Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1287 threat reports
Page 17 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 193–204 / 1287 reports
The AI CVE Explosion: Why 2026's Nginx Vulnerabilities Weren't the Crisis They Seemed
The AI CVE Explosion: Why 2026's Nginx Vulnerabilities Weren't the Crisis They Seemed
Computer Software/Engineering1 month ago

The AI CVE Explosion: Why 2026's Nginx Vulnerabilities Weren't the Crisis They Seemed

In 2026, AI-assisted vulnerability research led to an 85% surge in CVE disclosures, with four heavily publicized Nginx vulnerabilities (nginx-rift, nginx-poolslip, nginx-quicburst, and CVE-2026-42533) appearing as critical remote code execution flaws. However, Bishop Fox's analysis revealed that all four required uncommon non-default configurations, with real-world prevalence ranging from 0.007% to 1 in 35,633 deployments. While AI tools excel at discovering bugs in obscure code paths, they disproportionately find vulnerabilities in rarely-enabled configurations, creating a flood of high-CVSS alerts with minimal actual impact. This trend reflects the broader challenge of AI-generated vulnerability noise overwhelming security teams, as automated tools can thoroughly audit code without prioritizing commonly deployed configurations. The disconnect between theoretical severity and practical exploitability highlights the critical need for defenders to assess configuration prevalence and real-world conditions when triaging AI-discovered CVEs.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Pentagon DMDC Breach Exposes Critical Gaps in Government Cybersecurity
Pentagon DMDC Breach Exposes Critical Gaps in Government Cybersecurity
Government Administration1 month ago

Pentagon DMDC Breach Exposes Critical Gaps in Government Cybersecurity

In October 2025, hackers exploited vulnerabilities in the Pentagon's Defense Manpower Data Center (DMDC) file-sharing systems, maintaining unauthorized access for nine months until July 2026. The breach compromised sensitive personal data of over 3 million individuals, including 2.8 million living military personnel and 294,000 deceased individuals. Stolen data included Social Security numbers, names, dates of birth, contact information, and military personnel records. The DMDC operates as a critical operational support center storing over 60 million records used for authorizing benefits and entitlements across multiple government entities. This incident highlights the escalating threat to government systems and critical infrastructure, occurring alongside other high-profile breaches like the FBI's FBIjobs.gov compromise by ShinyHunters. The extended dwell time demonstrates the sophisticated nature of modern attacks and the challenges in detecting unauthorized access to sensitive government databases.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Financial Services1 month ago

Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities

In September 2026, cryptocurrency exchange Bitget suffered a devastating $387.5 million theft when North Korean threat actors exploited a zero-day vulnerability in third-party security products. The attackers gained access to high-level internal credentials through compromised security appliances, beginning their infiltration as early as August 31, 2026. Using a customized tool specifically designed for Bitget's wallet system, the threat actors executed unauthorized withdrawals across 11 blockchains, bypassing existing risk controls and affecting assets including XRP, ETH, USDT, and others. This incident highlights the growing sophistication of supply chain attacks targeting cryptocurrency exchanges, with North Korean APT groups increasingly exploiting third-party vendor vulnerabilities to access high-value targets. The attack demonstrates the critical need for enhanced vendor risk management and zero-trust architectures as cryptocurrency platforms become prime targets for nation-state actors seeking to fund illicit activities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Computer/Network Security1 month ago

Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026

In October 2026, Google released Gemini 4 Argon, an advanced AI model with autonomous vulnerability discovery capabilities, to trusted cyber defenders through its Fairwind Program. The model demonstrates unprecedented ability to find, validate, and patch critical software vulnerabilities, including discovering a previously unknown critical healthcare software vulnerability affecting hospitals worldwide. Google plans to release a version without cyber guardrails to trusted defenders while implementing safeguards against misalignment and indirect prompt injections. This incident highlights the emerging dual-use nature of AI security tools, where advanced models capable of autonomous vulnerability discovery can be weaponized by malicious actors if proper controls aren't maintained, representing a new frontier in AI security risks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools
ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools
Information Technology/IT1 month ago

ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools

In October 2024, threat actors launched a sophisticated phishing campaign leveraging legitimate ScreenConnect remote access tools to compromise victim systems. The attack began with deceptive emails claiming fraudulent wire transfers, directing recipients to download a preconfigured ScreenConnect client executable. The malicious file, signed by ConnectWise LLC and configured to connect to attacker-controlled infrastructure, bypassed traditional security controls by appearing as legitimate remote monitoring software. This campaign highlights the growing trend of attackers weaponizing trusted RMM tools to establish persistent remote access while evading detection through legitimate code signing certificates. This incident reflects the increasing sophistication of social engineering attacks combined with the abuse of legitimate remote access tools, a tactic that has become prevalent across multiple threat actor groups targeting organizations of all sizes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security
How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security
Financial Services1 month ago

How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security

Bitget cryptocurrency exchange suffered a devastating $387.5 million theft in September 2026 when North Korean threat actors exploited zero-day vulnerabilities in two third-party security appliances. The attackers gained initial access on August 31, deployed web shells and malware on production wallet infrastructure, then executed the theft across multiple blockchains over a three-hour period on September 25. Investigations by SlowMist and Google Mandiant revealed the attackers compromised critical backend systems used to authorize cryptocurrency transactions, ultimately spoofing the exchange's withdrawal processes to move funds from hot and warm wallets. This incident highlights the escalating sophistication of supply chain attacks targeting cryptocurrency infrastructure, particularly as North Korean state-sponsored groups continue targeting crypto exchanges with advanced zero-day exploits and multi-stage attack methodologies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
First Autonomous AI Agent Breach: DIVD Zammad Zero-Day Attack Analysis
First Autonomous AI Agent Breach: DIVD Zammad Zero-Day Attack Analysis
Computer/Network Security1 month ago

First Autonomous AI Agent Breach: DIVD Zammad Zero-Day Attack Analysis

In September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) suffered a sophisticated breach through exploitation of two zero-day vulnerabilities in their Zammad ticketing system (CVE-2026-102489 and CVE-2026-102490). An autonomous AI agent executed the attack within seconds, achieving session hijacking, remote code execution, and root privilege escalation without human intervention. The AI agent performed lateral movement and data exfiltration autonomously, leaving detailed logs of its decision-making process that enabled DIVD to reconstruct the attack timeline. This incident represents a critical evolution in cyber threats, demonstrating how AI-powered autonomous attack systems can accelerate breach timelines from hours to seconds. As organizations increasingly adopt AI systems and attackers weaponize artificial intelligence for autonomous operations, traditional detection and response mechanisms face unprecedented challenges in matching machine-speed attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise
Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise
Computer/Network Security1 month ago

Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise

In September 2026, CISA disclosed nine critical vulnerabilities (CVE-2026-100291 through CVE-2026-100299) affecting Anjvision YSSD-RTMP-H5 streaming devices firmware version 3.3.2.4. The vulnerabilities include unauthenticated ONVIF endpoint access, OS command injection through hidden debug interfaces, lack of cryptographic verification for firmware updates, hardcoded cloud API credentials, and weak DES-based password encryption. These flaws could allow attackers to access sensitive information, execute system-level commands, or achieve full device compromise. Anjvision has not responded to CISA's mitigation requests, leaving users without vendor-provided fixes. This incident highlights the growing security crisis in IoT and ICS devices, where vendors consistently deploy products with fundamental security flaws and fail to provide timely remediation when vulnerabilities are discovered.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign
Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign
Computer Software/Engineering1 month ago

Threat Actors Weaponize ChatGPT Custom GPTs in Sophisticated ClickFix RAT Campaign

In September 2026, threat actors exploited ChatGPT Custom GPTs to create fake AI services that directed users to malicious Google Sites hosting ClickFix attacks. The campaign began with sponsored Google search results for "ChatGPT" leading to attacker-controlled Custom GPTs named "Plus 5.6." Victims were presented with fake service notices redirecting them to backup domains where fraudulent Cloudflare CAPTCHA checks prompted execution of malicious PowerShell commands. The attack deployed sophisticated RAT malware through DLL sideloading, encrypted payloads hidden in WAV files, and DNS-over-HTTPS C2 communication, infecting at least 40 users with comprehensive surveillance capabilities including screen capture, camera access, and file system exploration. This incident represents the latest evolution in AI platform abuse, following previous campaigns weaponizing shared AI conversations and Claude Artifacts. The attack demonstrates how legitimate AI services are increasingly exploited as trusted entry points for social engineering, highlighting the urgent need for enhanced security controls around AI platform features and user-generated content validation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities
Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities
Utilities1 month ago

Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities

Throughout summer 2024, water utilities across the United States faced a sustained campaign of cyberattacks primarily attributed to Iranian threat actors, targeting internet-exposed operational technology (OT) systems and programmable logic controllers (PLCs). The attacks exploited aging infrastructure built for durability rather than cybersecurity, with attackers gaining initial access through exposed OT systems, vulnerable PLCs, and compromised integrator connections. The incidents prompted the Water Information Sharing and Analysis Center (WaterISAC) to accelerate threat intelligence sharing and partner with Cyware to enhance sector-wide cyber defense capabilities. These attacks underscore the growing threat to critical infrastructure as nation-state actors increasingly target industrial control systems amid escalating global tensions. The incidents highlight the vulnerability of legacy OT environments and demonstrate how threat actors are exploiting the convergence of IT and OT networks to compromise essential services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
The DIVD AI Agent Attack: When Machines Hack Autonomously
The DIVD AI Agent Attack: When Machines Hack Autonomously
Computer/Network Security1 month ago

The DIVD AI Agent Attack: When Machines Hack Autonomously

In September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) suffered an unprecedented AI-driven cyberattack that marked a new evolution in autonomous threat capabilities. The attack began with exploitation of an undisclosed technical vulnerability, followed by deployment of an automated AI agent that conducted post-exploitation activities independently. The AI agent operated autonomously across DIVD's network, making real-time decisions at machine speed while leaving behind extensive evidence due to poor training and configuration. The attack was described as 'loud and very messy' with the agent interfering with its own operations and over-documenting its activities. This incident represents a critical inflection point as threat actors increasingly weaponize AI for autonomous network operations, demonstrating how machine-speed attacks can overwhelm traditional detection and response capabilities while creating new categories of unpredictable adversarial behavior.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Dutch Authorities Arrest Cybersecurity Professional in ShinyHunters Investigation
Dutch Authorities Arrest Cybersecurity Professional in ShinyHunters Investigation
Law Enforcement1 month ago

Dutch Authorities Arrest Cybersecurity Professional in ShinyHunters Investigation

On September 15, 2026, Dutch authorities arrested 24-year-old Pepijn van der Stap (aka Umbreon) from Amsterdam in connection with the notorious ShinyHunters cybercriminal group. Van der Stap, who was previously convicted in 2023 for data theft and extortion while working at cybersecurity firm Hadrian, was arrested again while still on probation and currently employed as offensive security lead at Neo Security. The arrest follows ShinyHunters' high-profile claim of breaching the FBI's job application site using CVE-2026-35273, though the group denies any connection to van der Stap. This incident highlights the growing trend of insider threats and the blurred lines between cybersecurity professionals and cybercriminals. With ransomware groups increasingly recruiting individuals with legitimate security backgrounds, organizations face heightened risks from trusted insiders who may leverage their privileged access and knowledge for malicious purposes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports