✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Instructure's Canvas Platform Breached Twice by ShinyHunters in May 2026
In early May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks by the ShinyHunters group. The initial breach on April 29 exposed sensitive data of approximately 275 million users across nearly 9,000 educational institutions, including names, email addresses, student ID numbers, and private messages. Despite Instructure's efforts to secure the system, ShinyHunters re-compromised Canvas on May 7, defacing login pages and issuing ransom demands. The attacks disrupted operations during critical exam periods, leading to delays and cancellations of final exams at numerous colleges and universities. In response, Instructure reached an agreement with the attackers, reportedly paying a ransom to secure the return and destruction of the stolen data, though the exact terms were not disclosed. This incident underscores the escalating threat of cyberattacks targeting educational institutions and the challenges in safeguarding sensitive student and staff information. ([techradar.com](https://www.techradar.com/pro/security/us-congress-calls-instructure-ceo-as-it-investigates-canvas-breach?utm_source=openai))
2 months ago
Kill Chain
Instructure Canvas Breach: A Wake-Up Call for Educational Cybersecurity
In May 2026, Instructure, the company behind the Canvas learning management system, suffered a significant data breach orchestrated by the hacking group ShinyHunters. The attackers exploited vulnerabilities to access and exfiltrate approximately 3.65 terabytes of data, affecting nearly 275 million individuals across 8,809 educational institutions worldwide. The compromised information included names, email addresses, student ID numbers, and private messages between students and staff. Following the initial breach, ShinyHunters escalated their attack by defacing Canvas login portals, disrupting access during critical academic periods and demanding a ransom to prevent the public release of the stolen data. This incident underscores the escalating threat posed by cybercriminal groups targeting educational institutions, highlighting the critical need for robust cybersecurity measures and incident response strategies. The breach also raises concerns about the effectiveness of paying ransoms, as Instructure's decision to negotiate with the attackers has sparked debate over best practices in handling such extortion attempts.
2 months ago
Kill Chain
OpenAI's Response to the TanStack npm Supply Chain Attack
In May 2026, OpenAI disclosed that two employee devices were compromised due to a supply chain attack involving the TanStack npm library, part of the broader 'Mini Shai-Hulud' campaign. The attackers published 84 malicious versions across 42 TanStack packages, leading to unauthorized access and credential-focused exfiltration activities. OpenAI's investigation confirmed that only limited credential material was exfiltrated, with no evidence of user data, production systems, or intellectual property being compromised. ([openai.com](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely used open-source libraries, emphasizing the need for robust security measures in software development and deployment processes. Organizations are urged to enhance their monitoring and validation of third-party components to mitigate such risks.
2 months ago
Kill Chain
OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security
In May 2026, cybersecurity researchers identified four critical vulnerabilities in OpenClaw, an AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—enable attackers to bypass sandbox restrictions, escalate privileges, and establish persistent control over affected systems. Exploitation could lead to unauthorized data access, system configuration tampering, and the planting of backdoors, significantly compromising system integrity and security. The discovery of these vulnerabilities underscores the urgent need for robust security measures in AI agent frameworks. As AI systems become more integrated into critical operations, ensuring their security is paramount to prevent potential exploitation by malicious actors.
2 months ago
Kill Chain
mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks
Between April 14 and April 21, 2026, a DShield sensor detected 24 unique IP addresses executing the 'mdrfckr' campaign, a known botnet operation active since 2018. The attackers utilized the SSH client banner 'SSH-2.0-libssh_0.11.1' and produced the hassh fingerprint '03a80b21afa810682a776a7d42e5e6fb', indicating an evolution in their tooling. The campaign's tactics, including writing a persistent SSH key and executing reconnaissance commands, remained consistent with previous observations. This incident underscores the adaptability of threat actors in updating their tools while maintaining established attack methodologies. Organizations should enhance their detection capabilities to identify new SSH client fingerprints associated with known malicious campaigns.
2 months ago
Kill Chain
EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot
In June 2025, security researchers discovered 'EchoLeak' (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. This flaw allowed attackers to exfiltrate sensitive enterprise data, including chat logs, OneDrive files, SharePoint content, and Teams messages, without any user interaction. The attack was initiated through a crafted email that, when processed by Copilot, triggered unauthorized data access and transmission. Microsoft promptly addressed the vulnerability upon disclosure, mitigating potential exploitation. ([techrepublic.com](https://www.techrepublic.com/article/news-microsoft-365-copilot-flaw-echoleak/?utm_source=openai)) The EchoLeak incident underscores the critical need for robust security measures in AI-integrated systems. As AI becomes more embedded in enterprise environments, ensuring comprehensive logging, visibility, and compliance with emerging regulations like the EU AI Act's traceability requirements is paramount to prevent similar vulnerabilities.
2 months ago
Kill Chain
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
In May 2026, Palo Alto Networks' Unit 42 identified a new variant of the Gremlin Stealer malware, which has evolved from a basic credential harvester into a sophisticated modular toolkit. This variant employs advanced obfuscation techniques, including concealing malicious payloads within embedded resource files and utilizing instruction virtualization to evade detection. Gremlin Stealer targets sensitive information such as payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP and VPN credentials, exfiltrating this data to attacker-controlled servers for potential exploitation. The rapid evolution of Gremlin Stealer underscores a broader trend in the cyber threat landscape, where infostealers are becoming more sophisticated and harder to detect. This development highlights the urgent need for organizations to enhance their cybersecurity measures, particularly in monitoring and defending against advanced malware that employs complex evasion tactics.
2 months ago
Kill Chain
TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale
In May 2026, the TeamPCP hacker group infiltrated Mistral AI's codebase management system, exfiltrating nearly 5 gigabytes of internal repositories and source code. This breach was part of the broader 'Mini Shai-Hulud' supply-chain attack, which compromised official packages from TanStack and Mistral AI through stolen CI/CD credentials and legitimate workflows. The attackers are now demanding $25,000 for the stolen data, threatening to leak it publicly if a buyer isn't found within a week. This incident underscores the escalating threat of supply-chain attacks targeting software development processes. Organizations must prioritize securing their CI/CD pipelines and implement robust monitoring to detect unauthorized access promptly.
2 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in Burst Statistics WordPress Plugin (CVE-2026-8181)
In May 2026, a critical authentication bypass vulnerability, CVE-2026-8181, was discovered in the Burst Statistics WordPress plugin, affecting versions 3.4.0 and 3.4.1. This flaw allowed unauthenticated attackers to impersonate administrator accounts by exploiting improper handling of authentication functions, potentially leading to full site compromise. The vulnerability was actively exploited shortly after disclosure, with over 7,400 attacks recorded within 24 hours. This incident underscores the persistent threat posed by vulnerabilities in widely used WordPress plugins. It highlights the importance of prompt patching and vigilant monitoring, as attackers rapidly exploit such flaws to gain unauthorized access and control over websites.
2 months ago
Kill Chain
Malicious 'node-ipc' Versions Compromise Developer Credentials
On May 14, 2026, malicious versions of the widely used npm package 'node-ipc' were published, specifically versions 9.1.6, 9.2.3, and 12.0.1. These versions contained obfuscated backdoor code designed to steal developer credentials, including cloud service keys, SSH keys, and other sensitive information. The malware executed upon requiring the package, exfiltrating data to an attacker-controlled server. The compromised versions were published by an unauthorized account, indicating a potential maintainer account takeover. ([thehackernews.com](https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises. The event highlights the necessity for continuous monitoring and verification of third-party dependencies to safeguard against unauthorized code injections.
2 months ago
Kill Chain
Understanding the Risks: AI Integration and Cloud Security
In 2025, the enterprise risk landscape experienced a paradigm shift: the adoption of AI and LLMs officially becoming the primary driver of cloud risk. Today, almost 88% of organizations now leverage AI in at least one business function. With this level of integration, the risk of AI is now outpacing traditional security guardrails, culminating in a highly complex and interconnected attack surface. SentinelOne’s new AI and Cloud Verified Exploit Paths and Secrets Scanning Report examines this evolving threatscape and draws on telemetry from over 11,000 anonymized customer environments to offer deeper visibility into how threat actors are actively exploiting modern cloud and AI infrastructures. A primary finding of the 2026 report is the rising proliferation of AI-specific credentials. The data indicates that AI-related secrets — such as OpenAI API Keys, Azure OpenAI API Keys, and others — increased by approximately 140% in a span of one year. This growth correlates directly with the rapid embedding of AI technologies into customer support systems, internal tooling, financial platforms, and product experiences. Ubiquitous deployment has generated a widespread organizational pattern known as 'shadow AI' – the unsanctioned use of AI tools in an environment without formal IT approval or security oversight. In practice, this occurs when developers or internal teams utilize unmanaged or personal LLM keys to process corporate data outside of sanctioned IT or security channels. Since these AI integrations span numerous internal applications, the same API keys are frequently duplicated and stored within code repositories, SaaS configurations, and development scripts. Compounding this, these credentials are often implemented without proper access controls or routine rotation schedules. The sprawl of these credentials renders them difficult to track via standard secrets management protocols, establishing a requirement for more centralized governance over how AI keys are issued and utilized.
2 months ago
Kill Chain
GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems
In May 2026, a campaign named 'GemStuffer' exploited over 150 RubyGems packages to exfiltrate data scraped from UK local government portals. Unlike typical supply chain attacks that aim to distribute malware to developers, this operation utilized the RubyGems registry as a storage and retrieval channel for the exfiltrated data. The attackers published numerous packages containing scripts that collected public data from government websites and then uploaded this data back to RubyGems, effectively using the platform as a 'dead drop' for data storage. This method allowed the threat actors to bypass traditional command-and-control infrastructures, making detection more challenging. ([thecodingzebra.com](https://www.thecodingzebra.com/cybersecurity/gemstuffer-abuses-150-rubygems/?utm_source=openai)) This incident underscores a novel abuse of software package registries, highlighting the need for enhanced monitoring and security measures within these ecosystems. The use of legitimate platforms for data exfiltration represents an evolution in threat actor tactics, emphasizing the importance of vigilance in software supply chain security. ([cyberleveling.com](https://cyberleveling.com/blog/rubygems-gemstuffer-supply-chain-2026?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports