✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Flowise 2026 RCE Vulnerability Exploitation
In April 2026, security researchers identified active exploitation of a critical remote code execution (RCE) vulnerability, CVE-2025-59528, in Flowise, an open-source platform for building AI agents and large language model (LLM) workflows. This flaw, residing in the CustomMCP node, allows attackers to execute arbitrary JavaScript code without security validation, leading to potential full system compromise. Despite a patch being available since September 2025, many instances remain unpatched, exposing organizations to significant risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/?utm_source=openai)) The exploitation of this vulnerability underscores the persistent threat posed by unpatched software in widely used AI development tools. Organizations leveraging Flowise must prioritize immediate updates to mitigate potential breaches and safeguard sensitive data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/?utm_source=openai))
3 months ago
Kill Chain
APT28's 2025 DNS Hijacking Campaign: A Wake-Up Call for Network Security
In 2025, the Russian state-sponsored cyber group APT28, also known as Fancy Bear, exploited vulnerabilities in MikroTik and TP-Link routers to conduct a large-scale DNS hijacking campaign. By compromising these routers, APT28 redirected internet traffic through attacker-controlled servers, enabling adversary-in-the-middle attacks that harvested credentials from web and email services. This operation targeted a broad range of victims, including organizations linked to the UK Ministry of Defence and NATO logistics contractors, posing significant risks of credential theft, data manipulation, and broader network compromise. ([ncsc.gov.uk](https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations?utm_source=openai)) This incident underscores the critical importance of securing network infrastructure against sophisticated state-sponsored threats. The exploitation of widely used routers highlights the need for organizations to implement robust security measures, including regular firmware updates, strong authentication protocols, and continuous monitoring to detect and mitigate such attacks.
3 months ago
Kill Chain
Fortinet's 2026 Unauthenticated API Access Bypass: A Critical Security Alert
In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted API requests. The vulnerability was actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise customers to apply them immediately. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The incident underscores the persistent targeting of Fortinet products by threat actors, highlighting the importance of timely patch management and vigilant monitoring of security advisories to mitigate risks associated with zero-day vulnerabilities. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))
3 months ago
Kill Chain
Fortinet FortiClientEMS 2026 Improper Access Control Vulnerability
In April 2026, Fortinet disclosed a critical improper access control vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests, leading to potential remote code execution and privilege escalation. The vulnerability has been actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise immediate patching to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent targeting of Fortinet products by threat actors. Organizations are urged to apply the provided hotfixes promptly and monitor their systems for any signs of compromise to maintain robust security postures. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))
3 months ago
Kill Chain
Fortinet's FortiClient EMS Zero-Day Vulnerability Exploited in 2026
In early April 2026, Fortinet disclosed a critical zero-day vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS), which was actively exploited in the wild. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted requests. Fortinet released an emergency hotfix for versions 7.4.5 and 7.4.6, with plans for a comprehensive patch in version 7.4.7. The vulnerability was added to CISA's known exploited vulnerability catalog, highlighting its severity and widespread impact. The rapid exploitation of CVE-2026-35616 underscores a growing trend of attackers targeting zero-day vulnerabilities in widely used security solutions. Organizations must remain vigilant, ensuring timely application of patches and hotfixes to mitigate such threats. This incident also emphasizes the importance of robust access controls and continuous monitoring to detect and respond to unauthorized activities promptly.
3 months ago
Kill Chain
pcTattletale's 2024 Data Breach: A Cautionary Tale in Cybersecurity
In May 2024, pcTattletale, a U.S.-based spyware application, suffered a significant data breach when a hacker infiltrated its servers, defaced its website, and exposed sensitive data, including customer information and victim data. The breach was facilitated by exploiting vulnerabilities that allowed unauthorized access to the company's Amazon Web Services account, leading to the exposure of over 300 million screenshots captured from victims' devices. Following the incident, pcTattletale's founder, Bryan Fleming, announced the company's immediate shutdown, stating that all data had been deleted to prevent further exposure. This breach underscores the inherent risks associated with spyware applications, particularly their potential to compromise user privacy and security. The incident also highlights the growing scrutiny and legal actions against developers and distributors of such software, emphasizing the need for robust security measures and ethical considerations in software development.
3 months ago
Kill Chain
Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required
In April 2026, a critical vulnerability (CVE-2026-35616) was discovered in Fortinet's FortiClient Enterprise Management Server (EMS). This flaw allowed unauthenticated attackers to bypass authentication controls and execute arbitrary code via specially crafted requests. Fortinet released emergency hotfixes to address the issue, urging immediate application to prevent exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch affected systems by April 9, 2026, highlighting the significant risk posed by this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-fortinet-flaw-exploited-in-attacks-by-friday/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent threat of zero-day vulnerabilities in widely used enterprise solutions. Organizations are reminded of the critical importance of timely patch management and proactive security measures to mitigate such risks.
3 months ago
Kill Chain
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.
3 months ago
Kill Chain
Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required
In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Enterprise Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allows unauthenticated attackers to execute arbitrary code or commands via specially crafted requests. The vulnerability was actively exploited in the wild, prompting Fortinet to release emergency patches and advise immediate application of hotfixes or upgrading to version 7.4.7 upon its release. This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely patch management. Organizations are reminded to maintain robust security practices, including regular software updates and monitoring for unauthorized activities, to mitigate risks associated with such critical flaws.
3 months ago
Kill Chain
Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required
In early April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests, effectively bypassing API authentication and authorization mechanisms. The vulnerability has been actively exploited in the wild, prompting Fortinet to release out-of-band hotfixes and advise customers to upgrade to version 7.4.7 upon its release. ([thehackernews.com](https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html?utm_source=openai)) The exploitation of CVE-2026-35616 underscores a growing trend of attackers targeting management interfaces to gain elevated privileges within enterprise environments. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their network infrastructure to mitigate potential breaches.
3 months ago
Kill Chain
Drift Protocol's $285 Million Loss: A Wake-Up Call for Crypto Security
On April 1, 2026, Drift Protocol, a Solana-based decentralized exchange, suffered a significant security breach resulting in the theft of approximately $285 million in various cryptocurrencies. The attackers employed a sophisticated social engineering campaign over six months, culminating in the compromise of administrative controls through the exploitation of durable nonces. This allowed them to manipulate governance mechanisms and execute unauthorized transactions, leading to substantial financial losses and operational disruption for Drift Protocol. This incident underscores the escalating threat posed by state-sponsored cyber actors, particularly those from the Democratic People's Republic of Korea (DPRK), who have increasingly targeted the cryptocurrency sector to fund national programs. The attack highlights the critical need for robust operational security measures, including stringent access controls and vigilant monitoring of administrative activities, to mitigate the risks associated with social engineering and insider threats.
3 months ago
Kill Chain
European Commission's 2026 Supply-Chain Breach: A Wake-Up Call for Cybersecurity
In March 2026, the European Commission's cloud infrastructure hosting the Europa.eu platform was compromised through a supply-chain attack orchestrated by the cybercriminal group TeamPCP. The attackers exploited a vulnerability in the Trivy security tool to gain unauthorized access to the Commission's Amazon Web Services (AWS) environment. This breach led to the exfiltration of approximately 92 GB of compressed data, including personal information such as names, email addresses, and email content. Subsequently, the data extortion group ShinyHunters published the stolen data on their dark web leak site. The incident affected not only the European Commission but also at least 29 other Union entities utilizing the Europa.eu web hosting service. ([cert.europa.eu](https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain?utm_source=openai)) This breach underscores the escalating threat posed by supply-chain attacks, where vulnerabilities in third-party tools can serve as entry points for malicious actors. Organizations must enhance their cybersecurity measures, particularly in monitoring and securing their software supply chains, to mitigate such risks.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports