✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Malicious npm Packages Deliver Infostealers and DDoS Malware
In May 2026, cybersecurity researchers identified four malicious npm packages—chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils—containing infostealer malware and DDoS botnet functionality. These packages, published by the user deadcode09284814, were designed to steal sensitive information and facilitate distributed denial-of-service attacks. Notably, one package was a clone of the Shai-Hulud worm, previously leaked by TeamPCP. This incident underscores the escalating threat of supply chain attacks targeting developers through trusted repositories like npm. The discovery highlights the critical need for developers to exercise caution when integrating third-party packages, as attackers increasingly exploit public repositories to distribute malware. Implementing robust security measures, such as verifying package authenticity and monitoring for suspicious activity, is essential to mitigate the risks associated with supply chain compromises.
2 months ago
Kill Chain
Critical Cybersecurity Incidents: Exchange 0-Day, npm Worm, and Cisco Exploit
In May 2026, a series of significant cybersecurity incidents underscored the vulnerabilities in widely used systems and software. A zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange Server was actively exploited, allowing attackers to execute arbitrary JavaScript via crafted emails, affecting on-premises deployments. Concurrently, the 'Mini Shai-Hulud' campaign compromised multiple npm packages, including those from TanStack and Mistral AI, embedding malicious code to steal credentials and potentially execute destructive actions. Additionally, a critical authentication bypass flaw (CVE-2026-20182) in Cisco Catalyst SD-WAN Controllers was exploited by threat actor UAT-8616 to gain unauthorized access and escalate privileges. These incidents highlight the escalating sophistication of supply chain attacks and the critical need for robust security measures across all software dependencies. Organizations must prioritize patching known vulnerabilities, implement stringent access controls, and continuously monitor for anomalous activities to mitigate the risks posed by such multifaceted threats.
2 months ago
Kill Chain
Mini Shai-Hulud Attack: A Wake-Up Call for Developer Ecosystem Security
Between April 29 and May 1, 2026, a coordinated supply chain attack known as "Mini Shai-Hulud" targeted multiple developer ecosystems, including npm, PyPI, and Docker Hub. The threat actor group TeamPCP injected malicious code into widely used packages such as SAP's Cloud Application Programming Model, PyTorch Lightning, and Intercom's npm package. This malware harvested sensitive credentials from developer environments and CI/CD pipelines, including GitHub tokens, cloud API keys, and SSH keys, by exfiltrating them to attacker-controlled repositories. The attack compromised over 170 packages, affecting millions of developers and organizations worldwide. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-supply-chain-20260503-csa/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, which now focus on developer workstations as entry points. The integration of malicious code into trusted packages highlights the need for enhanced security measures in the software development lifecycle, particularly in dependency management and CI/CD processes. Organizations must adopt comprehensive strategies to protect against such sophisticated threats.
2 months ago
Kill Chain
Grafana GitHub Token Breach: Codebase Theft and Extortion Attempt in 2026
In May 2026, Grafana Labs disclosed a security incident where an unauthorized party obtained a token granting access to the company's GitHub environment, enabling the download of its codebase. The attacker attempted to extort the company by demanding payment to prevent the public release of the stolen code. Grafana's investigation confirmed that no customer data or personal information was accessed, and there was no impact on customer systems or operations. The compromised credentials were invalidated, and additional security measures were implemented to prevent future unauthorized access. This incident underscores the persistent threat of supply chain attacks targeting software development environments. Organizations are increasingly facing sophisticated extortion attempts, highlighting the need for robust security practices, including vigilant monitoring of access credentials and comprehensive incident response plans.
2 months ago
Kill Chain
Critical Privilege Escalation Vulnerability in Microsoft Azure AKS Exposes Security Disclosure Challenges
In March 2026, security researcher Justin O'Leary identified a critical privilege escalation vulnerability in Microsoft Azure Kubernetes Service (AKS). This flaw allowed users with the 'Backup Contributor' role to gain cluster-admin access without prior Kubernetes permissions. Despite reporting the issue to Microsoft on March 17, the company rejected the report on April 13, claiming the behavior was expected and did not constitute a security vulnerability. Subsequently, O'Leary escalated the matter to the CERT Coordination Center, which validated the vulnerability and assigned it the identifier VU#284781. However, Microsoft intervened to prevent the issuance of a CVE, maintaining that no product changes were necessary. This incident underscores the challenges in vulnerability disclosure processes and the importance of transparent communication between researchers and vendors to ensure the security of cloud services.
2 months ago
Kill Chain
Claude Mythos: AI's Leap in Cybersecurity Threats
In April 2026, Anthropic unveiled Claude Mythos, an advanced AI model capable of autonomously identifying and exploiting thousands of high-severity vulnerabilities across major operating systems and web browsers. This AI demonstrated the ability to perform complex multi-step network attacks in significantly reduced timeframes, surpassing human capabilities in vulnerability discovery and exploitation. The emergence of such AI tools has raised substantial concerns within the cybersecurity community regarding the potential for accelerated cyberattacks and the need for enhanced defensive measures. The rapid advancement of AI in cybersecurity underscores the urgency for organizations to adapt their security strategies. Traditional defense mechanisms may no longer suffice against AI-driven threats, necessitating the adoption of automated defenses, improved vulnerability management, and architectural adaptations to mitigate the risks posed by these powerful AI capabilities.
2 months ago
Kill Chain
CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies
In 2025, a series of sophisticated cyberattacks targeted Continuous Integration and Continuous Deployment (CI/CD) pipelines, exploiting vulnerabilities within these automated software delivery systems. Attackers gained unauthorized access to build servers and developer environments, injecting malicious code that was seamlessly integrated into legitimate software releases. This method allowed adversaries to distribute malware widely, compromising numerous organizations and leading to significant data breaches and operational disruptions. The incidents underscored the critical need for enhanced security measures within CI/CD processes to prevent such supply chain attacks. These attacks highlight a growing trend where cybercriminals focus on the software supply chain, recognizing the potential to infiltrate multiple organizations through a single compromised pipeline. The increasing reliance on automated development tools necessitates a reevaluation of security protocols to safeguard against such pervasive threats.
2 months ago
Kill Chain
Understanding the REMUS Infostealer: A 2026 Cybersecurity Threat
In early 2026, the REMUS infostealer emerged as a significant threat in the cybercrime landscape. Evolving from the Lumma Stealer family, REMUS introduced advanced capabilities such as session theft, targeting password managers, and utilizing blockchain-based command-and-control mechanisms. Its rapid development and commercialization reflect a shift towards malware-as-a-service (MaaS) models, enabling continuous updates and operational scalability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/?utm_source=openai)) The emergence of REMUS underscores the increasing sophistication of cyber threats, highlighting the need for organizations to enhance their security measures against evolving malware tactics and the growing prevalence of MaaS platforms.
2 months ago
Kill Chain
Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites
In May 2026, two critical vulnerabilities were discovered in the Avada Builder WordPress plugin, affecting over one million active installations. The first, CVE-2026-4782, is an arbitrary file read vulnerability exploitable by authenticated users with at least subscriber-level access, allowing them to read sensitive files on the server. The second, CVE-2026-4798, is a time-based blind SQL injection vulnerability that can be exploited without authentication, enabling attackers to extract sensitive information from the database, including password hashes. Both vulnerabilities have been patched in version 3.15.3 of the plugin. This incident underscores the importance of timely software updates and the potential risks associated with widely used plugins. Organizations should prioritize patch management and consider implementing additional security measures to protect against similar vulnerabilities in the future.
2 months ago
Kill Chain
Node-ipc npm Package Compromised: A Wake-Up Call for Open-Source Security
In May 2026, malicious versions of the widely used node-ipc npm package were published, introducing credential-stealing malware into applications. The compromised versions—9.1.6, 9.2.3, and 12.0.1—contained obfuscated code that, upon execution, harvested sensitive information such as cloud credentials, SSH keys, and CI/CD secrets. This data was exfiltrated through DNS TXT queries to attacker-controlled infrastructure. The attack was facilitated by the compromise of a maintainer's account, allowing unauthorized publication of these malicious versions. ([stepsecurity.io](https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises, as the reliance on third-party packages continues to grow.
2 months ago
Kill Chain
Pwn2Own Berlin 2026: Critical Zero-Day Exploits in Microsoft Exchange and Windows 11
During the second day of Pwn2Own Berlin 2026, security researchers demonstrated 15 unique zero-day vulnerabilities across multiple products, including Microsoft Exchange, Windows 11, and Red Hat Enterprise Linux for Workstations. Notably, Cheng-Da Tsai of the DEVCORE Research Team earned $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Additionally, Siyeon Wi exploited an integer overflow bug to hack Windows 11, and Ben Koo of Team DDOS escalated privileges to root on Red Hat Enterprise Linux for Workstations, earning $7,500 and $10,000 respectively. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/?utm_source=openai)) This incident underscores the persistent vulnerabilities in widely used enterprise software and highlights the critical need for organizations to prioritize timely patching and robust security measures to mitigate the risks associated with zero-day exploits.
2 months ago
Kill Chain
Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft
In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages. This flaw, present in versions prior to 3.15.0.3, allowed unauthenticated attackers to modify the plugin's global settings via an unprotected checkout endpoint, leading to the execution of malicious code on checkout pages. The injected code facilitated a payment card skimmer that stole sensitive customer information, including credit card numbers, CVVs, billing addresses, and other personal data. FunnelKit addressed the vulnerability by releasing version 3.15.0.3, urging users to update immediately and review their settings for any unauthorized scripts. This incident underscores the persistent threat posed by vulnerabilities in widely-used plugins, emphasizing the need for regular updates and vigilant monitoring of third-party components in web applications. The exploitation of such vulnerabilities can lead to significant data breaches, financial loss, and reputational damage for businesses, highlighting the critical importance of proactive cybersecurity measures.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports