✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Protect Your Crypto Assets: Understanding the 'Ill Bloom' Vulnerability
In July 2026, blockchain security firm Coinspect disclosed a critical vulnerability named 'Ill Bloom' affecting cryptocurrency wallets across multiple blockchains, including Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. The flaw stems from weak randomness in the generation of recovery phrases in certain software wallets, particularly lesser-known mobile applications created as early as 2018. This vulnerability has led to unauthorized access and the draining of funds, with at least $5 million stolen since May 27, 2026, including $3.1 million from 431 wallets in a coordinated attack on that date. ([crypto-economy.com](https://crypto-economy.com/coinspect-flags-ill-bloom-vulnerability/?utm_source=openai)) The 'Ill Bloom' incident underscores the critical importance of secure cryptographic practices in wallet generation. It highlights the ongoing risks associated with software wallets that may not adhere to robust security standards, emphasizing the need for users to verify the security of their wallet applications and consider using hardware wallets or reputable software wallets with strong security measures to safeguard their digital assets.
2 weeks ago
Kill Chain
WP-SHELLSTORM: A Massive Exploitation of WordPress Vulnerabilities
In June 2026, cybersecurity researchers uncovered a large-scale operation named WP-SHELLSTORM, which exploited vulnerabilities in outdated WordPress plugins to compromise thousands of websites. The attackers utilized known flaws, notably in the Breeze caching plugin (CVE-2026-3844), to deploy webshells, granting unauthorized access to affected sites. This operation targeted over 1.4 million domains, with confirmed compromises on approximately 25,195 sites. The exposed server provided insights into the attackers' methods, including automated scanning and exploitation of vulnerable plugins. This incident underscores the critical importance of maintaining up-to-date software and implementing robust security measures. The widespread nature of the attack highlights the persistent threat posed by cybercriminals exploiting known vulnerabilities, emphasizing the need for continuous vigilance and proactive defense strategies in website management.
2 weeks ago
Kill Chain
Unpatched XRING Flaw in XQUIC Lets Remote Clients Crash HTTP/3 Servers
In July 2026, a critical vulnerability named XRING was disclosed in XQUIC, Alibaba's QUIC and HTTP/3 library. This flaw allows remote clients to crash HTTP/3 servers by sending approximately 260 bytes of standard QPACK traffic, without requiring authentication or malformed packets. The issue stems from improper handling of the dynamic table resizing in QPACK, leading to memory corruption and server crashes. All versions up to v1.9.4 are affected, and as of July 10, no patch has been released. This incident underscores the importance of rigorous input validation and memory management in protocol implementations. The lack of a current patch necessitates immediate mitigation measures, such as disabling QPACK's dynamic table or HTTP/3 support, to prevent potential denial-of-service attacks.
2 weeks ago
Kill Chain
OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security
In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, a popular open-source AI assistant. These flaws, including CVE-2026-25253, CVE-2026-24763, and CVE-2026-25157, allowed attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data. Exploitation of these vulnerabilities led to unauthorized access to over 28,000 systems worldwide, with attackers gaining full control over affected hosts. The widespread deployment of OpenClaw in enterprise environments amplified the impact, exposing numerous organizations to significant security risks. The rapid adoption of AI agents like OpenClaw underscores the urgent need for robust security measures in AI deployments. This incident highlights the importance of comprehensive vulnerability assessments, timely patch management, and stringent access controls to mitigate the risks associated with integrating AI assistants into critical systems.
2 weeks ago
Kill Chain
Injective SDK npm Supply-Chain Attack Exposes Cryptocurrency Wallets
In July 2026, attackers compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious version (1.20.21) of the @injectivelabs/sdk-ts package on npm. This package, widely used for developing applications on the Injective blockchain, was altered to steal cryptocurrency wallet private keys and mnemonic seed phrases. The breach was detected promptly, and a clean version (1.20.23) was released. However, the malicious package was downloaded 310 times before deprecation, potentially compromising numerous developer systems. This incident underscores the escalating threat of supply-chain attacks targeting open-source ecosystems, particularly within the cryptocurrency sector. The rapid detection and response highlight the importance of vigilant monitoring and swift action in mitigating such threats.
2 weeks ago
Kill Chain
Understanding the Bucket Hijacking Threat in Cloud Storage
In July 2026, a critical cloud storage attack technique known as 'bucket hijacking' was disclosed, enabling threat actors to silently redirect an organization's active cloud data streams, including audit logs and telemetry, into attacker-controlled external storage buckets across major cloud platforms. This vulnerability exploits the global uniqueness of cloud storage bucket names, allowing attackers to register a previously deleted bucket name and reroute data streams intended for the original bucket. The attack affects major cloud providers, including Google Cloud, Amazon Web Services (AWS), and Microsoft Azure, and detection is extremely challenging once deployed. ([serisec.com](https://serisec.com/index.php/2026/06/27/new-bucket-hijacking-attack-allows-hackers-to-reroute-cloud-data-streams-to-external-storage/?utm_source=openai)) This incident underscores the escalating risks associated with cloud misconfigurations and the critical need for organizations to implement robust monitoring and configuration management practices. As cloud environments become increasingly complex, the potential for such vulnerabilities to be exploited grows, emphasizing the importance of proactive security measures to safeguard sensitive data.
2 weeks ago
Kill Chain
Dormant GitHub Accounts: A New Vector in Supply Chain Attacks
In July 2026, Datadog Security Labs identified multiple coordinated campaigns systematically enumerating corporate GitHub organizations, repositories, and user accounts via the GitHub API. Attackers utilized automated scraping tools with custom or legitimate-sounding user agents, leveraging dormant 'ghost' accounts—created two to five years prior and left inactive—as well as compromised OAuth tokens and personal access tokens (PATs) from legitimate users. While much of the activity targeted public data, some instances involved cloning private repositories, indicating a significant escalation in threat actor capabilities. This incident underscores the evolving tactics of threat actors who exploit dormant accounts and compromised credentials to conduct reconnaissance and access sensitive information. Organizations must enhance their monitoring of API activities and implement robust access controls to mitigate such risks.
2 weeks ago
Kill Chain
npm 12 Enhances Security by Disabling Automatic Install Scripts
In July 2026, GitHub released npm version 12, implementing significant security enhancements by disabling install scripts by default. This change prevents automatic execution of preinstall, install, and postinstall scripts during package installation, addressing a major attack vector exploited in previous supply chain attacks. Additionally, npm v12 requires explicit approval for Git and remote URL dependencies, further strengthening the ecosystem's security posture. This update is particularly relevant as supply chain attacks have become increasingly prevalent, with attackers leveraging automatic script execution to compromise systems. By requiring explicit consent for script execution and external dependencies, npm v12 aims to mitigate these risks, promoting a more secure development environment.
2 weeks ago
Kill Chain
AI-Powered Attack Compromises AWS Environment in Record Time
In July 2026, a lone threat actor utilized agentic AI workflows to orchestrate a sophisticated attack on a large Amazon Web Services (AWS) environment, achieving full compromise within 72 hours. The attacker exploited weaknesses across application services, AWS resources, source code repositories, CI/CD pipelines, runtime components, and data stores, leading to financial extortion of the victim. This incident underscores the evolving threat landscape where AI accelerates the speed and scale of cyberattacks, enabling even individual actors to execute complex operations rapidly. Organizations must adapt by enhancing their detection and response capabilities to counteract AI-assisted threats effectively.
2 weeks ago
Kill Chain
GodDamn Ransomware: A New Era of BYOVD Attacks
In July 2026, the Hyadina ransomware group launched a sophisticated attack against U.S. organizations using their newly developed 'GodDamn' ransomware. The attackers employed a Bring Your Own Vulnerable Driver (BYOVD) technique, utilizing a malicious kernel driver signed by Microsoft to disable security software and facilitate the ransomware deployment. This method allowed them to infiltrate sectors including healthcare, manufacturing, and education, leading to significant operational disruptions and data encryption. This incident underscores the evolving tactics of ransomware groups, particularly the exploitation of trusted digital certificates to bypass security measures. The use of legitimate tools for malicious purposes highlights the need for enhanced behavioral detection mechanisms and adaptive security strategies to counteract such sophisticated threats.
2 weeks ago
Kill Chain
AI Gateway Compromise Exposes Critical Security Vulnerabilities
In July 2026, a threat actor compromised an Amazon EC2 server hosting an AI gateway connected to Amazon Bedrock services. The attacker utilized this access to deploy cryptomining software, exploiting the gateway's privileged position to potentially access AI models, manipulate workflows, and infiltrate the organization's cloud infrastructure. This incident underscores the critical vulnerabilities associated with AI gateways, which often serve as central points of access to sensitive data and services. The increasing deployment of AI gateways in enterprise environments highlights the urgent need for robust security measures. As these gateways aggregate access to multiple AI models and datasets, they become attractive targets for attackers seeking to exploit centralized points of control. Organizations must implement stringent access controls, continuous monitoring, and regular security assessments to mitigate the risks posed by such vulnerabilities.
2 weeks ago
Kill Chain
NotPetya Attack: Lessons in Cybersecurity from a Nation-State Operation
In June 2017, the NotPetya malware attack, orchestrated by the Russian military's GRU Unit 74455 (Sandworm), exploited a compromised update mechanism in M.E.Doc, a widely used Ukrainian tax accounting software developed by Intellect Service. This supply chain attack led to the rapid propagation of the malware, causing extensive disruptions to critical infrastructure in Ukraine and resulting in global damages exceeding $10 billion. Major multinational corporations, including Maersk, Merck, and FedEx, experienced significant operational and financial impacts due to the attack. The incident underscored the vulnerabilities inherent in software supply chains and the potential for nation-state cyber operations to inflict widespread collateral damage. ([cyberbreaches.org](https://www.cyberbreaches.org/en/incidents/notpetya-2017?utm_source=openai)) The NotPetya attack serves as a stark reminder of the evolving nature of cyber warfare, where nation-state actors target civilian infrastructure to achieve strategic objectives. The incident highlights the critical importance for organizations to implement robust cybersecurity measures, particularly in securing their supply chains, to mitigate the risks posed by sophisticated cyber threats.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports