✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 697 to 708 of 5051
Critical Vulnerability in pydicom's pynetdicom Library Exposes Healthcare Systems
In June 2026, a critical vulnerability (CVE-2026-56445) was identified in the pydicom pynetdicom library, specifically affecting versions from 1.0.0 up to and including 3.0.4. This flaw resides in the qrscp application's C-STORE handler, which improperly handles attacker-supplied DICOM datasets, allowing unauthenticated attackers to write files to arbitrary paths on the server. The vulnerability poses significant risks, particularly to the healthcare sector, as it could lead to unauthorized data manipulation or system compromise. The maintainers of pynetdicom have not yet released a fix for this vulnerability. Organizations utilizing affected versions are advised to restrict network exposure of the qrscp DICOM port (default 11112) to trusted peers, implement firewall protections, and monitor for updates from the project's repository. This incident underscores the importance of securing medical imaging software against potential cyber threats.
1 month ago
Kill Chain
Critical Security Flaws Discovered in H.VIEW HV-500S6 IP Cameras
In June 2026, two critical vulnerabilities were identified in the H.VIEW HV-500S6 IP Camera, specifically in firmware version IPCAM_V4.06.88.251229. CVE-2026-55975 allows authenticated users to execute arbitrary commands with elevated privileges by injecting unsanitized XML fields into the device's certificate generation interface. CVE-2026-56414 permits authenticated users to upload arbitrary files without validation, potentially compromising system integrity. Exploitation of these vulnerabilities could lead to unauthorized access and control over the affected devices. The discovery of these vulnerabilities underscores the growing security challenges in IoT devices, particularly those deployed in critical infrastructure sectors. Organizations must prioritize regular security assessments and firmware updates to mitigate such risks.
1 month ago
Kill Chain
Critical SSRF Vulnerability in OHIF DICOM Web Viewer Framework (CVE-2026-12473)
In June 2026, a critical vulnerability (CVE-2026-12473) was identified in the OHIF DICOM Web Viewer Framework versions up to 3.12.0. This Server-Side Request Forgery (SSRF) flaw allowed attackers to steal authenticated clinicians' OIDC Bearer tokens via crafted links, potentially granting unauthorized access to sensitive patient data. The issue stemmed from two data sources—DICOMWebProxy and DICOMJSON—fetching arbitrary URL parameters without validation, leading to token exposure when requests were sent to attacker-controlled servers. ([hipaajournal.com](https://www.hipaajournal.com/high-severity-vulnerability-identified-in-ohif-viewers-dicom/?utm_source=openai)) The vulnerability was addressed with the release of version 3.12.2 on May 18, 2026. Users are strongly advised to upgrade to this version or later to mitigate the risk. This incident underscores the critical importance of validating external inputs and implementing robust security measures in healthcare applications to protect sensitive information. ([machinespirits.com](https://www.machinespirits.com/advisory/0a7f3c/?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerability in Delta Electronics DTM Soft: CVE-2026-12578
In June 2026, Delta Electronics' DTM Soft was found to have a critical vulnerability (CVE-2026-12578) involving the deserialization of untrusted data. This flaw allows attackers to execute arbitrary code by exploiting the software's handling of project files. The vulnerability affects all versions of DTM Soft, posing significant risks to systems utilizing this software. The discovery of this vulnerability underscores the ongoing challenges in securing industrial control systems, especially those integral to critical manufacturing sectors. Organizations are urged to apply the recommended mitigations promptly to prevent potential exploitation.
1 month ago
Kill Chain
CISA Adds Two Known Exploited Vulnerabilities to Catalog
On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager. These vulnerabilities are actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize remediation of such high-risk vulnerabilities to protect their networks against active threats. While BOD 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to update the catalog as new vulnerabilities are identified.
1 month ago
Kill Chain
Russian Intelligence Services' Phishing Campaigns Targeting Messaging Apps in 2026
In March 2026, the FBI and CISA issued a Public Service Announcement warning of ongoing phishing campaigns by Russian Intelligence Services (RIS) targeting commercial messaging applications (CMAs) such as Signal and WhatsApp. These campaigns aim to compromise individual user accounts by impersonating official support channels and tricking users into sharing verification codes or personal information. High-value targets include U.S. government officials, military personnel, political figures, and journalists. Once access is gained, attackers can view messages, contact lists, and conduct further phishing attacks. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260626?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors employing social engineering tactics to bypass encryption and gain unauthorized access to sensitive communications. The rise in such targeted phishing campaigns highlights the need for heightened vigilance and robust security practices among users of CMAs.
1 month ago
Kill Chain
Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations
In June 2026, cybersecurity firms were targeted by a sophisticated social engineering campaign dubbed 'Poisoned Tenant.' Threat actors created fraudulent OpenAI ChatGPT organizations impersonating legitimate companies and sent authentic-looking invitations to employees, urging them to join these fake tenants. Upon acceptance, employees were granted administrative privileges, potentially exposing sensitive company information. The attackers utilized OpenAI's legitimate notification system, making the invitations appear credible and bypassing standard email security measures. This incident underscores the evolving tactics of cyber adversaries who exploit trusted platforms to execute social engineering attacks. The use of legitimate services to deliver malicious content highlights the need for organizations to enhance their security awareness training and implement robust verification processes for unsolicited invitations, even when they appear to originate from trusted sources.
1 month ago
Kill Chain
Urgent Patching Required for Exploited Cisco and PTC Vulnerabilities
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to urgently patch two critical vulnerabilities: CVE-2026-20230 in Cisco Unified Communications Manager (Unified CM) and CVE-2026-12569 in PTC's Windchill and FlexPLM products. CVE-2026-20230 is a server-side request forgery (SSRF) flaw that allows unauthenticated remote attackers to write files to the operating system, potentially leading to root privilege escalation. CVE-2026-12569 is a remote code execution (RCE) vulnerability arising from the deserialization of untrusted data, affecting multiple versions of Windchill and FlexPLM. Both vulnerabilities were actively exploited, prompting CISA to set a remediation deadline of June 28, 2026. The urgency of these patches underscores the increasing sophistication and frequency of cyberattacks targeting critical infrastructure. Organizations must prioritize timely vulnerability management and adopt proactive security measures to mitigate risks associated with such exploits.
1 month ago
Kill Chain
Polymarket Supply-Chain Attack Results in $3 Million Theft
In June 2026, Polymarket, a leading cryptocurrency-based prediction market platform, suffered a supply-chain attack resulting in the theft of approximately $3 million from its customers. Attackers compromised a third-party vendor, injecting malicious JavaScript into Polymarket's frontend. This script deceived users into approving fraudulent transactions, leading to unauthorized fund transfers. The platform's backend infrastructure remained unaffected, and Polymarket has committed to fully reimbursing the impacted users. This incident underscores the escalating threat of supply-chain attacks targeting financial platforms. As cybercriminals increasingly exploit third-party dependencies to infiltrate systems, organizations must enhance their security measures and conduct thorough audits of their supply chains to mitigate such risks.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Computer/Network Security
1 month ago
Kill Chain
FBI Issues Alert on Russian Hackers Targeting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued a warning about a sophisticated phishing campaign by Russian intelligence services targeting Signal users. The attackers impersonated Signal support teams, sending messages that prompted users to enable backups and share their 64-character recovery keys. With these keys, the attackers could decrypt victims' entire message histories, compromising sensitive communications. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and key officials in Ukraine. This incident underscores the evolving tactics of state-sponsored cyber actors and highlights the critical importance of user vigilance against social engineering attacks. The exploitation of backup recovery keys represents a significant escalation in phishing techniques, emphasizing the need for robust security practices and user education to prevent unauthorized access to encrypted communications.
1 month ago
Kill Chain
Chinese APT CL-STA-1062's Deployment of TinyRCT Backdoor in Southeast Asia
In 2025, the Chinese-speaking advanced persistent threat (APT) group CL-STA-1062 targeted government entities and critical infrastructure in Southeast Asia, focusing on state-owned enterprises in the energy and government sectors. The attackers employed a hybrid toolkit, including common open-source tools like SoftEther VPN and Mimikatz, alongside a newly developed backdoor named TinyRCT. This backdoor facilitated arbitrary command execution, file exfiltration, screen capture, and included a self-destruct mechanism to erase forensic evidence. The campaign involved initial access through web application exploitation, deployment of ASPX web shells, and subsequent reconnaissance and lateral movement within the compromised networks. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/?utm_source=openai)) This incident underscores the evolving sophistication of APT groups in developing custom malware to infiltrate critical infrastructure. The use of TinyRCT highlights the need for organizations to enhance their detection capabilities and implement robust security measures to defend against such advanced threats.
1 month ago
Kill Chain
FBI Issues Warning on Russian Hackers Exploiting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued an updated warning regarding Russian intelligence phishing campaigns targeting Signal users. Attackers impersonated Signal support, sending messages that prompted users to share their Backup Recovery Keys under the guise of preventing data loss. Once obtained, these keys allowed attackers to restore backups, access private messages, and take over accounts. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and Ukrainian officials. This incident underscores the evolving tactics of nation-state actors in exploiting legitimate features of secure messaging apps through social engineering. The focus on high-profile individuals highlights the strategic nature of the campaign, emphasizing the need for heightened vigilance and robust security practices among potential targets.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
