Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1287 threat reports
Page 8 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 85–96 / 1287 reports
BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign
BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign
Government Administration2 weeks ago

BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign

In early 2026, a Chinese state-sponsored threat actor attributed with medium confidence to APT41 (also known as Brass Typhoon) deployed a novel UEFI bootkit called BlackX against diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploited the long-known Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys, then loaded a kernel driver signed with a revoked certificate to disable Kaspersky and Avast security processes, tamper with Event Tracing for Windows, and deploy a cloud-hosted RAT using Google Drive, OneDrive, and Yandex.Disk for command-and-control alongside the obfuscated OxiDLLRunner payload framework. BlackX highlights a persistent and dangerous gap in enterprise patching hygiene: Microsoft's fix for CVE-2022-21894 requires administrators to manually trigger Secure Boot revocations after patch installation—a step nearly universally skipped. With APT41 actively weaponizing firmware-level persistence and the October 2026 expiration of the Windows Production PCA 2011 certificate not automatically blocking vulnerable binaries, organizations face renewed urgency to audit bootloader revocation status across their fleets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode
PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode
Computer/Network Security2 weeks ago

PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode

In October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'PHP2Shell'—were disclosed with a CVSS v4.0 score of 9.2. Discovered by infosec firm Calif and analyzed by WatchTowr, both flaws allow unauthenticated attackers to execute arbitrary code on web servers simply by reaching them over the network. An embargo break led to early publication of a proof-of-concept tool, accelerating attacker reconnaissance while defenders scrambled to patch or mitigate across Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments. Active exploitation attempts were observed in the wild within hours of disclosure. The PHP2Shell incident echoes Log4Shell in scope and urgency, underscoring the fragility of open source supply chains and the disproportionate risk carried by under-resourced organizations—schools, municipalities, and nonprofits—that lack dedicated security staff but run PHP-based infrastructure extensively exposed to the internet.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
Information Technology/IT2 weeks ago

CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-110447 (CVSS 9.2), an OS command injection flaw in Collabora Online's Built-in CODE Server enabling remote code execution via proxy.php on Nextcloud platforms, and CVE-2026-114625 (CVSS 9.9), an SQL injection vulnerability in Arista VeloCloud Orchestrator allowing remote attackers with only read-only access to reach privileged internal functionality. Active exploitation of CVE-2026-110447 involved web shell implantation on Nextcloud servers followed by credential harvesting, while CVE-2026-114625 exploitation was traced to two IP addresses geolocated to Japan, marking the third VeloCloud vulnerability weaponized since July 2026. This incident underscores an accelerating pattern of critical infrastructure and SD-WAN orchestration platforms being targeted through high-CVSS injection vulnerabilities. With three VeloCloud flaws actively exploited within a four-month window, attackers are systematically probing network management planes—raising the stakes significantly for organizations relying on these platforms for hybrid and multi-cloud connectivity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet
Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet
Government Administration2 weeks ago

Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet

Between November 2025 and March 2026, Dutch firm Eye Security discovered that the abandoned Time4Popcorn application—a legacy fork of the popular piracy client Popcorn Time—contained a background updater (CVE-2026-30612, CVSS 9.8) that phoned home over unencrypted HTTP to unregistered domains, installed payloads at SYSTEM/root privilege without signature verification, and exposed an estimated 2.5–3 million Windows machines and up to 350,000 Macs to silent takeover. Eye registered the abandoned domains, confirmed inbound traffic from government, military, and corporate networks, and—finding no vendor to patch the software—pushed over 2 million benign disabling updates under Operation IXIM, reducing active call-home traffic by 98 percent before transferring domain custody to Shadowserver in March 2026. This incident illustrates a growing supply-chain blind spot: software that organizations never formally adopted—installed by employees on personal or corporate devices—can harbor persistent, privileged execution channels years after the original vendor disappears, creating botnet-ready infrastructure at scale without any malicious actor needing to write a single line of exploit code.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack
One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack
Computer Software/Engineering2 weeks ago

One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack

In May 2026, a LiteLLM Agent Platform master key was accidentally committed to a public GitHub repository and never revoked. On October 10, 2026, an unknown threat actor exploited this unrevoked credential to access the Agent Platform, extract a broadly scoped GitHub CLI OAuth token belonging to an organization owner, and harvest secrets from internal CI/CD workflows via malicious cache.yml files pushed to short-lived throwaway branches. On October 21, the attacker redirected the release pipeline to a lookalike repository and published the backdoored LiteLLM 1.107.0 to PyPI, Docker Hub, and GHCR—delivering a credential-stealing infostealer and persistent Python backdoor to downstream users across the AI developer ecosystem. This incident exemplifies the compounding risk of a single unrevoked secret in an AI-native supply chain: one leaked master key cascaded into organization-wide repository access, CI/CD pipeline hijack, and mass credential exfiltration targeting AI API keys, cloud credentials, and developer tool tokens. As agentic AI frameworks become critical infrastructure, secrets hygiene and pipeline integrity controls are emerging as top-tier enterprise security priorities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE
Government Administration2 weeks ago

CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE

A critical remote code execution vulnerability (CVE-2026-30612) was discovered in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, affecting an estimated 3 million Windows and 350,000 macOS devices. The flaw resided in the app's auto-updater, which contacted an expired domain over unencrypted HTTP and accepted unsigned executables—enabling anyone who registered the domain to push arbitrary code with SYSTEM-level or root privileges. Researchers at Eye Security registered the abandoned update domain and 14 related domains, then used the same vulnerable mechanism to deploy remediation payloads that disabled the updater across approximately 2 million devices between November 2025 and March 2026. Connections originated not only from residential ISPs but also from corporate, government, and military networks, amplifying the potential blast radius significantly. This incident exemplifies the growing threat of abandoned-software supply-chain attacks, where unpatched updaters tied to expired domains become persistent, low-cost entry points. As organizations accumulate shadow IT and forgotten consumer applications on managed endpoints, adversaries increasingly scout lapsed domains as cheap vectors for mass exploitation—making software lifecycle governance and egress traffic enforcement critical defensive priorities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Computer Software/Engineering2 weeks ago

Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.

In October 2026, Ruby disclosed three critical bugs in Onigmo, its built-in regular expression engine, that collectively enabled four remote code execution vulnerabilities in GitLab—two rated CVSS 9.9 and two rated a perfect 10.0. GitLab compiles user-supplied regex patterns in features such as CI/CD configuration, and a specially crafted pattern could corrupt memory during compilation, granting an unauthenticated attacker full code execution on GitLab's servers. The unauthenticated flaws, CVE-2026-97229 and CVE-2026-110264, affect every GitLab version from 7.0 onward. Patched Ruby builds (4.0.9, 3.4.12, 3.3.13) and corresponding GitLab releases (19.5.1 down to 18.11.13) were shipped between September 23 and October 21, 2026. This incident highlights a systemic supply-chain risk: a single language-level regex engine flaw propagated into multiple critical application CVEs. As DevSecOps pipelines rely heavily on Ruby-based tooling and GitLab-hosted workflows, organizations must treat upstream language runtime patches with the same urgency as direct application patches, and implement inline traffic inspection to detect exploitation attempts before patches can be applied.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week
When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week
Retail Industry2 weeks ago

When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week

In September 2026, a Chinese-speaking threat actor deployed three agentic AI frameworks — Hermes, Strix, and Cairn — against 105 e-commerce targets over five days, compromising at least 27 organizations, including a Fortune 500 company. The autonomous system stole more than 600,000 payment card records, planted credit-card skimmers on five sites, and gained unauthorized access across the remainder, all at an average cost of $25.46 per completed target. Parallel research by Silverfort demonstrated that a publicly available Claude Opus agent could escalate initial access to full domain control in eight minutes for roughly $12, confirming that agentic AI has industrialized the entire attack chain. This campaign signals a structural shift in the threat landscape: autonomous AI eliminates the skilled-attacker bottleneck, collapsing marginal attack costs to near zero. With initial-access prices on dark markets already falling from $1,400 to $429, and ransomware activity up 45% in 2026 despite fewer ransom payments, the economics now decisively favor attackers — demanding that defenders rethink architecture, not just tooling.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
Information Technology/IT2 weeks ago

PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins

In October 2024, SANS Internet Storm Center elevated its Infocon alert level in response to a critical PHP vulnerability affecting a broad range of web-facing applications, embedded devices, and appliances. The flaw—tied to PHP's session.upload_progress mechanism—enabled remote code execution, prompting coordinated disclosure across vendors including Cloudflare and Amazon, both of which reported large volumes of exploit attempts in the wild. Although no fully weaponized public exploit was confirmed at time of publication, security researchers warned that working exploit code was imminent. Patches were issued by php.net and major vendors, but incomplete coverage of embedded and legacy devices left significant attack surface exposed. This incident highlights a growing pattern of critical web-runtime vulnerabilities being exploited before organizations can fully patch their environments. The coordinated disclosure process succeeded, yet unpatched embedded devices and delayed enterprise patch cycles continue to represent systemic risk—underscoring why network segmentation and east-west traffic controls are essential backstops when software updates cannot be applied immediately.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ThreatsDay October 2026: AI Secrets Leak, PingCAP Source Code Theft, Signal Hang-Up Flaw, Laravel Auth Bypass, and SafePay Ransomware's 600+ Victims
ThreatsDay October 2026: AI Secrets Leak, PingCAP Source Code Theft, Signal Hang-Up Flaw, Laravel Auth Bypass, and SafePay Ransomware's 600+ Victims
Financial Services2 weeks ago

ThreatsDay October 2026: AI Secrets Leak, PingCAP Source Code Theft, Signal Hang-Up Flaw, Laravel Auth Bypass, and SafePay Ransomware's 600+ Victims

In the week of October 22, 2026, a sweeping multi-vector threat bulletin exposed simultaneous incidents across credential theft, supply-chain compromise, AI/GenAI abuse, ransomware, and critical vulnerability exploitation. PingCAP confirmed stolen service-account credentials enabled exfiltration of TiDB Cloud source code and customer records between September 9 and October 7, 2026. Zeabur announced shutdown after plaintext-credential abuse exposed 3.2 million environment variable records and 321,810 accounts. SafePay ransomware surpassed 600 victims since 2024 by chaining known edge-device CVEs with lateral movement and data exfiltration. A critical Laravel TokenGuard bypass (CVE-2026-114509, CVSS 9.2), a Signal RingRTC hang-up flaw (CVE-2026-113380, CVSS 9.3), and a NVIDIA AIStore Kubernetes host-takeover flaw (CVE-2026-65162, CVSS 10.0) compounded organizational risk across cloud, messaging, and container infrastructure. These incidents reflect a maturing attacker playbook: stolen credentials unlock supply-chain footholds, unpatched edge-device vulnerabilities feed ransomware pipelines, and AI-layer weaknesses — from biased code generation to prompt-injection via ChatGPT GitHub Connectors — are becoming primary attack surfaces. Regulatory and intelligence pressure is intensifying, with U.S. agencies banning DeepSeek from federal systems and releasing joint rogue-AI containment guidelines, signaling that AI governance is now a frontline security imperative.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
eMudhra's PKI Collapse: How Trivially Weak CA Keys Triggered a 30,000-Certificate Crisis
eMudhra's PKI Collapse: How Trivially Weak CA Keys Triggered a 30,000-Certificate Crisis
Higher Education/Acadamia2 weeks ago

eMudhra's PKI Collapse: How Trivially Weak CA Keys Triggered a 30,000-Certificate Crisis

In October 2026, Indian certificate authority eMudhra announced its exit from the global SSL/TLS certificate business after a researcher discovered that eight of its intermediate CA private keys were trivially guessable—each below the integer value 256 rather than the cryptographically large random numbers required. Disclosed on October 17, 2026 to Apple, Google, Microsoft, Mozilla, and eMudhra, the flaw prompted Chrome and Firefox to distrust the emSign ECC Root CA - G3 root within hours, affecting approximately 30,800 unexpired certificates—99.9% of them issued through InCommon, the Internet2 certificate service serving U.S. higher education institutions. eMudhra acknowledged it never used the weak keys to issue end-entity certificates, and that no systems were breached, but compounding concerns emerged around a 2025 incident in which invalid CRLs were signed with the same flawed keys, raising serious transparency questions. This incident underscores a systemic risk in the public PKI ecosystem: a single trusted CA's key-management failure can cascade to tens of thousands of relying parties overnight. With browser vendors accelerating root-store governance and higher-education institutions now scrambling to replace certificates, organizations must treat CA trustworthiness and certificate lifecycle automation as critical infrastructure concerns, not administrative afterthoughts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
QPACK Zero-Days: How a Single UDP Packet Can Crash Your HTTP/3 Infrastructure
QPACK Zero-Days: How a Single UDP Packet Can Crash Your HTTP/3 Infrastructure
Information Technology/IT2 weeks ago

QPACK Zero-Days: How a Single UDP Packet Can Crash Your HTTP/3 Infrastructure

In October 2026, security firm FoxIO disclosed critical QPACK header-compression flaws affecting seven of ten HTTP/3 server stacks tested, releasing working proof-of-concept exploit code. An unauthenticated remote attacker can send a small compressed HTTP header batch that expands up to 4,000-fold in server memory, crashing affected servers with a single UDP connection. Impacted stacks include quic-go (CVE-2025-64702), Cloudflare quiche (CVE-2026-12523), lsquic, Bun, the h3 Rust library, and aioquic. Bun carries the worst-case scenario: a 516 KB payload triggers an integer overflow leading to 100% CPU lock with no recovery. Patches exist for quic-go, Cloudflare quiche, lsquic, and Wireshark, but Bun, h3, and aioquic remain unpatched as of disclosure. This disclosure follows the HTTP/2 "MadeYouReset" denial-of-service research and signals a broader trend of protocol-layer amplification attacks targeting modern cloud-native infrastructure. As HTTP/3 adoption accelerates across CDNs, API gateways, and edge runtimes, unpatched stacks present an immediate availability risk to internet-facing services operating without protocol-aware traffic inspection or egress controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports