✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
MemGhost Attack: A New Threat to AI Assistant Security
In July 2026, cybersecurity researchers identified a novel attack vector named 'MemGhost,' which exploits AI assistants equipped with persistent memory. By sending a single, specially crafted email, attackers can implant false information into the assistant's memory without user detection. This manipulation allows the AI to provide altered responses in future interactions, potentially leading to misinformation or unauthorized actions. The attack leverages the assistant's ability to autonomously process emails and update its knowledge base, making it particularly insidious. The MemGhost attack underscores the emerging vulnerabilities associated with AI systems that maintain long-term user data. As AI assistants become more integrated into daily workflows, the potential for such memory poisoning attacks increases, highlighting the need for robust security measures to protect against unauthorized data manipulation.
2 weeks ago
Kill Chain
Anubis Ransomware Exploits Citrix Bleed 2 Vulnerability in 2026
In early July 2026, the Anubis ransomware group exploited a critical vulnerability known as Citrix Bleed 2 (CVE-2025-5777) in Citrix NetScaler appliances to gain unauthorized access to enterprise networks. This flaw allowed attackers to bypass multi-factor authentication by stealing session tokens, leading to the compromise of 91 organizations across sectors such as healthcare, financial services, manufacturing, and technology. The attackers utilized legitimate remote management tools to maintain persistence and evade detection, culminating in the deployment of ransomware that encrypted critical data and disrupted operations. This incident underscores the persistent threat posed by unpatched vulnerabilities and the sophisticated tactics employed by ransomware groups. The exploitation of Citrix Bleed 2 highlights the importance of timely patch management and the need for comprehensive monitoring of remote access tools to detect and prevent unauthorized activities.
2 weeks ago
Kill Chain
Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials
In July 2026, security researchers identified a widespread scanning campaign targeting Model Context Protocol (MCP) servers and AI assistant credential files. Attackers systematically probed internet-facing systems for exposed MCP endpoints and configuration files associated with AI development tools, aiming to exploit misconfigurations and gain unauthorized access. This reconnaissance activity underscores the critical need for organizations to secure their AI infrastructure against emerging threats. The incident highlights a growing trend of attackers focusing on AI-related assets, exploiting the rapid adoption of AI technologies and potential security oversights. Organizations must proactively implement robust security measures to protect sensitive AI systems and data from evolving cyber threats.
2 weeks ago
Kill Chain
Global CMS Exploitation Campaign: Protect Your Website Now
In July 2026, the Australian Cyber Security Centre (ACSC) issued an alert regarding a global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning websites to deploy webshells, leveraging flaws in platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. This campaign has significantly impacted small to medium-sized Australian businesses, leading to service disruptions, credential theft, malware deployment, and potential lateral movement within networks. The ACSC highlighted that the campaign might be supported by artificial intelligence, enabling threat actors to accelerate attacks and scale the exploitation of emerging vulnerabilities. Website administrators are urged to apply the latest security updates, remove unused components, enable automatic updates where possible, and implement additional security measures to mitigate the risk of compromise.
2 weeks ago
Kill Chain
jscrambler npm Package Compromise: A Wake-Up Call for Developer Security
On July 11, 2026, the jscrambler npm package version 8.14.0 was compromised, introducing a preinstall hook that deployed a Rust-based infostealer upon installation. This malicious code targeted developer environments across Windows, macOS, and Linux platforms, exfiltrating sensitive data such as cloud credentials, cryptocurrency wallets, password manager vaults, and session tokens for various applications. The attack was identified within minutes of the release, but the exact number of affected systems remains undetermined. This incident underscores the escalating threat of supply chain attacks within the software development ecosystem. The rapid detection highlights the importance of vigilant monitoring and swift response mechanisms. Organizations must prioritize securing their development pipelines and implement robust verification processes to mitigate the risks associated with third-party dependencies.
2 weeks ago
Kill Chain
Ghostcommit: Unveiling the AI Code Review Exploit via Image-Based Prompt Injection
In July 2026, researchers from the University of Missouri-Kansas City's ASSET Research Group unveiled 'Ghostcommit,' a sophisticated supply chain attack that exploits AI code reviewers by embedding prompt injections within image files. The attack involves submitting a pull request containing a PNG image with hidden instructions that, when processed by AI agents, extract sensitive information from the repository's environment files and encode them into the source code as innocuous-looking data. This method effectively bypasses traditional code review processes, as images are typically not scrutinized for malicious content. The 'Ghostcommit' attack underscores a critical vulnerability in AI-assisted development workflows, highlighting the need for enhanced scrutiny of non-textual assets in code reviews. As AI integration in software development continues to grow, understanding and mitigating such novel attack vectors becomes imperative to maintain the integrity and security of development pipelines.
2 weeks ago
Kill Chain
Critical Authentication Bypass in Gitea Docker Image (CVE-2026-20896)
In July 2026, a critical authentication bypass vulnerability, CVE-2026-20896, was discovered in Gitea's official Docker image versions up to and including 1.26.2. This flaw allowed unauthenticated attackers to impersonate any user, including administrators, by exploiting a default configuration that trusted reverse-proxy authentication headers from any source IP address. Exploitation began less than two weeks before public disclosure, with approximately 6,200 Gitea instances exposed on the public web. Successful exploitation granted attackers full access to repositories, CI/CD secrets, and administrative functions, posing significant risks to organizations relying on Gitea for source code management. The rapid exploitation of CVE-2026-20896 underscores the critical importance of promptly addressing default configuration vulnerabilities in widely used open-source tools. Organizations must remain vigilant, ensuring that default settings are reviewed and adjusted to align with security best practices to prevent unauthorized access and potential data breaches.
2 weeks ago
Kill Chain
Injective Labs GitHub Compromise Exposes Supply Chain Vulnerabilities
In July 2026, threat actors compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious npm package, @injectivelabs/sdk-ts@1.20.21. This package contained code designed to exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases by embedding fake telemetry functionality. The malicious version was released on July 8, 2026, and remained available for download until its deprecation. The attackers utilized a developer's GitHub account with a history of contributions to introduce the malicious code, which was then propagated across 17 additional @injectivelabs scoped packages, affecting numerous downstream users. This incident underscores the escalating threat of supply chain attacks targeting open-source repositories. The sophisticated nature of the attack, involving legitimate contributor accounts and widespread package dependencies, highlights the urgent need for enhanced security measures in software development pipelines to prevent similar breaches.
2 weeks ago
Kill Chain
Critical ATM Software Vulnerabilities Uncovered
In July 2026, security researcher Matt Burch identified nine vulnerabilities in CryptWare's CryptoPro Secure Disk, a full-disk encryption and pre-boot authentication solution for Windows. These flaws could potentially allow attackers with physical access to ATMs to execute arbitrary code, bypass encryption, and steal cash. The vulnerabilities include integrity validation bypasses and improper storage of key materials, raising significant security concerns for organizations utilizing this software. This discovery underscores the critical need for robust physical and software security measures in ATMs, especially as 'jackpotting' attacks have been on the rise, with over 700 incidents reported in 2025, resulting in more than $20 million stolen. ([techcrunch.com](https://techcrunch.com/2026/02/19/fbi-says-atm-jackpotting-attacks-are-on-the-rise-and-netting-hackers-millions-in-stolen-cash/?utm_source=openai))
2 weeks ago
Kill Chain
Navigating the Security Landscape of AI Coding Tools
In July 2026, a comprehensive analysis revealed that while AI coding tools have significantly enhanced developer productivity, they also introduce substantial security vulnerabilities. Studies indicated that a significant portion of AI-generated code contained critical flaws, including injection vulnerabilities and hardcoded secrets. Additionally, incidents such as the 'GhostApproval' vulnerability in major AI coding assistants highlighted the potential for remote code execution and data exfiltration. These findings underscore the necessity for organizations to balance the productivity benefits of AI coding tools with rigorous security assessments and mitigation strategies. The current relevance of this issue is underscored by the rapid adoption of AI coding tools across industries, coupled with an increasing number of documented security incidents. As organizations integrate these tools into their development workflows, the potential for widespread security breaches grows, emphasizing the urgent need for enhanced security protocols and continuous monitoring.
2 weeks ago
Kill Chain
Protect Your Crypto Assets: Understanding the 'Ill Bloom' Vulnerability
In July 2026, blockchain security firm Coinspect disclosed a critical vulnerability named 'Ill Bloom' affecting cryptocurrency wallets across multiple blockchains, including Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. The flaw stems from weak randomness in the generation of recovery phrases in certain software wallets, particularly lesser-known mobile applications created as early as 2018. This vulnerability has led to unauthorized access and the draining of funds, with at least $5 million stolen since May 27, 2026, including $3.1 million from 431 wallets in a coordinated attack on that date. ([crypto-economy.com](https://crypto-economy.com/coinspect-flags-ill-bloom-vulnerability/?utm_source=openai)) The 'Ill Bloom' incident underscores the critical importance of secure cryptographic practices in wallet generation. It highlights the ongoing risks associated with software wallets that may not adhere to robust security standards, emphasizing the need for users to verify the security of their wallet applications and consider using hardware wallets or reputable software wallets with strong security measures to safeguard their digital assets.
2 weeks ago
Kill Chain
WP-SHELLSTORM: A Massive Exploitation of WordPress Vulnerabilities
In June 2026, cybersecurity researchers uncovered a large-scale operation named WP-SHELLSTORM, which exploited vulnerabilities in outdated WordPress plugins to compromise thousands of websites. The attackers utilized known flaws, notably in the Breeze caching plugin (CVE-2026-3844), to deploy webshells, granting unauthorized access to affected sites. This operation targeted over 1.4 million domains, with confirmed compromises on approximately 25,195 sites. The exposed server provided insights into the attackers' methods, including automated scanning and exploitation of vulnerable plugins. This incident underscores the critical importance of maintaining up-to-date software and implementing robust security measures. The widespread nature of the attack highlights the persistent threat posed by cybercriminals exploiting known vulnerabilities, emphasizing the need for continuous vigilance and proactive defense strategies in website management.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports