✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
2025 Cyberattack Wave: USB Malware, React2Shell & AI Tool Exploits Expose Security Gaps
In December 2025, organizations worldwide faced a surge of multi-vector cyberattacks exploiting recent vulnerabilities in USB devices, popular developer frameworks like React (notably the React2Shell bug), and emerging AI-powered coding environments. Attackers leveraged unpatched software, social engineering, and compromised USB devices to distribute malware and establish lateral movement within networks. The campaign capitalized on the rapid deployment of new technologies and lagging security controls, resulting in data breaches, financial theft via sophisticated WhatsApp worms, and the infiltration of development pipelines. This spate of incidents underscores the escalating convergence of traditional malware vectors and AI-driven exploits, exposing significant gaps in current security postures. As organizations accelerate digital transformation and adopt generative AI tools, adversaries are rapidly evolving, testing defenses across cloud, hybrid, and on-premises ecosystems.
6 months ago
Kill Chain
Active Exploitation of React2Shell: How Chinese APTs Breached the Supply Chain in 2025
In December 2025, security researchers identified a critical vulnerability, CVE-2025-55182 (React2Shell), actively exploited in the wild by suspected Chinese threat actors Earth Lamia and Jackpot Panda. The flaw impacts React Server Components in several Meta-maintained packages (versions 19.0 to 19.2.0), allowing attackers to execute arbitrary code on backend servers via unsafe deserialization at API endpoints. First reported by AWS Threat Intelligence on December 4, evidence ties multiple untracked clusters and IP addresses to coordinated supply-chain attacks targeting organizations operating modern web stacks. In successful compromises, attackers gained full backend access, posing serious risks to enterprise data and operations. This incident underscores the rapid weaponization of supply-chain vulnerabilities and the growing sophistication of state-aligned APTs exploiting core software dependencies. React2Shell highlights the urgent need for rigorous patch management, attack surface monitoring, and proactive defense as critical technologies become frequent entry points for advanced adversaries.
6 months ago
Kill Chain
React2Shell Vulnerability Triggers Mass Breach Across 30+ Organizations in 2025
In early 2025, researchers discovered that over 77,000 internet-exposed IP addresses are vulnerable to a critical Remote Code Execution (RCE) flaw in the React2Shell framework (CVE-2025-55182). Threat actors rapidly exploited this vulnerability to breach at least 30 organizations across sectors such as finance, healthcare, and technology. Attackers leveraged the exploit to gain remote control, exfiltrate data, and potentially deploy malware across impacted systems, highlighting significant risks to operational resilience and data privacy. The compromised firms are now racing to contain lateral movement and mitigate exposure amid ongoing incident response. This incident illustrates a growing trend of attackers rapidly weaponizing newly disclosed vulnerabilities in popular frameworks for mass exploitation. It underscores the urgent need for timely patch management, robust segmentation, and comprehensive monitoring to counter the escalating threat from opportunistic RCE attacks targeting exposed internet-facing assets.
6 months ago
Kill Chain
Critical React2Shell Flaw (CVE-2025-55182) Added to CISA KEV After Confirmed Exploitation
In June 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-55182, impacting React Server Components (RSC) was added to CISA's Known Exploited Vulnerabilities catalog following confirmed reports of active exploitation. Attackers leveraged the flaw, known as 'React2Shell,' to execute arbitrary code on vulnerable servers by exploiting inadequate input validation, enabling lateral movement and potential compromise of sensitive systems and data. Several organizations in sectors reliant on JavaScript-based web infrastructures were affected, resulting in service disruptions and the risk of unauthorized data access and exfiltration. This incident highlights a broader trend in targeting supply chain and open-source components within modern web development stacks. The increasing frequency and sophistication of attacks on widely adopted frameworks like React underscore the urgency for rapid vulnerability remediation, improved code validation, and enterprise adoption of proactive threat detection to mitigate future large-scale RCE campaigns.
6 months ago
Kill Chain
AI IDEsaster: 30+ Vulnerabilities Expose Developer Environments to Prompt Injection & RCE (2025)
In December 2025, over 30 serious security flaws—collectively named "IDEsaster"—were uncovered in popular AI-powered Integrated Development Environments (IDEs) by researcher Ari Marzouk (MaccariTA). Exploiting these vulnerabilities, attackers could inject malicious prompts, leading to unauthorized data exfiltration and remote code execution within developer environments. The flaws stemmed from unsafe integrations of AI features, including insufficient sandboxing and lack of network traffic controls, exposing sensitive code and credentials to threat actors. Notably, vulnerabilities allowed for lateral movement and direct access to code repositories, risking business continuity and intellectual property. This incident is especially significant as AI adoption in coding workflows accelerates, creating new attack vectors. The surge in prompt injection and AI supply chain threats, paired with evolving attacker tactics targeting developer tools, highlights the urgent need for organizations to strengthen segmentation, monitoring, and AI risk governance.
6 months ago
Kill Chain
How MCP Prompt Injection Attacks Bypassed AI Security Controls in 2024
In early 2024, cybersecurity researchers from Unit 42 uncovered a series of novel prompt injection attack vectors targeting applications built on the Model Context Protocol (MCP), an emerging technology that connects large language models (LLMs) to external data sources and tools. Threat actors exploited weaknesses in MCP sampling to inject malicious prompts, enabling sensitive data exfiltration, command execution, and unauthorized access to downstream APIs. The compromised LLM applications posed significant risks across industries utilizing MCP to enhance automation and efficiency, ultimately raising concerns over AI/ML-powered business processes. The attack highlighted urgent visibility, policy enforcement, and segmentation shortfalls in cloud-native environments. The MCP prompt injection incident underscores a surge in AI-driven threats, particularly as generative AI is rapidly being integrated into enterprise workflows. Regulatory bodies and CISOs now place a premium on robust framework adherence and continuous monitoring as generative AI vulnerabilities and supply-chain risks multiply.
6 months ago
Kill Chain
Cloudflare 2024 Outage: Why Network Resilience and Redundancy Matter More Than Ever
On June 20, 2024, Cloudflare, a major internet infrastructure and security provider, suffered a widespread service outage that disrupted access to thousands of websites and web services globally. The event was characterized by persistent 500 Internal Server Error messages for end users. Cloudflare initiated an internal investigation, ultimately attributing the incident to a critical infrastructure failure rather than a cyberattack or external threat. Throughout the outage, web-facing businesses, SaaS providers, and end-users experienced degraded network performance, extended downtime, and impact to brand trust, illustrating the magnitude of hyperscaler dependencies. The Cloudflare outage highlights the increasing risks associated with concentration of critical internet services and underscores the urgency for organizations to bolster resilience strategies. In an era of heightened service interdependencies and upticks in both incidents and attacks targeting fundamental service providers, outage preparedness and robust incident response planning are more essential than ever.
6 months ago
Kill Chain
AI Agent Prompt Injection Turns GitHub Actions Into Supply Chain Backdoor
In early 2024, cybersecurity researchers at Aikido disclosed a critical supply-chain vulnerability affecting major AI coding tools such as Google Gemini, Claude Code, OpenAI Codex, and GitHub AI Inference. The flaw enables attackers to inject malicious prompts into software automation workflows like GitHub Actions, causing integrated AI agents with elevated privileges to execute unauthorized commands. Cunning use of crafted commit messages and pull requests can trick large language models into treating these inputs as actionable instructions, leading to code modifications, shell command execution, and privilege escalation within software repositories. The vulnerability, reported via responsible disclosure, has prompted urgent fixes in some tools, but similar weaknesses remain present in other platforms. This incident highlights the expanding risks of AI-powered automation in the software development supply chain. With organizations increasingly relying on LLM integrations, the potential for prompt injection and privilege abuse creates new avenues for compromise, underscoring the urgency for robust controls, regular audit, and architectural safeguards around agentic AI workflows.
6 months ago
Kill Chain
How Sophisticated Attackers Exploited the 2025 React2Shell Zero-Day
In June 2025, a critical remote code execution vulnerability named React2Shell (CVE-2025-55182) was exploited in the wild against organizations using React Server Components. Within hours of the public disclosure and patch release, Chinese state-linked groups such as UNC5174 (CL-STA-1015), Earth Lamia, and Jackpot Panda, alongside opportunistic cybercriminals, began mass scanning and targeting exposed systems. The threat actors successfully deployed malware (notably Snowlight and Vshell), established persistent access, conducted credential theft, and attempted to extract Amazon Web Services configuration and credential files. Over 30 organizations across industries suffered breaches, including documented impact on customer cloud environments. This campaign demonstrates the increasing speed and coordination of attackers exploiting newly public vulnerabilities, especially in widely deployed frameworks like React and Next.js. The incident underscores the necessity of rapid patching, improved east-west traffic security, and continuous threat detection, as adversaries quickly weaponize disclosures for initial access and persistent footholds.
6 months ago
Kill Chain
China-Linked Supply Chain Breach Exploits React2Shell Flaw in 2025
In mid-2025, multiple China-linked threat actors launched widespread exploitation of the React2Shell vulnerability (CVE-2025-55182), a critical supply-chain flaw impacting React and Next.js applications. Within hours of the flaw’s public disclosure, attackers initiated automated scanning and weaponization campaigns, targeting internet-exposed services to quickly gain unauthorized, remote code execution. Successful intrusions enabled attackers to harvest sensitive data, escalate privileges, and pivot laterally within affected cloud environments. The rapid adoption of malicious payloads and swift exploitation before most organizations could patch led to substantial business risk, data loss, and potential compliance violations across sectors. This incident underscores an escalated threat landscape where nation-state actors rapidly exploit newly-disclosed supply-chain vulnerabilities. The speed and scope of these attacks reflect a significant uptick in zero-day exploitation campaigns and highlight the urgent need for organizations to strengthen patching velocity, endpoint monitoring, and east-west segmentation controls.
6 months ago
Kill Chain
Cloudflare’s 2024 Outage: Lessons from the React2Shell RCE Emergency
In June 2024, Cloudflare experienced a significant outage after emergency patching efforts to address an actively exploited remote code execution (RCE) vulnerability in the React framework, dubbed "React2Shell." The incident unfolded as threat actors began leveraging the vulnerability to attempt unauthorized code execution on internet-facing workloads, prompting Cloudflare to rush critical security mitigations. While the attack itself targeted exploitation routes via React, it was the swift application of mitigations—rather than a direct breach—which triggered widespread downtime, temporarily impacting Cloudflare's global network operations and customer accessibility. This incident underscores the increasing speed and aggression of active exploitation cycles, particularly for zero-day vulnerabilities in widely used frameworks. As attacker sophistication grows and organizations race to patch critical flaws, operational disruptions and collateral damage are becoming more frequent in the ongoing effort to balance security with business continuity.
6 months ago
Kill Chain
Clop Ransomware Hits Barts Health NHS via Oracle Zero-Day
In early 2024, Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite. The attackers gained unauthorized access to internal systems, exfiltrated sensitive files from a key database, and threatened further leaks. The attack leveraged unpatched software flaws as the entry vector, allowing for rapid lateral movement and data theft before being detected. The incident disrupted operations and triggered regulatory notifications due to the sensitive nature of patient and operational information. This breach highlights the ongoing risks posed by sophisticated ransomware groups exploiting zero-day vulnerabilities in widely used enterprise software. Attacks of this kind are increasingly common, especially in the healthcare sector, which remains a high-value target for ransomware due to legacy systems and critical service mandates.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports