Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1287 threat reports
Page 16 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 181–192 / 1287 reports
Google's PageBreak AI Discovers 500 Critical Web App Vulnerabilities
Google's PageBreak AI Discovers 500 Critical Web App Vulnerabilities
Computer Software/Engineering1 month ago

Google's PageBreak AI Discovers 500 Critical Web App Vulnerabilities

Google's internal AI security agent PageBreak discovered over 500 cross-site scripting (XSS) vulnerabilities in the company's own web applications throughout 2026. The AI-powered tool, developed by Google's Product Security team, uses autonomous vulnerability discovery combined with deterministic validation to minimize false positives. PageBreak identified critical flaws including cache poisoning in apis.google.com, XSS in admin.google.com, and insecure external handshakes in browser extensions, all of which have been remediated. This incident highlights the growing trend of organizations using AI for offensive security testing and the critical importance of continuous security validation in enterprise applications, especially as AI-driven development accelerates and attack surfaces expand.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Apple iOS Automatic Reboot Security Bypass: GrayKey Preserve Vulnerability Analysis
Apple iOS Automatic Reboot Security Bypass: GrayKey Preserve Vulnerability Analysis
Law Enforcement1 month ago

Apple iOS Automatic Reboot Security Bypass: GrayKey Preserve Vulnerability Analysis

In late 2024, Magnet Forensics disclosed a vulnerability in Apple's iOS automatic reboot security feature through their GrayKey Preserve device and Evidence Preservation Mode. This exploit bypasses the 72-hour inactivity reboot mechanism that transitions iPhones into a more secure state, allowing forensic tools to maintain persistent access to device data indefinitely. The vulnerability affects iPhone's critical security boundary between Before First Unlock (BFU) and After First Unlock (AFU) states, potentially exposing sensitive user data including cached locations, recently deleted photos, and iMessages that would normally be purged after specific timeframes. This incident highlights the growing sophistication of mobile device exploitation techniques and the ongoing cat-and-mouse game between security researchers, law enforcement forensic capabilities, and privacy protections built into consumer devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
Banking/Mortgage1 month ago

AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything

In October 2026, South Korea's Financial Services Commission launched emergency investigations after AI-powered cyberattacks targeted multiple major financial institutions. Shinhan Bank suffered a breach affecting 25,000 customers, while Kookmin Bank lost credit card information for 119,000 clients, and Hana Bank experienced a limited compromise of its sales-support system. Evidence suggests attackers used ARTEX AI, an open-source penetration testing framework that automates vulnerability discovery and attack-path planning, marking one of the first confirmed uses of AI agents in large-scale financial sector breaches. This incident represents a critical inflection point as threat actors begin weaponizing AI automation tools for sophisticated attacks against high-value targets. The use of autonomous AI agents for reconnaissance and exploitation signals a new era of accelerated, intelligent cyber warfare that traditional security controls struggle to counter.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Critical Rejetto HFS Vulnerability Under Active Exploitation by China-Based Threat Actors
Critical Rejetto HFS Vulnerability Under Active Exploitation by China-Based Threat Actors
Information Technology/IT1 month ago

Critical Rejetto HFS Vulnerability Under Active Exploitation by China-Based Threat Actors

In October 2026, threat actors began actively exploiting CVE-2026-61500, a critical vulnerability in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The flaw stems from weak pseudo-random number generation using JavaScript's Math.random() for session cookie signing keys, enabling attackers to forge administrator sessions and achieve remote code execution. VulnCheck detected exploitation attempts by China-based threat actors targeting vulnerable U.S. systems just one day after proof-of-concept code was publicly released. Despite a patch being available since July 2026 in version 3.2.1, many organizations remain vulnerable due to delayed patching cycles. This incident highlights the growing sophistication of vulnerability research, as the flaw was originally discovered using Anthropic's Mythos AI model, demonstrating how artificial intelligence is accelerating both defensive research and offensive capabilities in cybersecurity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DShield Honeypot Intelligence Exposes Massive SSH Botnet Campaign
DShield Honeypot Intelligence Exposes Massive SSH Botnet Campaign
Information Technology/IT1 month ago

DShield Honeypot Intelligence Exposes Massive SSH Botnet Campaign

The SANS DShield honeypot network has captured extensive TTY logs revealing coordinated botnet activities targeting SSH services across the internet. Analysis of transaction ID f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 shows over 3,130 unique IP addresses executing identical crontab commands over a 90-day period, indicating a widespread automated attack campaign. These attacks demonstrate sophisticated credential stuffing and brute force techniques against SSH services, with attackers immediately attempting to establish persistence through scheduled tasks and lateral movement capabilities once gaining access to compromised systems. This research highlights the critical importance of SSH security as threat actors increasingly automate their initial access operations and demonstrate consistent post-compromise behaviors across diverse infrastructure targets.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Iranian Water System Attacks Expose Critical U.S. Infrastructure Vulnerabilities
Iranian Water System Attacks Expose Critical U.S. Infrastructure Vulnerabilities
Utilities1 month ago

Iranian Water System Attacks Expose Critical U.S. Infrastructure Vulnerabilities

In summer 2024, Iranian threat actors successfully compromised water infrastructure systems across 12 U.S. states, exploiting critical vulnerabilities in industrial control systems. The attackers primarily targeted exposed operational technology devices connected directly to the internet without proper network segmentation or access controls. This campaign demonstrated how 80% of U.S. water systems lack basic cyber hygiene, allowing adversaries to gain unauthorized access to critical infrastructure that serves millions of Americans. The incidents highlighted the fragmented nature of water sector cybersecurity, where approximately 49,000 systems operate with minimal federal oversight and insufficient technical defenses. This attack represents a escalating trend of nation-state actors specifically targeting U.S. critical infrastructure, following similar campaigns by China's Volt Typhoon group. The timing coincides with growing concerns about AI-enhanced cyber capabilities and the urgent need for comprehensive federal cybersecurity standards across water utilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
Banking/Mortgage1 month ago

RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats

RemoteThreat, a new offensive cybersecurity startup founded by Chris Thompson and Shawn Jones, emerged from stealth in 2025 with $7 million in pre-seed funding to revolutionize red team penetration testing. The platform leverages AI to help organizations test their defenses against increasingly sophisticated threats, moving beyond traditional three-week assessment models to provide scalable, real-time security validation. RemoteThreat builds custom tooling from scratch for each engagement, bypassing Tier 1 EDR solutions to simulate how nation-state actors and advanced ransomware groups operate in real environments. This development reflects the urgent evolution of offensive security testing as frontier AI models enable both defenders and attackers to operate at unprecedented speed and sophistication, fundamentally changing how organizations must approach cybersecurity validation.

Threat report

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security
Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security
Computer Software/Engineering1 month ago

Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security

In October 2026, threat actors compromised Microsoft's official X account, which has over 13 million followers, to execute a cryptocurrency pump-and-dump scheme promoting a fraudulent $Clippy token. The attackers hijacked the account to follow and repost content from impersonation accounts claiming the token had liquidity paired with Microsoft stock. Microsoft confirmed the unauthorized access, removed the malicious posts, secured the account, and disavowed any connection to cryptocurrency projects while threatening legal action against the perpetrators. This incident highlights the escalating trend of social media account takeovers targeting high-profile organizations for cryptocurrency fraud, following similar attacks on Microsoft India's account and the SEC's official X account that manipulated Bitcoin prices.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign
Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign
Banking/Mortgage1 month ago

Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign

The U.S. Treasury Department sanctioned eight members of Venezuelan gang Tren de Aragua in October 2026 for their role in sophisticated ATM jackpotting attacks that have stolen $40.73 million from U.S. financial institutions across over 1,500 incidents. Led by Anibal Alexander Canelon Aguirre ("Prometheus"), the criminal network deployed malware including Ploutus, ATMii, and GreenDispenser to force ATMs to dispense cash, then laundered proceeds through cryptocurrency addresses receiving $6.1 million in total inflows. The Treasury also designated seven TRON blockchain addresses linked to the operation, highlighting the gang's use of cryptocurrency for money laundering. This incident demonstrates the evolving threat landscape where traditional organized crime groups increasingly leverage sophisticated malware and cryptocurrency infrastructure to target critical financial infrastructure, requiring enhanced egress security controls and blockchain transaction monitoring.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure
Banking/Mortgage1 month ago

Critical RCE Flaw in SWIFT Banking Authentication Middleware Exposes Global Financial Infrastructure

In October 2026, researchers discovered a critical vulnerability (CVE-2026-18397) in Thales Group's SConnect browser extension, a hardware authentication middleware used by over 1 million users to access highly sensitive government and financial systems including SWIFT banking networks. The vulnerability allows attackers to perform drive-by remote code execution attacks in 6-10 seconds through malicious websites or iframes, bypassing cryptographic security checks due to improper RSA signature validation and buffer handling. The flaw enabled attackers to load malicious DLLs and achieve complete system compromise on systems used for global financial transfers and government operations. This incident highlights the growing risks in authentication middleware as organizations increasingly rely on hardware-based MFA for critical infrastructure. With SConnect reaching end-of-life status and the emergence of AI-assisted exploit development, legacy authentication systems face unprecedented threats that could impact global financial stability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FortiMail Zero-Day Exploit: How CVE-2026-104286 Bypasses Email Security
FortiMail Zero-Day Exploit: How CVE-2026-104286 Bypasses Email Security
Financial Services1 month ago

FortiMail Zero-Day Exploit: How CVE-2026-104286 Bypasses Email Security

A critical zero-day vulnerability (CVE-2026-104286) in Fortinet FortiMail has been actively exploited by threat actors to write arbitrary files on vulnerable systems. The flaw, scoring 9.8 on CVSS, affects FortiMail versions 7.2.0 through 8.0.1 and allows unauthenticated attackers to exploit path traversal and NULL byte injection weaknesses through crafted HTTP/HTTPS requests. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, with evidence of ongoing attacks targeting the IBE feature and management interfaces exposed to the internet. This incident highlights the growing trend of threat actors targeting enterprise email security appliances as initial access vectors, part of a broader campaign against network infrastructure devices that has also impacted Check Point, Cisco, F5, and Citrix products in recent months.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft
Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft
Computer/Network Security1 month ago

Critical Authorization Flaws Expose Meari IoT Cloud Platform to Device Manipulation and Data Theft

The Meari IoT Cloud Platform OpenAPI Service contains critical authorization flaws (CVE-2026-101104 and CVE-2026-96613) that allow authenticated users to manipulate device configurations and access sensitive device data without proper ownership verification. These vulnerabilities expose device credentials, owner details, network data, and telemetry information across all versions of the platform. Despite CISA's coordination attempts, Meari has not responded with remediation plans, leaving millions of IoT devices worldwide potentially vulnerable to unauthorized access and manipulation. This incident highlights the growing security challenges in IoT cloud platforms as threat actors increasingly target connected device ecosystems to establish persistence, steal credentials, and pivot into broader network infrastructures through compromised IoT devices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports