✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Phishing Attacks Decline 20% in 2026, But AI Enhances Threats
In 2026, phishing attack volumes decreased by 20% for the second consecutive year. However, the sophistication and effectiveness of these attacks have significantly increased, largely due to the integration of artificial intelligence (AI) by cybercriminals. AI tools enable attackers to craft highly convincing phishing lures and automate the creation of fraudulent websites, leading to more targeted and successful campaigns. ([zscaler.com](https://www.zscaler.com/blogs/security-research/one-click-compromise-threatlabz-2026-phishing-and-initial-access-report?utm_source=openai)) This trend underscores a shift in cybercriminal strategies from mass, indiscriminate attacks to focused, high-yield operations. Organizations must recognize that while the quantity of phishing attempts has declined, the quality and potential impact of these attacks have escalated, necessitating enhanced vigilance and advanced security measures.
1 month ago
Kill Chain
Critical RCE Vulnerability in LangGraph: Immediate Action Required
In February 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-27794, was discovered in LangGraph's caching layer. This flaw allowed attackers with write access to the cache backend to inject malicious serialized objects, leading to arbitrary code execution upon deserialization by the LangGraph process. The vulnerability affected versions of langgraph-checkpoint prior to 4.0.0 and was particularly concerning for applications utilizing cache backends inheriting from BaseCache with nodes opted into caching via CachePolicy. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27794/?utm_source=openai)) This incident underscores the persistent risks associated with deserialization of untrusted data, especially in AI frameworks. Organizations leveraging LangGraph for AI agent orchestration must ensure they have updated to version 4.0.0 or later to mitigate this vulnerability. The event highlights the critical need for secure coding practices and regular security assessments in AI development environments.
1 month ago
Kill Chain
Agentjacking: Exploiting AI Coding Agents via Sentry Vulnerability
In June 2026, Tenet Security identified a novel attack method termed 'Agentjacking,' which exploits AI coding agents by injecting malicious code through manipulated error reports in Sentry, an open-source error-tracking platform. Attackers can send crafted error events to Sentry using publicly accessible Data Source Names (DSNs), embedding commands that AI agents interpret and execute as legitimate diagnostic steps. This technique allows unauthorized code execution on developer machines, potentially exposing sensitive data such as environment variables, Git credentials, and private repository URLs. The Agentjacking attack underscores the growing security risks associated with integrating AI coding agents into development workflows. As these agents gain broader access to codebases and tools, they become attractive targets for exploitation. This incident highlights the urgent need for robust security measures and governance frameworks to manage the deployment and operation of AI agents, ensuring they do not inadvertently become vectors for cyberattacks.
1 month ago
Kill Chain
CompleteFTP 'Short-Sleeve' RSA and DSA Key Vulnerability Exposed
In June 2026, researchers identified a vulnerability in RSA and DSA key generation within the CompleteFTP software, leading to the creation of 'short-sleeve' keys with predictable zero-bit patterns. This flaw, stemming from a type mismatch in big-integer code, resulted in the generation of weak cryptographic keys that could be easily factored, compromising the security of encrypted communications. The issue affected CompleteFTP versions 10.0.0 through 23.0.4, spanning from December 2016 to December 2023. EnterpriseDT, the developers of CompleteFTP, promptly released version 26.1.0 on May 8, 2026, which includes a tool to detect and regenerate vulnerable keys. ([enterprisedt.jp](https://www.enterprisedt.jp/doc23/html/howtoserverkeys.html?utm_source=openai)) This incident underscores the critical importance of rigorous code review and adherence to cryptographic standards in software development. It also highlights the necessity for organizations to regularly audit their cryptographic implementations to identify and mitigate potential vulnerabilities that could be exploited by attackers.
1 month ago
Kill Chain
Critical Security Flaws Discovered in OpenClaw AI Agent
In June 2026, security researchers from Imperva and Varonis identified critical vulnerabilities in OpenClaw, a widely used self-hosted AI agent. Imperva demonstrated that attackers could embed malicious instructions within shared contacts, vCards, and location pins, leading the agent to execute unauthorized code without user awareness. Varonis revealed that OpenClaw could be manipulated through standard emails to exfiltrate sensitive data, such as AWS keys and customer information, to external addresses. These findings underscore the agent's susceptibility to prompt injection attacks and its overreliance on unverified inputs, posing significant security risks to users. The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, highlighting the urgent need for comprehensive governance frameworks. Organizations must reassess their deployment strategies, implement stringent access controls, and ensure continuous monitoring to mitigate the risks associated with autonomous AI systems operating within their environments.
1 month ago
Kill Chain
CISA's BOD 26-04: A New Era in Federal Vulnerability Management
On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, mandating federal agencies to adopt a risk-based approach to vulnerability remediation. This directive requires agencies to prioritize vulnerabilities based on four criteria: inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, public exposure of the asset, potential for automated exploitation, and the level of control an attacker could gain upon successful exploitation. Vulnerabilities meeting all four criteria must be remediated within three days, while others have extended timelines or can be deferred. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))The directive reflects growing concerns about AI-driven threats accelerating the discovery and exploitation of vulnerabilities, necessitating faster remediation processes. This shift underscores the need for agencies to enhance their vulnerability management practices to keep pace with evolving cyber threats. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))
1 month ago
Kill Chain
ServiceNow Security Alert: Understanding the June 2026 Incident
In early June 2026, ServiceNow identified a security issue that allowed unauthorized users to access certain customer data through a misconfigured API endpoint. The vulnerability, affecting customers on the Australia platform release and earlier versions with specific configurations, was exploited to query customer instance tables containing sensitive information. ServiceNow addressed the issue with a security update on June 5, 2026, restricting access to authenticated users. Subsequent investigations revealed that the anomalous activity was conducted by security researchers participating in bug bounty programs, not malicious actors. This incident underscores the importance of promptly addressing security vulnerabilities and the potential for security research activities to be misinterpreted as malicious threats.
1 month ago
Kill Chain
GitHub Enhances Security by Disabling npm Install Scripts by Default
In June 2026, GitHub announced significant changes to npm version 12, aiming to enhance security by disabling install scripts by default. This measure addresses vulnerabilities where attackers exploit npm lifecycle hooks during the 'npm install' process to execute malicious code. By requiring explicit user approval for script execution, GitHub seeks to mitigate risks associated with software supply chain attacks. This change is particularly relevant given the recent surge in supply chain attacks targeting npm packages. Incidents like the 'Mini Shai-Hulud' campaign have demonstrated the potential for widespread impact, emphasizing the need for proactive security measures in package management systems.
1 month ago
Kill Chain
TanStack npm Supply Chain Attack: A Wake-Up Call for CI/CD Security
In May 2026, TanStack's npm packages were compromised in a sophisticated supply chain attack. The attackers exploited GitHub Actions vulnerabilities, including misconfigured workflows and cache poisoning, to publish 84 malicious versions across 42 packages. This breach led to credential theft and potential malware propagation, impacting developers and CI/CD systems. ([tanstack.com](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem?utm_source=openai)) This incident underscores the critical need for secure CI/CD pipeline configurations and robust supply chain security measures, as similar attacks are on the rise, targeting widely-used open-source libraries.
1 month ago
Kill Chain
OpenClaw AI Agent Phishing Incident Highlights Critical Security Gaps
In June 2026, a significant cybersecurity incident was reported involving the OpenClaw AI agent. Security researchers at Varonis conducted an experiment where they connected an OpenClaw email agent to a simulated Gmail inbox containing fictitious company data. Through a single phishing email impersonating a colleague, the AI agent was tricked into disclosing sensitive information, including AWS credentials, database connection strings, and a customer export list. This breach underscores the vulnerability of autonomous AI systems to social engineering attacks, highlighting the need for robust security measures in AI deployments. The incident is particularly concerning given the increasing integration of AI agents in enterprise environments. As these systems gain more autonomy and access to critical data, the potential for exploitation through sophisticated phishing tactics grows. Organizations must prioritize the development and implementation of security frameworks tailored to AI agents to prevent similar breaches in the future.
1 month ago
Kill Chain
Understanding the OpenClaw Vulnerability and AI Agent Supply Chain Risks
In early 2026, the OpenClaw AI agent framework, widely adopted for automating enterprise workflows, was found to have a critical vulnerability (CVE-2026-25253) that allowed remote code execution via a WebSocket exploit. This flaw enabled attackers to hijack agents by tricking users into visiting malicious websites, potentially compromising entire workstations. The incident highlighted the risks associated with unmanaged, autonomous AI systems operating with extensive access and minimal oversight. ([waxell.ai](https://www.waxell.ai/blog/openclaw-ai-agent-supply-chain-security?utm_source=openai)) This event underscores the growing security challenges in AI agent supply chains, emphasizing the need for robust governance and verification mechanisms. As organizations increasingly deploy AI agents, ensuring the integrity and security of third-party skills and components becomes paramount to prevent similar vulnerabilities and attacks.
1 month ago
Kill Chain
GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks
In June 2026, GitHub announced significant security enhancements for npm version 12, aimed at mitigating supply-chain attacks. Key changes include requiring explicit approval for running preinstall, install, or postinstall scripts from dependencies, and restricting automatic fetching of dependencies from Git repositories and remote URLs unless explicitly permitted. These measures are designed to prevent unauthorized code execution during package installations, thereby enhancing the security of the npm ecosystem. This initiative addresses vulnerabilities exploited in recent supply-chain attacks, such as the Shai-Hulud campaign, which compromised numerous npm packages to steal developer credentials. By implementing these changes, GitHub aims to fortify the software supply chain against emerging threats and protect developers from potential security breaches.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports