and enabling remote control of infected devices. The proliferation of Coruna underscores the evolving landscape of mobile threats and the critical need for robust security measures to protect against advanced exploit kits. Organizations and individuals must prioritize timely software updates, implement comprehensive security protocols, and remain vigilant against emerging threats to safeguard their digital assets.
4 months ago
Kill Chain
Critical Vulnerability in Anthropic's Claude Chrome Extension Highlights AI Security Risks
In March 2026, a critical vulnerability was discovered in Anthropic's Claude Chrome Extension, allowing malicious actors to inject prompts into the assistant without user interaction. This zero-click cross-site scripting (XSS) flaw enabled attackers to execute arbitrary commands by embedding malicious code into web pages, leading to potential data exfiltration and unauthorized actions. The vulnerability was promptly addressed by Anthropic through an emergency patch, mitigating the risk to users. This incident underscores the growing threat landscape associated with AI-powered browser extensions. As these tools become more integrated into daily workflows, they present new vectors for exploitation. Organizations must remain vigilant, ensuring that such extensions are regularly updated and monitored for security vulnerabilities to prevent similar attacks.
4 months ago
Kill Chain
Unveiling Red Menshen's 2026 BPFDoor Espionage in Telecom Networks
In 2026, the China-linked threat actor Red Menshen, also known as Earth Bluecrow, conducted a prolonged cyber espionage campaign targeting telecommunications networks across the Middle East and Asia. Utilizing the stealthy Linux backdoor BPFDoor, the group infiltrated critical infrastructure, including Home Subscriber Servers (HSS), to exfiltrate sensitive subscriber data. BPFDoor's advanced evasion techniques allowed it to bypass traditional security measures, enabling Red Menshen to maintain persistent access and conduct surveillance undetected for extended periods. This incident underscores the increasing sophistication of nation-state cyber threats targeting telecom infrastructure. The use of kernel-level implants and passive backdoors like BPFDoor highlights the need for enhanced detection capabilities and proactive security measures to protect critical communication networks from such covert operations.
4 months ago
Kill Chain
Unveiling the Scarlet Goldfinch 2025 ClickFix Malware Campaign
In 2025, the Scarlet Goldfinch threat actor launched a sophisticated malware campaign utilizing the ClickFix social engineering technique. This method deceived users into executing malicious commands under the guise of routine system verifications, leading to the installation of NetSupport Manager, a remote access tool. The campaign primarily targeted Windows systems, exploiting compromised websites to display fake browser update prompts, which, when acted upon, initiated the malware download and execution process. ([redcanary.com](https://redcanary.com/threat-detection-report/threats/scarlet-goldfinch/?utm_source=openai)) The significance of this incident lies in the evolution of social engineering tactics, highlighting the increasing sophistication of threat actors in bypassing traditional security measures. The widespread use of ClickFix underscores the necessity for enhanced user education and the implementation of robust security protocols to mitigate such deceptive attack vectors.
4 months ago
Kill Chain
Critical Vulnerabilities in WAGO Industrial Managed Switches Expose Systems to Remote Attacks
In early 2026, multiple critical vulnerabilities were discovered in WAGO GmbH & Co. KG's Industrial Managed Switches, notably models 852-1322 and 852-1328. These flaws, including stack buffer overflows and authentication bypasses, allowed unauthenticated remote attackers to execute arbitrary code, potentially leading to full system compromise. The vulnerabilities stemmed from unsafe input handling in the devices' web-based management interfaces, which utilized modified lighttpd servers and custom CGI binaries. Exploitation could result in denial-of-service conditions and unauthorized access to sensitive configurations. ([certvde.com](https://certvde.com/en/advisories/VDE-2026-004/?utm_source=openai)) This incident underscores the persistent risks associated with industrial control systems (ICS) and the critical need for robust security measures. The vulnerabilities highlight the importance of regular firmware updates, secure coding practices, and comprehensive network segmentation to protect against unauthorized access and potential operational disruptions.
4 months ago
Kill Chain
OpenCode Systems 2026 Access Control Vulnerability Exposes SMS Messages
In March 2026, a significant security vulnerability (CVE-2025-70614) was identified in OpenCode Systems' OC Messaging and USSD Gateway version 6.32.2. This flaw allowed authenticated users with low privileges to access SMS messages beyond their authorized scope by manipulating company or tenant identifier parameters. The vulnerability posed a substantial risk to data confidentiality across multi-tenant environments. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-70614/?utm_source=openai)) The incident underscores the critical importance of robust access control mechanisms in multi-tenant systems. Organizations are urged to review and strengthen their access control policies to prevent similar vulnerabilities and protect sensitive information.
4 months ago
Kill Chain
Critical RCE Vulnerability Discovered in PTC Windchill PLM Software
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-4681, was discovered in PTC's Windchill Product Lifecycle Management (PLM) software. This flaw, stemming from improper deserialization of untrusted data, affects multiple versions of Windchill PDMLink and FlexPLM. Exploitation of this vulnerability could allow attackers to execute arbitrary code remotely, potentially compromising sensitive product data and disrupting manufacturing processes. PTC has acknowledged the issue and is actively developing a fix. In the interim, they have provided specific mitigation steps, including updates to Apache and IIS server configurations, to protect affected systems. Organizations utilizing Windchill are urged to implement these workarounds immediately to safeguard their environments. This incident underscores the persistent threat posed by software vulnerabilities in critical infrastructure sectors. The exploitation of deserialization flaws remains a favored technique among cyber adversaries, highlighting the necessity for continuous vigilance, timely patching, and adherence to secure coding practices to mitigate such risks.
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
