✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1033 to 1044 of 5077
Miasma Worm's 2026 Attack on Microsoft: A Wake-Up Call for Supply Chain Security
In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm compromised 73 of its GitHub repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously stolen credentials to inject malicious code into these repositories, leading to widespread disruptions in continuous integration and deployment (CI/CD) workflows globally. This incident underscores the escalating threat of self-replicating malware targeting trusted software supply chains. The Miasma worm's ability to exploit AI coding tools and integrated development environments (IDEs) highlights a concerning evolution in attack vectors, emphasizing the need for enhanced security measures in development environments to prevent similar breaches in the future.
1 month ago
Kill Chain
Microsoft Exchange 'Ghost-Sender' Vulnerability Exposes Organizations to Email Spoofing Attacks
In June 2026, researchers identified a vulnerability in Microsoft Exchange, termed 'Ghost-Sender,' allowing attackers to spoof emails from any sender to organizations using Exchange Online or on-premises in hybrid mode with third-party mail servers. This flaw enables malicious actors to bypass SPF, DKIM, and DMARC policies, delivering emails directly to users' inboxes without warnings. The misconfiguration is widespread, with evidence of active exploitation in the wild. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/exchange-flaw-attackers-spoof-email-address?utm_source=openai)) The 'Ghost-Sender' vulnerability underscores the critical need for organizations to review and secure their email configurations. With attackers actively exploiting this flaw, immediate action is required to implement recommended mitigations and prevent potential phishing attacks, fraud, and unauthorized access facilitated through email spoofing.
1 month ago
Kill Chain
Microsoft's June 2026 Patch Tuesday: A Record 206 Vulnerabilities Addressed
In June 2026, Microsoft released a record-breaking Patch Tuesday update addressing 206 vulnerabilities across its product suite. This unprecedented volume underscores the accelerating pace of vulnerability discovery, largely driven by advancements in artificial intelligence. Notably, the update includes critical remote code execution flaws in core Windows components, such as HTTP.sys and the DHCP Client service, which could allow unauthenticated attackers to achieve full system compromise without user interaction. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-june-2026/?utm_source=openai)) The surge in identified vulnerabilities highlights the dual-edged nature of AI in cybersecurity. While AI enhances defensive capabilities, it also enables faster and more efficient discovery of software flaws, potentially outpacing traditional remediation efforts. Organizations must adapt by integrating AI-driven tools into their security workflows and enhancing their patch management processes to keep pace with this evolving threat landscape.
1 month ago
Kill Chain
RoguePlanet Zero-Day Exploit Targets Microsoft Defender
On June 10, 2026, the security researcher known as Nightmare-Eclipse publicly disclosed a zero-day vulnerability in Microsoft Defender, termed 'RoguePlanet.' This exploit leverages a race condition to grant SYSTEM-level privileges on fully patched Windows 10 and Windows 11 systems. The proof-of-concept code was released shortly after Microsoft's Patch Tuesday updates, which addressed previous vulnerabilities disclosed by the same researcher. The RoguePlanet disclosure underscores ongoing tensions between independent security researchers and major software vendors regarding vulnerability disclosure practices. The incident highlights the critical need for organizations to implement robust security measures and maintain vigilance against emerging threats, even on systems considered up-to-date.
1 month ago
Kill Chain
ServiceNow Security Incident: Unauthenticated API Access Exposes Customer Data
In early June 2026, ServiceNow identified a security vulnerability within its platform, where an unauthenticated API endpoint allowed unauthorized access to customer data. The flaw, present since at least April 2026, was actively exploited by attackers between June 2 and June 3, 2026. ServiceNow applied a security update on June 5, 2026, to remediate the issue. The vulnerability primarily affected customers on the Australia platform release and earlier versions with specific configurations. The exact scope of data accessed remains undisclosed, but potential exposure includes sensitive information such as IT service tickets, internal documentation, and employee records. ([techcrunch.com](https://techcrunch.com/2026/06/10/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet/?utm_source=openai)) This incident underscores the critical importance of timely vulnerability management and the potential risks associated with delayed patching. Organizations relying on third-party platforms must ensure robust security measures and maintain vigilance over their data security practices to mitigate such risks.
1 month ago
Kill Chain
Escalation of TeamPCP Supply Chain Attacks: A Wake-Up Call for Cybersecurity
In early June 2026, the TeamPCP supply chain campaign escalated with two significant developments. First, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added key vulnerabilities associated with the campaign to its Known Exploited Vulnerabilities catalog on May 27, 2026, and issued a standalone advisory the following day, highlighting compromises in Nx Console and GitHub repositories. Second, the open-sourced Mini Shai-Hulud framework led to widespread exploitation, notably the 'Miasma' attack on June 1, 2026, which compromised numerous @redhat-cloud-services npm packages, and the 'Phantom Gyp' variant on June 3, 2026, affecting additional packages. These incidents underscore the campaign's transition into a phase where its techniques are being adopted by a broader range of threat actors, extending beyond the original operators. This escalation highlights the critical need for organizations to enhance their supply chain security measures. The rapid adoption of the Mini Shai-Hulud framework by various attackers indicates a growing trend of sophisticated supply chain attacks, emphasizing the urgency for proactive defense strategies and continuous monitoring to mitigate potential risks.
1 month ago
Kill Chain
cURL Ends Bug Bounty Program Amid AI-Generated Reports
In January 2026, the cURL project, a widely-used open-source data transfer tool, terminated its bug bounty program due to an overwhelming influx of low-quality, AI-generated vulnerability reports. This surge, often referred to as 'AI slop,' inundated the project's maintainers, making it challenging to identify genuine security issues. The decision underscores the unintended consequences of AI tools in cybersecurity, where the ease of generating plausible but inaccurate reports can strain limited resources and hinder effective vulnerability management. This incident highlights a growing trend where AI-generated content disrupts traditional cybersecurity processes. Organizations must adapt by implementing more robust validation mechanisms and reconsidering incentive structures to mitigate the impact of such low-quality submissions.
1 month ago
Kill Chain
Microsoft's June 2026 Patch Tuesday: A Record-Breaking Security Update
On June 9, 2026, Microsoft released its largest Patch Tuesday update to date, addressing 206 vulnerabilities across its product suite, including Windows, Office, Azure, and more. Among these, 33 were classified as critical, with three zero-day vulnerabilities publicly disclosed prior to the release. Notably, CVE-2026-49160, a denial-of-service vulnerability related to the HTTP/2 protocol, was patched to prevent potential server disruptions. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-june-2026/?utm_source=openai)) This unprecedented volume of patches underscores the increasing complexity and interconnectivity of modern software ecosystems, highlighting the necessity for organizations to maintain rigorous patch management practices to mitigate emerging threats effectively.
1 month ago
Kill Chain
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2026-20245, an improper encoding vulnerability in Cisco Catalyst SD-WAN Manager; CVE-2026-11645, an out-of-bounds read and write flaw in Google Chrome's V8 engine; and CVE-2026-7473, an incomplete comparison vulnerability in Arista's Extensible Operating System (EOS). These vulnerabilities could allow attackers to execute arbitrary code or process unauthorized tunnel traffic, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by actively exploited flaws in widely used software and hardware. Organizations are urged to apply the necessary patches or mitigations promptly to safeguard their systems against potential attacks.
1 month ago
Kill Chain
CISA Highlights Active Exploitation of Three New Vulnerabilities
On June 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2026-7473 affecting Arista's Extensible Operating System, CVE-2026-11645 in Google Chromium's V8 engine, and CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. These vulnerabilities pose significant risks to federal enterprises, as they are commonly targeted by malicious cyber actors. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks against active threats.
1 month ago
Kill Chain
Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild
In March 2026, a critical path traversal vulnerability (CVE-2026-5027) was identified in Langflow, an open-source platform for building AI applications. This flaw allows unauthenticated attackers to write files to arbitrary locations on the server's filesystem, potentially leading to remote code execution. Despite multiple disclosure attempts by Tenable, the vulnerability remains unpatched, and active exploitation has been observed in the wild. The exploitation of CVE-2026-5027 underscores a growing trend of attackers targeting AI development tools and infrastructure. Organizations utilizing Langflow should prioritize implementing mitigations, such as disabling unauthenticated auto-login and monitoring for suspicious activity, to protect their systems from potential compromise.
1 month ago
Kill Chain
NSO Group's Continued Targeting of WhatsApp Users Despite Legal Prohibitions
In June 2026, WhatsApp identified and disrupted a spear-phishing campaign linked to the NSO Group, a spyware firm previously barred by a court order from targeting WhatsApp users. The attackers attempted to deceive users into clicking malicious links leading to external websites, aiming to install spyware on their devices. This incident follows a 2019 campaign where NSO exploited a WhatsApp vulnerability to target approximately 1,400 users, leading to a lawsuit and a permanent injunction against NSO. ([techcrunch.com](https://techcrunch.com/2026/06/08/whatsapp-says-it-caught-new-spyware-attacks-linked-to-nso-group-in-violation-of-court-order/?utm_source=openai)) The recurrence of such attacks underscores the persistent threat posed by spyware firms and highlights the challenges in enforcing legal restrictions against them. Organizations must remain vigilant and proactive in defending against sophisticated phishing and spyware campaigns that continue to evolve despite legal deterrents.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
