Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1287 threat reports
Page 10 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 109–120 / 1287 reports
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
Government Administration2 weeks ago

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

In October 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Plex Media Server (four CVEs covering SSRF, URI scheme injection, and path traversal), EG Secure Solutions SiteGuard Server Edition (OS command injection), and Siemens Software Center (uncontrolled search path element). These vulnerabilities collectively enable attackers to achieve initial access, remote code execution, and full system control. Federal agencies operating under BOD 26-04 face mandatory remediation timelines, while CISA urges all organizations to prioritize patching these high-risk flaws across publicly exposed assets before threat actors can leverage pre-patch compromise windows. This catalog addition reflects a sustained attacker focus on commercial media platforms, enterprise security gateways, and industrial software distribution infrastructure. The breadth of affected vendors—consumer-grade to OT-adjacent—signals that ransomware groups and nation-state actors are actively scanning for unpatched instances, making rapid remediation and network segmentation critical defensive priorities across all sectors.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack
One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack
Information Technology/IT2 weeks ago

One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack

In October 2024, an unidentified threat actor exploited a compromised multi-tenant API secret tied to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to Microsoft 365 environments across hundreds of customer tenants. The attacker leveraged the stolen credential to bypass MFA, perform Microsoft Graph API reconnaissance, elevate privileges, and implant persistent backdoor credentials in affected tenants. Huntress confirmed successful sign-ins across more than 300 Entra tenants, with 162 verified compromises. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services roughly two days after initial attack activity was observed on October 15, 2024. This incident exemplifies the systemic risk of shared multi-tenant application secrets in managed service provider ecosystems. A single compromised credential cascaded into hundreds of downstream customer breaches, underscoring how supply-chain trust relationships and privileged API access can become force-multipliers for attackers targeting SMB-focused MSP platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now
GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now
Computer Software/Engineering2 weeks ago

GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now

In October 2026, OVHcloud disclosed that its open-source CLI tool hosted on GitHub was backdoored by the GlassWorm threat actor after attackers compromised a developer's GitHub account that had been silently controlled since at least March 2026. Versions 0.11.0 through 0.15.0 were trojanized with an infostealer designed to harvest secrets stored on disk. The malicious releases were live for approximately 94 minutes before detection following a customer report. GitHub's release immutability feature had been disabled, allowing tampered binaries to bypass CI/CD pipelines entirely. Affected platforms include macOS, Linux, and Windows, and all secrets on exposed machines should be treated as compromised. This incident underscores a growing and sophisticated pattern in supply-chain attacks where threat actors target developer tooling ecosystems—GitHub, npm, VSCode, and OpenVSX—to silently poison trusted distribution channels. With GlassWorm active since late 2025 and expanding its targeting scope, organizations relying on open-source CLI tools and package managers face escalating credential-theft risk with minimal detection windows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Zeabur's Fatal Second Breach: How Plaintext Credentials and Unrotated Tokens Brought Down a Cloud Platform
Zeabur's Fatal Second Breach: How Plaintext Credentials and Unrotated Tokens Brought Down a Cloud Platform
Information Technology/IT2 weeks ago

Zeabur's Fatal Second Breach: How Plaintext Credentials and Unrotated Tokens Brought Down a Cloud Platform

In October 2026, cloud developer platform Zeabur suffered its second major security breach within two months. Attackers leveraged plaintext administrator credentials and cloud access keys—likely stolen during a prior August 2026 breach—to compromise shared hosting clusters across nine global regions, 321,810 user accounts, and approximately 3.2 million environment-variable records. Threat actors gained root access to 101 GCP servers, added SSH keys to 50 servers, and attached 16 customer disk copies to attacker-controlled virtual machines. The root cause included unrotated admin tokens created in January 2024, publicly accessible admin portals, and credentials stored in plaintext. Following this second breach, Zeabur announced a full platform shutdown by December 31, 2026. This incident highlights an accelerating pattern of credential-reuse attacks targeting cloud-native developer platforms. As organizations consolidate infrastructure on shared PaaS environments, unrotated secrets, plaintext credential storage, and overly permissive admin interfaces create compounding blast radii. Regulatory scrutiny of cloud platform providers is intensifying, making credential hygiene and zero-trust segmentation urgent priorities across the industry.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet
eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet
Financial Services2 weeks ago

eMudhra CA Key Compromise: How a Single PKI Failure Triggered Emergency Patches Across the Internet

On October 17, 2026, a researcher identified as Wayne discovered that the private keys for eight eMudhra intermediate certificate authority (CA) certificates had been compromised, enabling any holder to issue fraudulently trusted TLS and code-signing certificates for any website or software. Chrome blocked the six TLS intermediates within 100 minutes of receiving the report; Firefox followed within hours via OneCRL. Because no rogue certificates appeared in Certificate Transparency logs, no active exploitation was confirmed, but the supply-chain risk was severe. Emergency patches were released across Go, Firefox, NSS, Python certifi, Rust webpki-roots, and Homebrew. Mozilla subsequently removed the eMudhra root from NSS, and Chrome began reviewing removal of eMudhra's remaining root. This incident highlights the systemic fragility of the public key infrastructure (PKI) supply chain: a single CA key compromise can cascade across every browser, runtime, and application that trusts that root. With intermediate CA keys exposed and revocation mechanisms unreliable across non-browser runtimes, organizations relying on TLS for encrypted traffic validation face silent trust failures—directly amplifying risks of undetected data exfiltration and adversary-in-the-middle attacks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack
One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack
Information Technology/IT2 weeks ago

One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack

In October 2026, ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product (formerly SkyKick), a SaaS solution serving managed service providers (MSPs). A threat actor used compromised API credentials to authenticate into Microsoft 365 Entra tenants across more than 1,000 organizations, with over 300 successful sign-ins confirmed by third-party researchers at Huntress and Todyl. The attacker escalated privileges to Global Administrator in at least two tenants and planted persistent backdoor credentials. ConnectWise responded by disabling Cloud Backup, SaaS Security, and Cloud Management services while engaging an incident response firm and revoking compromised certificates. This incident exemplifies the accelerating risk of supply-chain credential abuse targeting MSP platforms. Attackers increasingly exploit the trusted, high-permission relationships between SaaS vendors and their downstream customers, turning a single compromised vendor identity into a master key across hundreds of enterprise Microsoft 365 environments—amplifying blast radius far beyond what a direct breach would achieve.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam
Financial Services2 weeks ago

Inside Help TDS: How a Russian Affiliate Network Built an Industrial-Scale Microsoft Impersonation Scam

Since at least 2017, a Russian-language affiliate network called Hotejka has operated Help TDS, a malicious traffic distribution system that routes victims to Microsoft-impersonation tech support scams. Researchers at Infoblox infiltrated the affiliate panel and confirmed the platform serves over a dozen criminal affiliates—including known malware operations Balada Injector and DollyWay—redirecting compromised web traffic to fake Windows security alerts. Victims are socially engineered into installing remote desktop tools such as UltraViewer, granting threat actors persistent, repeated access to their systems. Over 20,000 malicious Cloudflare Pages domains were detected across a six-month period, with C2 infrastructure rolling over every five minutes via Telegram. This operation illustrates how commodity social engineering infrastructure has industrialized at scale, combining legitimate CDN abuse, dark-web affiliate models, and remote access tooling to enable long-term victim exploitation far beyond simple credit card fraud.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
Oil/Energy/Solar/Greentech2 weeks ago

When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform

In October 2026, CISA published ICS Advisory ICSA-26-280-01 disclosing seven vulnerabilities in CISA Malcolm, the agency's own open-source network traffic analysis and ICS security monitoring platform. Reported by Seth Grover of Idaho National Laboratory, the flaws span authentication bypass via nginx regex spoofing (CVE-2026-107336), hardcoded credentials enabling direct Arkime backend access (CVE-2026-107361), SSRF through an unmodified FilePond PHP component (CVE-2026-107362), RBAC bypass via URL path normalization inconsistency (CVE-2026-107333), cross-site request forgery enabling forensic log destruction (CVE-2026-107337), percent-encoding authorization bypass (CVE-2026-107334), and a gzip-bomb denial-of-service (CVE-2026-107335). Collectively these vulnerabilities expose critical-infrastructure operators—in Energy, IT, and Water sectors worldwide—to unauthenticated access, privilege escalation, lateral movement, and destruction of forensic evidence. The compromise of a security-monitoring tool itself represents an acute supply-chain and defense-evasion risk. As ICS/OT environments deepen their dependence on network-visibility platforms, adversaries now actively target the monitoring layer—blinding defenders while moving laterally through operational technology networks, a tactic increasingly observed in critical-infrastructure threat campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer
OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer
Information Technology/IT2 weeks ago

OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer

On October 19, 2026, attackers hijacked a contributor's GitHub account and silently replaced download archives across five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious binary designed to steal secrets stored on disk. The tampered files were live for up to 94 minutes before a customer's hash-pinning CI job detected the discrepancy and filed a public issue. The attack exploited the absence of GitHub's immutable-release setting, allowing anyone with repository write access to overwrite existing release artifacts without triggering the CI/CD pipeline. Affected users on macOS, Linux x86_64/arm64, and Windows x86_64 who installed or auto-upgraded during the window were advised to rotate all credentials immediately. This incident highlights a deepening supply-chain threat targeting developer toolchains: attackers are increasingly compromising trusted contributors rather than the build pipeline itself, bypassing conventional CI/CD controls. The campaign has been tentatively linked to GlassWorm, a threat actor known for hiding loader code in Unicode characters and abusing blockchain memo fields for C2 staging, signaling a sophisticated, multi-stage offensive posture against open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
Information Technology/IT2 weeks ago

ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants

In October 2026, ConnectWise disclosed a supply-chain credential compromise in which threat actors exploited a vendor application credential to gain unauthorized access to application identities tied to its Cloud Backup service. First identified on October 14, the attackers used a single compromised vendor credential from IP 144.172.64.128 to perform application sign-ins across thousands of Microsoft 365 tenants. Post-compromise activity included self-granting Global Administrator rights and backdooring additional applications with new secrets for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, reset credentials, and engaged third-party incident responders. Huntress telemetry across 10,000-plus tenants confirmed the scope. This incident underscores the accelerating threat of supply-chain credential abuse targeting managed service providers. As attackers increasingly pivot through trusted vendor relationships to reach downstream customers at scale, the ConnectWise breach exemplifies why identity hygiene, least-privilege application permissions, and real-time cross-tenant visibility have become non-negotiable security controls for MSP ecosystems in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack
Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack
Computer Software/Engineering2 weeks ago

Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack

On October 20, 2026, the Go team issued an emergency security release (versions 1.27.3 and 1.26.10) that hard-codes a block on eight intermediate certificate authority public keys linked to Indian CA eMudhra's emSign brand. Programs rebuilt against the new releases will refuse TLS connections and reject code signatures whose chains pass through any of the eight blocked keys—six TLS intermediates and two code-signing intermediates—under emSign Root TLS CA - G3 and emSign Root CS CA - G3. Mozilla independently added six related eMudhra certificates to its OneCRL revocation list two days prior. The Go team classified the fix on its URGENT track, reserved for active ecosystem-integrity threats, but has disclosed no specific misbehavior, leaving operators of Go-based services to reissue certificates immediately or face broken connectivity. This incident underscores an accelerating pattern of browser and runtime vendors taking unilateral, emergency action against certificate authorities without public disclosure—compressing the remediation window for enterprises that depend on affected PKI chains and highlighting how supply-chain trust decisions made in CA root programs ripple instantly into production software deployments worldwide.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
Information Technology/IT2 weeks ago

CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE

In October 2026, Fortinet disclosed CVE-2026-106173, a critical path traversal vulnerability in FortiSIEM (CVSS 9.4) affecting versions up to 7.5.0. Unauthenticated attackers can connect to the gRPC service on TCP port 27918, exploit unsafe path construction in the SendQueryResult() function, and chain a null-byte injection technique to overwrite arbitrary files—including a Redis health-check shell script executed every 60 seconds by a cron job—achieving full unauthenticated remote code execution. Horizon3.ai published a public proof-of-concept exploit within days of patching, dramatically lowering the bar for exploitation across all unpatched FortiSIEM deployments. The public release of a working PoC transforms this from a theoretical risk into an active, weaponizable threat. Security operations platforms like FortiSIEM are high-value targets because compromising them can blind defenders, disrupt incident response, and provide attackers with privileged visibility into an organization's entire security telemetry—amplifying blast radius far beyond a typical application breach.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports