✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 769 to 780 of 5051
AIR's Experiment Unveils Critical Security Gaps in AI Agent Skill Marketplaces
In June 2026, security firm AIR conducted an experiment to highlight vulnerabilities in AI agent skill marketplaces. They created a fake AI agent skill named 'brand-landingpage,' which purported to assist users in building landing pages using Google's Stitch design tool. This skill was submitted to a popular skill marketplace and promoted via an Instagram ad, ultimately reaching approximately 26,000 agents, including those on corporate accounts. Notably, all security scanners tested by AIR marked the skill as safe. The payload was intentionally benign, merely collecting users' email addresses to demonstrate the ease with which malicious skills could bypass existing security measures. This incident underscores the pressing need for enhanced security protocols in AI agent skill ecosystems, as traditional trust signals such as GitHub stars and scanner verdicts proved insufficient in detecting potential threats. The reliance on external links within skills, which can be altered post-review, presents a significant risk, emphasizing the necessity for continuous monitoring and comprehensive vetting processes to safeguard against supply chain attacks in AI environments.
1 month ago
Kill Chain
FortiBleed: Unprecedented Credential Harvesting Targets FortiGate Firewalls
In June 2026, a Russian-speaking initial access broker initiated 'FortiBleed,' a large-scale credential-harvesting operation targeting over 430,000 FortiGate firewalls globally. The campaign involved deploying custom sniffers on compromised devices to capture cleartext and hashed credentials, which were then used to infiltrate Active Directory domains and other services. This incident underscores the critical need for organizations to secure their network devices, as attackers increasingly exploit firewall vulnerabilities to gain unauthorized access. The widespread impact of FortiBleed highlights the importance of regular security assessments and prompt patch management.
1 month ago
Kill Chain
Unveiling the World Cup 2026 Purchase Scam Tactics
In 2026, cybercriminals exploited the FIFA World Cup's global appeal by compromising legitimate websites to redirect users to fraudulent domains selling non-existent tickets and merchandise. This tactic involved embedding malicious code into high-ranking sites, enabling scammers to hijack organic search traffic without relying on paid advertisements. Victims, believing they were purchasing official products, not only lost money but also had their payment information stolen, leading to further unauthorized transactions. This incident underscores a growing trend where attackers leverage major events to deploy sophisticated scams, bypassing traditional detection methods. The use of compromised legitimate websites for redirection highlights the need for enhanced vigilance and security measures, especially during high-profile events that attract massive online traffic.
1 month ago
Kill Chain
Scattered Spider Hackers Plead Guilty in TfL Cyberattack
In August 2024, Transport for London (TfL) suffered a significant cyberattack orchestrated by the Scattered Spider hacking group, leading to the compromise of personal data for approximately 10 million individuals and causing substantial disruptions to TfL's online services. The attack, executed through sophisticated social engineering tactics, resulted in operational challenges and financial losses for the organization. ([livemint.com](https://www.livemint.com/news/world/transport-for-london-2024-hack-around-10-million-had-their-data-stolen-says-report-11772807389186.html?utm_source=openai)) The recent guilty pleas by key members of Scattered Spider underscore the persistent threat posed by cybercriminal groups employing advanced social engineering techniques. This incident highlights the critical need for organizations, especially those managing essential services, to enhance their cybersecurity measures and remain vigilant against evolving cyber threats.
1 month ago
Kill Chain
SIM Swap Attack Highlights Need for Enhanced Authentication Measures
In June 2026, Torsten George, a chief cybersecurity evangelist, experienced a SIM swap attack that led to an attempted account takeover. The attacker, posing as an AT&T representative, had previously conducted a SIM swap, allowing them to intercept one-time passwords (OTPs) sent via text. During a subsequent call, the attacker sought additional credentials to gain full access to George's AT&T account. Recognizing the threat, George acted swiftly to regain control, preventing unauthorized access. This incident underscores the vulnerabilities associated with SMS-based OTPs and highlights the need for multi-layered security measures. The resurgence of SIM swap attacks, as demonstrated in this case, emphasizes the importance of adopting more secure authentication methods, such as app-based OTPs or hardware tokens, to mitigate the risks of account takeovers.
1 month ago
Kill Chain
DifyTap Vulnerabilities: A Wake-Up Call for AI Platform Security
In June 2026, security researchers identified four critical vulnerabilities, collectively termed 'DifyTap,' in the Dify AI platform. These flaws—CVE-2026-41947, CVE-2026-41948, CVE-2026-41949, and CVE-2026-41950—allowed unauthorized access to sensitive data, including private AI chat histories and documents across tenants. Exploitation could lead to significant data breaches and compromise of AI applications. The DifyTap vulnerabilities underscore the escalating risks associated with AI platforms, emphasizing the need for robust security measures and prompt patch management to protect sensitive information and maintain trust in AI-driven services.
1 month ago
Kill Chain
Operation Endgame: Dismantling the SocGholish Malware Network
In June 2026, an international law enforcement operation, as part of Operation Endgame, dismantled the SocGholish malware framework by seizing 106 servers and remediating nearly 15,000 compromised WordPress websites. SocGholish, active since 2017, utilized traffic distribution systems (TDSs) to redirect users to fake browser updates, thereby gaining initial access to victims' networks. This access was often sold to cybercriminal groups like Evil Corp, facilitating ransomware deployments and espionage activities. The takedown significantly disrupted a major component of the cybercrime ecosystem, highlighting the critical role of TDSs in malware distribution. ([darkreading.com](https://www.darkreading.com/cyber-risk/socgholish-takedown-malicious-tds-threats?utm_source=openai)) The operation underscores the persistent threat posed by sophisticated social engineering tactics and the exploitation of legitimate web infrastructure. Organizations are reminded to maintain vigilant cybersecurity practices, including regular updates to content management systems, monitoring for unauthorized changes, and educating users about the risks of unsolicited software updates.
1 month ago
Kill Chain
FortiBleed: Massive Credential Exposure in Fortinet Firewalls
In June 2026, the 'FortiBleed' campaign emerged as a significant cybersecurity threat, compromising over 86,000 Fortinet FortiGate firewalls across 194 countries. Attackers utilized a Golang-based tool, FortigateSniffer, to exploit default credentials and weak password practices, turning these devices into passive credential collectors across 24 authentication protocols. This led to the exposure of approximately 110 million credentials, affecting major corporations and government agencies worldwide. The incident underscores the critical importance of robust password policies and the implementation of multi-factor authentication (MFA). Organizations are urged to review and enhance their security measures to prevent similar breaches, as reliance on default credentials and inadequate password management continue to be exploited by threat actors.
1 month ago
Kill Chain
Critical Vulnerabilities in Siemens SINEC INS: Immediate Action Required
In June 2026, Siemens disclosed multiple vulnerabilities in its SINEC INS software, versions prior to V1.0 SP2 Update 6. These vulnerabilities include improper input sanitization leading to OS command injection (CVE-2026-46746), path traversal (CVE-2026-46747), execution with unnecessary privileges (CVE-2026-46748), and the use of a one-way hash with a predictable salt (CVE-2026-46749). Exploitation of these flaws could allow attackers to execute arbitrary commands, access unintended file system locations, escalate privileges, and recover user passwords, potentially resulting in unauthorized access and control over affected systems. The disclosure underscores the critical importance of timely software updates and robust security practices in industrial control systems. Organizations utilizing SINEC INS are urged to upgrade to V1.0 SP2 Update 6 or later to mitigate these risks. This incident highlights the ongoing challenges in securing industrial networks against evolving cyber threats.
1 month ago
Kill Chain
Critical Vulnerability in Hubbell Aclara Metrum Cellular Web Interface (CVE-2026-1840)
In June 2026, a critical vulnerability (CVE-2026-1840) was identified in the Hubbell Aclara Metrum Cellular Web Interface, affecting versions prior to v2.1.0.105. This flaw allows unauthorized access to critical system functions due to missing authentication controls, enabling attackers to alter device configurations and disrupt operations, potentially leading to loss of communications. The vulnerability poses significant risks to the energy sector, particularly in the United States, where these devices are widely deployed. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1740?utm_source=openai)) The incident underscores the importance of robust authentication mechanisms in industrial control systems. With increasing cyber threats targeting critical infrastructure, organizations must prioritize timely firmware updates and implement comprehensive security measures to mitigate such vulnerabilities.
1 month ago
Kill Chain
ABB Freelance Security Lock Vulnerability CVE-2025-7064
In June 2026, a vulnerability identified as CVE-2025-7064 was disclosed in ABB's Freelance Security Lock software. This authentication bypass flaw allows attackers to access underlying Windows OS functions even when Freelance Operations is active, depending on system configuration and user permissions. Affected versions include Freelance through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, and 2024. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-7064?utm_source=openai)) The vulnerability has a CVSS score of 6.6, indicating a medium severity level. While no active exploitation has been reported, organizations using the affected versions should assess their exposure and apply patches as recommended by ABB. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-7064?utm_source=openai))
1 month ago
Kill Chain
Siemens Discloses Critical Vulnerability in WinCC Certificate Manager
In June 2026, Siemens disclosed a vulnerability (CVE-2026-24349) in the WinCC Certificate Manager component of SIMATIC WinCC Unified PC Runtime versions 16 through 21 (prior to V21 Update 2). The flaw involves insufficient protection of cryptographic key material, potentially allowing attackers with local access to extract sensitive information. Siemens has released an update for version 21 and recommends upgrading to V21 Update 2 or later. For earlier versions, no fixes are planned, and users are advised to implement specific countermeasures. This incident underscores the critical importance of securing cryptographic key material, especially in industrial control systems. Organizations should prioritize updating affected systems and apply recommended mitigations to prevent potential exploitation.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
