✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack
On April 29, 2026, a sophisticated supply chain attack targeted SAP's JavaScript and cloud application development ecosystem by compromising several npm packages, including mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, and @cap-js/sqlite@2.2.2. The attackers introduced a preinstall script that downloaded and executed a malicious payload via the Bun JavaScript runtime, enabling the theft of developer credentials, GitHub and npm tokens, and cloud service secrets. The stolen data was exfiltrated to public GitHub repositories created on the victims' accounts, labeled with the description 'A Mini Shai-Hulud has Appeared.' ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments, particularly within widely-used frameworks like SAP's CAP model. The attack's sophistication, including its ability to propagate through developer workflows and exploit AI coding agent configurations, highlights the need for enhanced security measures in software development pipelines. ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai))
3 months ago
Kill Chain
CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2024-1708, a path traversal flaw in ConnectWise ScreenConnect, and CVE-2026-32202, a protection mechanism failure in Microsoft Windows Shell. CVE-2024-1708 allows remote code execution or unauthorized access to sensitive data, while CVE-2026-32202 enables network-based spoofing attacks. Both vulnerabilities have been actively exploited by threat actors, including the China-based group Storm-1175 deploying Medusa ransomware and the Russian APT28 targeting Ukraine and EU countries. Federal agencies are mandated to remediate these vulnerabilities by May 12, 2026. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by state-sponsored actors exploiting known flaws. Organizations must prioritize patching and enhance monitoring to mitigate risks associated with these and similar vulnerabilities.
3 months ago
Kill Chain
Credential-Stealing Malware Found in Official SAP npm Packages
In April 2026, a sophisticated supply chain attack targeted SAP's Cloud Application Programming Model (CAP) by compromising four official npm packages: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The attackers, identified as TeamPCP, injected malicious 'preinstall' scripts into these packages, which, upon installation, executed a multi-stage payload designed to steal a wide array of credentials from developers' systems and CI/CD environments. The stolen data included npm and GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud. The malware also attempted to extract secrets directly from the CI runner's memory, bypassing standard log masking mechanisms. The exfiltrated data was encrypted and uploaded to public GitHub repositories under the victim's account, with descriptions indicating the presence of 'A Mini Shai-Hulud.' This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools and the necessity for robust security measures in software development pipelines.
3 months ago
Kill Chain
BlueNoroff's AI-Driven Fake Zoom Attacks on Crypto Executives
In April 2026, the North Korean state-sponsored hacking group BlueNoroff launched a sophisticated campaign targeting cryptocurrency executives. The attackers impersonated trusted contacts to schedule fake Zoom meetings, utilizing AI-generated avatars and stolen video footage to create convincing virtual environments. During these meetings, victims were prompted to install malicious software under the guise of resolving technical issues, leading to the installation of malware designed for credential theft, persistent access, and cryptocurrency wallet exfiltration. This campaign underscores the evolving threat landscape where attackers leverage advanced social engineering techniques and AI to enhance the credibility of their schemes. Organizations, especially in the cryptocurrency sector, must remain vigilant against such deceptive tactics and implement robust security measures to protect against these sophisticated attacks.
3 months ago
Kill Chain
Critical cPanel Authentication Vulnerability: Immediate Action Required
In April 2026, cPanel identified a critical authentication vulnerability affecting all supported versions of its software, potentially allowing unauthorized access to control panel interfaces. The issue was addressed with patches released on April 28, 2026, for versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.136.0.5, and 11.134.0.20. Organizations were urged to update their systems promptly to mitigate the risk of exploitation. ([thehackernews.com](https://thehackernews.com/2026/04/critical-cpanel-authentication.html?utm_source=openai)) This incident underscores the importance of timely patch management and proactive security measures, as attackers were reportedly exploiting the vulnerability before the patch was available. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/cpanel-authentication-bypass-was.html?utm_source=openai))
3 months ago
Kill Chain
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
On April 28, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions 23.9.7 and prior, and CVE-2026-32202, a Windows Shell protection mechanism failure. CVE-2024-1708 allows attackers to execute remote code or access sensitive data by exploiting improper path handling, while CVE-2026-32202 enables attackers to steal NTLMv2 hashes without user interaction, leading to potential unauthorized access. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2024-1708/?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by actively exploited security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate risks associated with remote code execution and unauthorized data access, which can lead to significant operational disruptions and data breaches.
