Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 84 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 997–1008 / 1289 reports
Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026
Financial Services9 months ago

Fortinet FortiCloud Auth Bypass: Patched Firewalls Remain at Risk in 2026

In January 2026, Fortinet confirmed the existence of a critical authentication bypass (CVE-2025-59718) affecting its FortiCloud SSO feature, leaving fully patched devices vulnerable to compromise. Attackers exploited a patch bypass to gain administrative access, quickly creating VPN-enabled accounts and exfiltrating firewall configurations. Despite an earlier advisory, threat actors continued to exploit an unaddressed attack path, with the campaign becoming automated and impacting organizations globally. Evidence included unauthorized logins and suspect account creation, prompting urgent investigation and forensic response from network teams. This breach illustrates the growing risk posed by incomplete patches and the relentless pursuit by attackers of residual vulnerabilities, particularly in widely deployed network security products. It underscores the critical need for continuous monitoring, rapid patch validation, and limiting administrative access to sensitive management interfaces.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)
Computer Software/Engineering9 months ago

AI-Generated Code Exposes New Honeypot Security Risks at Intruder (2026)

In January 2026, Intruder Security revealed an application security vulnerability in their intentionally vulnerable honeypot, stemming from AI-generated code that mishandled client-supplied IP headers. The AI-assisted system incorrectly trusted IP values in HTTP headers without enforcing a trust boundary, allowing attackers to inject payloads or spoof source IP information. This oversight, undetected by common static analysis tools, resulted in attacker-controlled inputs influencing system logic, posing potential risks for local file disclosure or server-side request forgery had the vulnerable code path been used differently. While the actual impact remained low due to the isolated nature of the honeypot, the incident highlights significant gaps in current AI-assisted development and security review processes. This event underscores the growing prevalence of AI-generated vulnerabilities and the limitations of automated security tools in identifying nuanced flaws. As enterprises increasingly rely on AI-driven coding and automation, such oversights are likely to become more common, emphasizing the need for robust validation and updated security governance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
US ATM Jackpotting 2024: Venezuelan Hackers Steal Hundreds of Thousands Using Malware
Banking/Mortgage9 months ago

US ATM Jackpotting 2024: Venezuelan Hackers Steal Hundreds of Thousands Using Malware

In early 2024, federal prosecutors in South Carolina uncovered a sophisticated ATM jackpotting scheme perpetrated by two Venezuelan nationals. Employing financial malware, the attackers compromised U.S. bank ATM networks and extracted hundreds of thousands of dollars in cash. The scheme involved the unauthorized installation of malware on ATM machines, which enabled the criminals to override withdrawal limits and rapidly dispense large sums of money. Following their arrest, both individuals were convicted and will be deported after serving their sentences, highlighting significant vulnerabilities in ATM security and network segmentation. This incident reflects a growing trend in financial crime, where cybercriminals target banking infrastructure using advanced malware and physical access techniques. Regulators and banks are increasingly focused on hardening ATM systems and tightening controls to prevent similar attacks as cyber-enabled fraud remains a persistent and evolving threat.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fortinet 2026 Breach: Authentication Bypass Leads to Firewall Configuration Theft
Financial Services9 months ago

Fortinet 2026 Breach: Authentication Bypass Leads to Firewall Configuration Theft

In January 2026, Fortinet FortiGate devices became the target of a coordinated cyberattack exploiting an authentication bypass vulnerability (CVE-2025-59718) associated with the FortiCloud SSO feature. Attackers accessed vulnerable firewalls, created rogue administrative accounts, and swiftly exfiltrated firewall configuration data using automated tools, demonstrating significant threat actor sophistication. Reports indicated the campaign began on January 15, 2026, and quickly escalated as even patched devices were compromised—suggesting a patch bypass or incomplete remediation. Affected organizations faced exposure of sensitive security configurations and heightened risk of follow-on breaches or lateral movement within their networks. This incident spotlights the urgent challenges posed by cloud-exposed assets and incomplete vulnerability remediation. It emphasizes the criticality of rapid patch cycles, zero trust principles, and robust monitoring amid a trend of identity and configuration–focused attacks targeting enterprise infrastructure platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Tesla and Leading Automakers Hacked at Pwn2Own Automotive 2026: 37 Zero-Days Uncovered
Automotive9 months ago

Tesla and Leading Automakers Hacked at Pwn2Own Automotive 2026: 37 Zero-Days Uncovered

In January 2026, security researchers at the Pwn2Own Automotive competition in Tokyo successfully exploited 37 zero-day vulnerabilities across flagship automotive technologies, including Tesla's infotainment system, multiple EV chargers, and in-vehicle digital receivers. The Synacktiv team achieved root access on the Tesla Infotainment System through chained vulnerabilities involving an information leak and out-of-bounds write flaw via USB. Other researchers compromised systems from Sony, Alpitronic, Autel, Kenwood, and Phoenix Contact. The event demonstrates the breadth of exploitable attack surfaces even in patched, production automotive hardware and highlights coordinated vulnerability disclosure processes wherein vendors have 90 days to issue fixes. This incident underscores how automotive technology—including electric vehicles and charging infrastructure—remains a top target for advanced security researchers, with new zero-day vulnerabilities continually emerging. As vehicle software stacks grow in complexity and interconnectivity, the imperative for proactive, industry-wide security controls and coordinated patch processes is increasingly urgent.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)
Computer/Network Security9 months ago

Exposed Security Testing Apps Used to Breach Fortune 500 Cloud Environments (2026)

In January 2026, threat actors exploited misconfigured web applications used for security testing and internal penetration testing—such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP—publicly exposed by Fortune 500 companies and major security vendors. By targeting these intentionally vulnerable apps tied to overly privileged cloud accounts in AWS, GCP, and Azure, attackers gained unauthorized access, deployed Monero (XMR) crypto miners, planted persistent webshells, and pivoted to sensitive cloud assets. Over 1,900 instances were found online, many with default credentials and excessive permissions, exposing secrets and allowing full access to cloud resources including storage buckets and Secrets Manager. Victim organizations remediated after being notified. This incident highlights a growing attack pattern where "friendly" security test and training tools become high-risk assets when mismanaged in cloud environments. Their exploitation underscores pressing gaps in cloud inventory management, IAM least-privilege enforcement, and secret sprawl, at a time of escalating attacks exploiting cloud misconfiguration and supply chain weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Patched Fortinet Firewalls Breached in 2026: Authentication Bypass Exposes Enterprise Networks
Computer/Network Security9 months ago

Patched Fortinet Firewalls Breached in 2026: Authentication Bypass Exposes Enterprise Networks

In January 2026, patched FortiGate firewalls running FortiOS versions 7.4.9 and 7.4.10 were actively breached due to exploitation of a lingering authentication bypass flaw (CVE-2025-59718) in the FortiCloud SSO login feature. Despite an earlier patch, attackers utilized crafted SAML messages to create rogue admin accounts on exposed devices, as observed in customer logs and confirmed by Fortinet developers. More than 11,000 Internet-facing Fortinet devices remained vulnerable as attackers leveraged the flaw to gain privileged access and potentially compromise network defenses, triggering urgent remediation efforts. This incident underscores persisting risks from incomplete remediation, especially on security appliances pivotal to organizational defenses. Growing attacker expertise in exploiting authentication logic flaws and a surge in identity-based attacks highlight the necessity for ongoing vigilance, layered compensating controls, and rapid vulnerability response strategies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024
Computer/Network Security9 months ago

How 'Damn Vulnerable' Training Apps Exposed Security Vendor Clouds in 2024

In early 2024, cybersecurity researchers discovered that widely used 'Damn Vulnerable' training applications, deployed by several prominent security vendors, had been left exposed due to cloud misconfigurations. Hackers exploited over-permissioned cloud environments and insufficient network segmentation to access sensitive IT infrastructure, including internal management consoles and production environments. The attack vector primarily leveraged misconfigured network access and default credentials, enabling lateral movement and potential data exfiltration. The impact included unauthorized access to vendor systems, reputational damage, and concerns over customer data exposure. This incident is particularly relevant today as organizations increasingly adopt cloud-based apps and training environments without adequate security controls. Similar misconfiguration-driven breaches are on the rise, highlighting the urgent need for robust cloud security posture management and Zero Trust strategies to minimize risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)
Computer Software/Engineering9 months ago

Anthropic MCP Git Server Vulnerability: AI Supply Chain at Risk (2026)

In January 2026, three critical vulnerabilities were disclosed in Anthropic's official Model Context Protocol (MCP) Git server, a tool widely used for managing Git repositories programmatically via large language models (LLMs). The flaws—identified as CVE-2025-68143, CVE-2025-68144, and CVE-2025-68145—included two path traversal and one argument injection vulnerabilities. Attackers could exploit these bugs through prompt injection via malicious content (e.g., README files, poisoned issue descriptions) to access or overwrite arbitrary files and achieve remote code execution, without needing direct access to victim systems. Chained exploitation with Filesystem MCP enabled full system compromise until patched in late 2025. This incident highlights growing risks at the intersection of AI-driven development, supply chain dependencies, and insufficient input validation within reference implementations. As organizations increasingly rely on open-source AI tooling, securing both the application layer and its automation becomes vital in defending against evolving prompt-based and supply chain exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
North Korea Supply Chain Attack Exploits VS Code Projects – 2026 Analysis
Computer Software/Engineering9 months ago

North Korea Supply Chain Attack Exploits VS Code Projects – 2026 Analysis

In January 2026, cybersecurity researchers uncovered a sophisticated supply chain attack targeting software developers via malicious Visual Studio Code (VS Code) projects. Threat actors linked to North Korea's Contagious Interview campaign distributed weaponized VS Code samples to compromise developer endpoints and install covert backdoors. Once inside victims' systems, the attackers could move laterally, exfiltrate sensitive source code, and access development infrastructure, risking intellectual property, customer data, and supply chain integrity. The campaign represents an evolution of social engineering tactics and demonstrates the attackers’ focus on high-leverage targets within the tech sector. This incident is highly relevant as it underscores the growing trend of software supply chain attacks leveraging development environments and trusted open-source platforms. Organizations must now reassess third-party code risks and developer security, as attackers increasingly exploit toolchains and social-engineering techniques instead of perimeter defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Punycode Phishing: How IDN Abuse Enabled Stealth Attacks in 2026
Financial Services9 months ago

Punycode Phishing: How IDN Abuse Enabled Stealth Attacks in 2026

In January 2026, security researchers identified a surge in phishing attacks leveraging Internationalized Domain Names (IDNs) encoded with Punycode, enabling attackers to create visually deceptive domains that closely resemble legitimate ones. By substituting standard ASCII characters with similar-looking Unicode characters, threat actors bypassed traditional detection, tricking users into visiting fraudulent sites and unknowingly exposing credentials or sensitive information. The attack was uncovered through DNS log analysis, revealing repeated internal access attempts to encoded domains such as xn--yutube-wqf.com, demonstrating the sophistication and stealth of this social engineering tactic. This incident highlights the growing prevalence of advanced phishing campaigns using homoglyph attacks and encoded domains, underscoring the need for updated detection routines and user awareness. Organizations face increased operational risk as threat actors exploit gaps caused by internationalization and encoding, making timely monitoring and DNS log analysis crucial.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Pixel 9 (2026): Zero-Click BigWave Driver Breach Exposes Kernel Vulnerabilities
Telecommunications9 months ago

Google Pixel 9 (2026): Zero-Click BigWave Driver Breach Exposes Kernel Vulnerabilities

In January 2026, Google Pixel 9 devices were found vulnerable to a sophisticated zero-click exploit chain targeting the Android BigWave hardware driver. Attackers combined a remote code execution exploit affecting a Dolby decoder with a privilege escalation flaw in the /dev/bigwave device, accessible from the mediacodec SELinux sandbox. The chain allowed attackers to escape the sandbox, bypass SELinux protections, and achieve kernel-level arbitrary read/write, essentially gaining full device control. This exploit enabled unauthorized access to sensitive data and even allowed remote data exfiltration by attackers, severely compromising device security. This incident highlights the increasing sophistication of exploit chains leveraging hardware-specific drivers and sandbox escape techniques in mobile ecosystems. With the rise in supply chain threats, use of AI to automate exploit engineering, and growing pressure from privacy regulators, organizations face escalating risks from zero-day attacks targeting embedded devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports