✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 289 to 300 of 5034
CISA Issues Urgent Directive on Fortinet FortiSandbox Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive for federal agencies to patch two critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws, disclosed in April and June 2026 respectively, allow unauthenticated attackers to execute arbitrary code remotely via command injection attacks. Despite Fortinet's initial advisories, threat intelligence firm Defused observed active exploitation of these vulnerabilities in mid-June 2026, prompting CISA to mandate immediate remediation by July 19, 2026. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting critical infrastructure components. FortiSandbox, integral to many organizations' security architectures, has become a focal point for cyber threats. This incident highlights the necessity for organizations to promptly apply security patches and maintain vigilant monitoring to mitigate emerging threats.
2 weeks ago
Kill Chain
US Charges Two Over $43 Million Investment Fraud Laundering
In July 2026, U.S. prosecutors charged Zhuoying Chen and Haojie Zhang, residents of New York, for orchestrating a sophisticated money laundering network between 2020 and 2022. The duo managed over a dozen individuals who opened approximately 140 bank accounts under 45 shell companies, facilitating the transfer of at least $43 million from cyber investment fraud victims to bank accounts in China. The fraudulent schemes involved contacting victims via social media, building trust, and persuading them to invest in fake opportunities, ultimately leading to significant financial losses. This case underscores the escalating threat of cyber-enabled financial fraud and the critical need for robust cybersecurity measures. With investment fraud accounting for 49% of all scam-related incidents in 2025, resulting in losses of $8.6 billion, organizations must prioritize the implementation of advanced security protocols to protect against such pervasive threats.
2 weeks ago
Kill Chain
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk. The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.
2 weeks ago
Kill Chain
Ernst & Young Data Breach Exposes Client Tax Information in 2026
In April 2026, Ernst & Young (EY) identified unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded documents containing personal and financial information used in tax filings. EY promptly secured the affected systems, notified federal law enforcement, and offered 24 months of identity monitoring services to impacted clients. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/?utm_source=openai)) This incident underscores the critical need for robust third-party risk management, especially as organizations increasingly rely on external platforms for sensitive operations. The breach highlights the importance of continuous monitoring and rapid response strategies to mitigate potential damages from such compromises.
2 weeks ago
Kill Chain
Cybercriminals' Quest for 'Clean' Residential Proxies in Carding Schemes
In July 2026, Flare researchers analyzed 2,889 underground posts across 545 threads, revealing that cybercriminals are increasingly seeking 'clean' residential proxies to enhance their carding operations. These proxies are now part of a broader identity-simulation stack, including device fingerprints, browser profiles, and transaction behaviors, to evade detection by financial institutions. The study highlights a shift where residential IPs alone are insufficient, leading to a secondary market for proxies with pristine histories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-the-search-for-clean-residential-proxies-for-carding/?utm_source=openai)) This trend underscores the evolving tactics of cybercriminals who are investing more effort into creating convincing digital identities. The demand for 'clean' proxies indicates that traditional IP-based trust models are becoming less reliable, necessitating more comprehensive security measures. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-the-search-for-clean-residential-proxies-for-carding/?utm_source=openai))
2 weeks ago
Kill Chain
Understanding the HollowByte OpenSSL DoS Vulnerability
In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.
2 weeks ago
Kill Chain
NadMesh Botnet Exploits Exposed AI Services to Steal Cloud Credentials
In early July 2026, the NadMesh botnet emerged, targeting exposed AI services such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The botnet exploits these unsecured services to harvest sensitive cloud credentials, including AWS keys and Kubernetes tokens. QiAnXin's XLab reported that the botnet operator's dashboard claimed possession of 3,811 unique AWS keys, indicating a significant breach of cloud security. The malware employs a Shodan harvester to continuously scan for vulnerable AI services, emphasizing the critical need for securing such deployments. This incident underscores the growing trend of cyber attackers exploiting misconfigured AI and automation tools to gain unauthorized access to cloud infrastructures. Organizations must prioritize the security of AI services, ensuring proper authentication and network configurations to prevent such breaches.
2 weeks ago
Kill Chain
Abbott Laboratories Faces Cyber Attacks: ShinyHunters' Vishing Tactics in 2026
In July 2026, Abbott Laboratories disclosed two separate cybersecurity incidents. The first involved unauthorized access to internal systems within its Cancer Diagnostics business, attributed to the ShinyHunters extortion group. The attackers reportedly used a vishing attack in mid-June to compromise a Microsoft Entra single sign-on account, leading to data exfiltration. The second incident pertained to a potential breach of Abbott's LabCentral portal, with claims of stolen company data. Abbott stated that these incidents did not impact business operations, product availability, or patient services, and that the affected systems were separate from its core infrastructure. These incidents underscore the escalating threat posed by sophisticated social engineering attacks targeting healthcare organizations. The ShinyHunters group has been increasingly active, employing tactics like vishing to exploit single sign-on vulnerabilities, highlighting the need for enhanced security measures and employee awareness training to mitigate such risks.
2 weeks ago
Kill Chain
GoldenEyeDog Subgroup's Infiltration of DigiCert: A Wake-Up Call for Digital Trust
In April 2026, DigiCert, a leading Certificate Authority, experienced a security breach attributed to the CylindricalCanine subgroup of the GoldenEyeDog cybercrime group. The attackers infiltrated DigiCert's internal support portal by compromising two support analyst workstations through a malicious screensaver file delivered via a customer chat channel. This access enabled them to issue 27 fraudulent Extended Validation (EV) Code Signing certificates, which were subsequently used to sign malware, notably the Zhong Stealer, facilitating its distribution and evasion of security measures. The incident underscores the critical vulnerabilities within trusted digital infrastructure and the potential for widespread impact when such systems are compromised. ([thehackernews.com](https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html?utm_source=openai)) This breach highlights a concerning trend of cybercriminals targeting Certificate Authorities to obtain legitimate certificates for malicious purposes. The use of social engineering tactics to exploit support channels emphasizes the need for enhanced security protocols and employee training to prevent similar incidents in the future.
2 weeks ago
Kill Chain
OpenSSL HollowByte Flaw: Critical DoS Vulnerability Discovered
In July 2026, a vulnerability named 'HollowByte' was discovered in OpenSSL, allowing unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers by sending a malicious 11-byte payload. This flaw causes the server to allocate significant memory for a message that never arrives, leading to potential service disruptions. The OpenSSL team has silently patched this vulnerability without assigning a CVE identifier or issuing an advisory. Organizations relying on OpenSSL for secure communications should prioritize updating to the latest patched versions to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the critical importance of timely patch management and the need for organizations to stay vigilant about silent fixes in widely used libraries. As cyber threats continue to evolve, ensuring that foundational security components like OpenSSL are up-to-date is essential to maintain robust defense mechanisms.
2 weeks ago
Kill Chain
ViteVenom: Unveiling the Blockchain-Powered Supply Chain Attack on Vite npm Packages
In July 2026, cybersecurity researchers identified a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. This campaign, dubbed ViteVenom, expanded upon the earlier ChainVeil attack by utilizing a sophisticated four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron, Aptos, and Binance Smart Chain. The attackers, attributed to the group SuccessKey, employed this infrastructure to deliver a remote access trojan (RAT) capable of reverse shell operations, credential harvesting, file exfiltration, and persistent backdoor injection. The malicious packages, published between June 29 and July 3, 2026, impersonated legitimate Vite packages, thereby deceiving developers into incorporating them into their projects. This incident underscores the escalating complexity and persistence of supply chain attacks, particularly those leveraging decentralized technologies to evade detection and takedown efforts. The use of blockchain for C2 infrastructure presents significant challenges for traditional security measures, highlighting the need for enhanced vigilance and advanced threat detection capabilities within the software development community.
2 weeks ago
Kill Chain
wp2shell: Critical WordPress Core Vulnerability Exposes Sites to Unauthenticated RCE
In July 2026, a critical vulnerability known as 'wp2shell' was discovered in WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. This flaw allowed unauthenticated remote code execution (RCE) via anonymous HTTP requests, making even default installations without plugins susceptible. The vulnerability was identified by Adam Kues of Searchlight Cyber and reported through WordPress's HackerOne program. In response, WordPress released emergency security updates—versions 6.9.5 and 7.0.2—on July 17, 2026, and initiated forced auto-updates to mitigate the risk. ([thehackernews.com](https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html?utm_source=openai)) The 'wp2shell' incident underscores the persistent threat of unauthenticated RCE vulnerabilities in widely used platforms. It highlights the critical importance of timely software updates and proactive security measures to protect against emerging exploits targeting core system functionalities.
2 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
