✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 865 to 876 of 5051
Critical FortiSandbox Vulnerabilities Exploited: Immediate Action Required
In June 2026, attackers began exploiting critical vulnerabilities in Fortinet's FortiSandbox, specifically CVE-2026-39808 and CVE-2026-39813. These flaws, disclosed and patched in April 2026, allow unauthenticated code execution and authentication bypass, respectively. Despite the availability of patches, threat actors have initiated attacks, potentially compromising systems that rely on FortiSandbox for threat analysis and detection. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808-cve-2026-25089/?utm_source=openai)) This incident underscores the persistent risk posed by unpatched vulnerabilities in critical security infrastructure. Organizations must prioritize timely application of security updates to mitigate such threats and maintain the integrity of their defense mechanisms.
1 month ago
Kill Chain
Kodak Data Breach 2026: ShinyHunters Extortion Group Claims Responsibility
In June 2026, Kodak confirmed a data breach after the ShinyHunters extortion group claimed responsibility for accessing over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data. The attackers threatened to leak the exfiltrated data if their demands were not met by June 18, 2026. Kodak engaged external cybersecurity experts and law enforcement to investigate the incident and mitigate potential threats to their systems and operations. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to multiple high-profile data breaches in 2026, including attacks on Oracle PeopleSoft servers and various universities. Organizations must enhance their cybersecurity measures to protect sensitive data and prevent similar breaches.
1 month ago
Kill Chain
Urgent: Patch Critical Joomla Plugin Vulnerability CVE-2026-48907 Now
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability in the Joomla Content Editor (JCE) plugin, identified as CVE-2026-48907. This flaw allowed unauthenticated attackers to create new editor profiles, leading to the upload and execution of arbitrary PHP code on affected servers. The JCE security team released version 2.9.99.6 to address this issue, urging immediate updates due to active exploitation and the availability of public exploit code. The urgency of this directive underscores the increasing trend of attackers targeting web application vulnerabilities to gain unauthorized access and control over systems. Organizations are reminded of the critical importance of timely patch management and continuous monitoring to mitigate such risks effectively.
1 month ago
Kill Chain
FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices
In June 2026, a significant data breach known as 'FortiBleed' exposed VPN credentials for approximately 73,000 Fortinet devices worldwide. Security researcher Bob Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords. The leaked data encompassed entries from major organizations such as Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, and State Grid. The breach was attributed to a Russian-speaking threat group that conducted extensive credential harvesting campaigns against FortiGate SSL VPN devices, leading to unauthorized access and potential lateral movement within affected networks. This incident underscores the escalating threat posed by sophisticated cyber actors targeting critical infrastructure through credential harvesting and exploitation of VPN vulnerabilities. Organizations are urged to implement robust security measures, including regular credential rotation, enforcement of multi-factor authentication, and continuous monitoring for unauthorized access attempts, to mitigate the risk of similar breaches.
1 month ago
Kill Chain
Meta's Instagram Account Takeover Incident: Lessons in AI Security
In April 2026, Meta disclosed a significant security incident affecting over 20,000 Instagram accounts. Attackers exploited a vulnerability in Instagram's AI-assisted account recovery tool, High Touch Support, to generate unauthorized password reset links. This flaw allowed them to bypass standard authentication measures, leading to unauthorized access to user accounts. The breach potentially exposed sensitive user data, including contact details, private messages, and linked services. Meta identified the issue on May 31, 2026, and took immediate steps to mitigate the vulnerability and notify affected users. This incident underscores the evolving tactics of cyber attackers who are increasingly targeting automated support systems to facilitate account takeovers. Organizations must enhance the security of their AI-driven tools and implement robust monitoring to detect and prevent such sophisticated attacks.
1 month ago
Kill Chain
Microsoft Defender 'RoguePlanet' Zero-Day Vulnerability (CVE-2026-50656)
In June 2026, a security researcher known as Nightmare-Eclipse publicly disclosed a zero-day vulnerability in Microsoft Defender, dubbed 'RoguePlanet'. This flaw, identified as CVE-2026-50656 with a CVSS score of 7.8, exploits a race condition within the Microsoft Malware Protection Engine, allowing attackers to escalate privileges to SYSTEM level on fully patched Windows 10 and 11 systems. The exploit's success rate varies across different machines, but when successful, it grants attackers full control over the affected system. Microsoft has acknowledged the vulnerability and is actively developing a security update to address the issue. ([securityweek.com](https://www.securityweek.com/microsoft-working-on-patch-for-rogueplanet-zero-day/?utm_source=openai)) The disclosure of 'RoguePlanet' underscores the ongoing challenges in securing endpoint protection tools, which are often targeted by attackers due to their deep integration with system processes. This incident highlights the critical need for organizations to implement robust security measures, including application allowlisting and continuous monitoring, to mitigate the risks associated with privilege escalation vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/?utm_source=openai))
1 month ago
Kill Chain
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
1 month ago
Kill Chain
Attacker Exploits Tailscale and OpenSSH for Persistent Access in French Automotive Business Breach
In April 2026, a French-speaking attacker, identified as 'Poisson,' infiltrated a small French automotive business. Utilizing a VBScript stager and PowerShell loader, he deployed the Havoc Demon agent in memory, avoiding disk detection. For persistence, he established scheduled tasks and injected shellcode into Explorer.exe. Notably, before his command-and-control (C2) server went offline, Poisson installed OpenSSH and Tailscale on a compromised machine, creating an independent access route. This allowed him to maintain control even after the C2 server was deactivated, leading to the theft of banking and email credentials. This incident underscores the evolving tactics of cybercriminals who leverage legitimate tools like Tailscale and OpenSSH to establish resilient backdoors. The use of such tools complicates detection and remediation efforts, highlighting the need for organizations to monitor for unauthorized installations and unusual network configurations.
1 month ago
Kill Chain
Cybercriminals Exploit Remote Access Tools in 2026 Attacks
Between January and March 2026, cybercriminals exploited legitimate remote access tools such as LogMeIn and ScreenConnect to gain unauthorized access to victim devices. These attacks, detailed in HP's Threat Insights Report, involved phishing emails that tricked users into installing these tools, allowing attackers to control systems without triggering security alerts. The abuse of trusted software enabled threat actors to blend malicious activities with normal IT operations, complicating detection and response efforts. This incident underscores a growing trend where attackers leverage legitimate remote monitoring and management (RMM) tools to establish persistent access and deploy malware. The increasing sophistication of such tactics highlights the need for organizations to enhance monitoring of software installations, enforce strict privilege controls, and update defenses to detect and prevent misuse of trusted applications.
1 month ago
Kill Chain
Understanding the HTTP/2 Bomb (CVE-2026-49975) Vulnerability
In June 2026, a critical denial-of-service vulnerability, CVE-2026-49975, known as the "HTTP/2 Bomb," was disclosed. This flaw exploits the HPACK compression and flow control features of the HTTP/2 protocol, allowing attackers to send minimal requests that rapidly exhaust server memory. Major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, are affected in their default configurations. The attack can be executed remotely without authentication, leading to immediate service disruptions. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai)) The discovery of this vulnerability underscores the evolving threat landscape, where attackers leverage protocol features to amplify attacks. Organizations must prioritize patching affected systems and consider implementing additional security measures, such as Web Application Firewalls (WAFs), to mitigate potential exploits. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai))
1 month ago
Kill Chain
Debate Erupts Over U.S. Ban on Anthropic's AI Models
In June 2026, the U.S. government issued an export control order restricting foreign nationals from accessing Anthropic's advanced AI models, Claude Fable 5 and Mythos 5, citing national security concerns. This led Anthropic to suspend the models' use for all customers to ensure compliance. The security community criticized the decision, arguing that it hampers defenders' access to crucial tools while doing little to prevent adversaries from developing similar capabilities. Experts highlighted that such restrictions might inadvertently accelerate the development of decentralized, open-source alternatives, potentially diminishing U.S. leadership in AI security. The incident underscores the delicate balance between national security and technological advancement, emphasizing the need for policies that support innovation while mitigating risks.
1 month ago
Kill Chain
FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices
In June 2026, a large-scale credential harvesting operation, dubbed 'FortiBleed,' targeted Fortinet firewalls and VPN gateways, compromising over 30,000 internet-facing devices across nearly 200 countries. The attackers, suspected to be Russian-speaking threat actors, utilized automated tools to collect and verify login credentials, exploiting weak or default passwords without leveraging any known Fortinet vulnerabilities. This campaign affected various sectors, including government, telecommunications, healthcare, education, financial services, and critical infrastructure, with significant concentrations in India and the United States. The operation underscores the critical importance of robust password policies and the implementation of multi-factor authentication to safeguard network security devices. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices?utm_source=openai))
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