3 months ago
Kill Chain
DPRK-Linked Supply Chain Attack on Axios npm Package in 2026
In March 2026, North Korean state-sponsored hackers, identified as UNC1069, executed a sophisticated supply chain attack by compromising the widely-used JavaScript library Axios. The attackers gained access to the maintainer's npm account and published malicious versions 1.14.1 and 0.30.4, which included a remote access trojan (RAT). This malware granted the attackers control over infected systems, potentially leading to credential theft and persistent access. The malicious versions were available for approximately three hours before detection and removal, during which time they were downloaded millions of times, posing a significant risk to developers and organizations worldwide. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations must implement stringent monitoring and verification processes to safeguard against such vulnerabilities.
3 months ago
Kill Chain
Claude Mythos AI Enhances Firefox Security with 271 Vulnerability Fixes
In April 2026, Mozilla collaborated with Anthropic to utilize the advanced AI model, Claude Mythos, for a comprehensive security audit of Firefox. This partnership led to the identification and remediation of 271 vulnerabilities in Firefox 150, marking a significant advancement in AI-assisted cybersecurity. The vulnerabilities ranged from minor issues to critical flaws, all of which were addressed in the latest release. This initiative underscores the potential of AI in enhancing software security by rapidly detecting and mitigating vulnerabilities that might elude traditional methods. The success of this collaboration highlights a pivotal shift in cybersecurity, where defenders can leverage AI to gain a decisive advantage over potential threats. As AI tools become more sophisticated, their integration into security protocols is expected to become standard practice, offering a proactive approach to threat detection and resolution.
3 months ago
Kill Chain
Vercel's 2026 Security Breach: A Wake-Up Call for Third-Party Integration Risks
In April 2026, Vercel, a cloud development platform known for supporting frameworks like Next.js, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, posing potential risks to customer data. The breach underscores the vulnerabilities associated with interconnected systems and the importance of stringent access controls. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident/?utm_source=openai)) This incident highlights the growing threat landscape where attackers leverage third-party integrations to gain unauthorized access to enterprise systems. Organizations must reassess their security postures, especially concerning third-party tools, to mitigate such risks effectively.
3 months ago
Kill Chain
Exploring AI Security: The 'Otto Support' MCP Challenge
In April 2026, Bishop Fox introduced 'Otto Support,' a Capture-The-Flag (CTF) challenge designed to expose vulnerabilities in Model Context Protocol (MCP)-based AI systems. This hands-on exercise simulates real-world attack scenarios where AI assistants interact with tools, services, and local resources, highlighting potential security flaws in modern AI architectures. Participants are tasked with escalating privileges, exfiltrating data, and executing code, thereby uncovering how MCP-enabled systems can be exploited in practice. The relevance of this challenge is underscored by the rapid adoption of AI technologies and the corresponding emergence of new attack surfaces. As organizations integrate AI assistants into their operations, understanding and mitigating the security risks associated with MCP-based systems becomes imperative to prevent potential breaches and maintain trust in AI-driven processes.
3 months ago
Kill Chain
Navigating the Cybersecurity Challenges of Frontier AI Models in 2026
In April 2026, the cybersecurity landscape witnessed a significant shift with the emergence of frontier AI models like Anthropic's Claude Mythos. These advanced AI systems demonstrated unprecedented capabilities in autonomously identifying and exploiting software vulnerabilities, effectively performing tasks that previously required extensive human expertise. The rapid development and deployment of such models have raised concerns about their potential misuse, as they can lower the barrier for launching sophisticated cyberattacks and accelerate the exploitation of vulnerabilities across critical infrastructures. ([weforum.org](https://www.weforum.org/stories/2026/04/anthropic-mythos-ai-cybersecurity/?utm_source=openai)) This development underscores the urgent need for organizations to reassess their cybersecurity strategies. The dual-use nature of frontier AI models means they can be harnessed for both defensive and offensive purposes, necessitating robust governance frameworks and collaborative efforts between AI developers, cybersecurity professionals, and policymakers to mitigate emerging risks and ensure the safe deployment of these powerful technologies. ([openai.com](https://openai.com/index/frontier-ai-regulation/?utm_source=openai))
3 months ago
Kill Chain
NASA Employees Targeted in Chinese Phishing Scheme
Between January 2017 and December 2021, Chinese national Song Wu orchestrated a sophisticated spear-phishing campaign targeting NASA, the U.S. military, universities, and private companies. By impersonating U.S. researchers and engineers, Wu successfully obtained sensitive aerospace software and source code, violating U.S. export control laws. The scheme led to unauthorized access to defense-related technologies, posing significant national security risks. In September 2024, Wu was indicted on multiple counts of wire fraud and aggravated identity theft but remains at large. This incident underscores the persistent threat of state-sponsored cyber espionage and the critical need for robust cybersecurity measures to protect sensitive information. Organizations must remain vigilant against increasingly sophisticated phishing tactics employed by foreign adversaries.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports