✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Security Breach: Unauthorized Access to Anthropic's Claude Mythos AI Model
In April 2026, Anthropic's advanced AI model, Claude Mythos, designed for cybersecurity applications, was accessed without authorization through a third-party vendor environment. The breach occurred on the same day the model was announced, with individuals from an online forum exploiting the access. Anthropic is investigating the incident and has not found evidence of broader system compromise. This incident underscores the challenges in securing powerful AI models, especially when third-party vendors are involved. It highlights the need for stringent access controls and monitoring to prevent unauthorized access to sensitive technologies.
3 months ago
Kill Chain
Critical Remote Code Execution Vulnerability in GitHub Enterprise Server (CVE-2026-3854)
In March 2026, a critical vulnerability (CVE-2026-3854) was identified in GitHub Enterprise Server, allowing authenticated users with push access to execute arbitrary code on the server through a crafted 'git push' command. The flaw stemmed from improper sanitization of user-supplied push option values, which were incorporated into internal service headers without adequate validation. This oversight enabled attackers to inject malicious metadata fields, leading to remote code execution. GitHub promptly addressed the issue by releasing patches for affected versions, including 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, and 3.19.4. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-3854?utm_source=openai)) This incident underscores the critical importance of rigorous input validation and prompt patch management in safeguarding software supply chains. As organizations increasingly rely on platforms like GitHub for code collaboration and deployment, ensuring the security of these infrastructures is paramount to prevent potential exploitation and maintain trust in software development processes.
3 months ago
Kill Chain
LofyGang's LofyStealer: A New Threat to Minecraft Players in 2026
In April 2026, the Brazilian cybercrime group LofyGang re-emerged after a three-year hiatus, launching a campaign targeting Minecraft players with a new malware known as LofyStealer. Disguised as a Minecraft hack named 'Slinky,' the malware uses the official game icon to deceive users into execution. Once activated, it deploys a JavaScript loader that installs LofyStealer ('chromelevator.exe') directly into the system memory. This stealer harvests sensitive data—including cookies, passwords, tokens, credit card information, and International Bank Account Numbers (IBANs)—from various web browsers such as Google Chrome, Microsoft Edge, Brave, Opera, Mozilla Firefox, and Avast Browser. The exfiltrated data is then transmitted to a command-and-control server controlled by the attackers. This incident underscores a significant shift in LofyGang's tactics from previous methods like typosquatting on npm packages to a malware-as-a-service (MaaS) model, offering both free and premium tiers. The campaign highlights the persistent threat posed by cybercriminals exploiting trusted platforms and popular games to distribute malicious software, emphasizing the need for heightened vigilance among users and robust security measures to protect sensitive information.
3 months ago
Kill Chain
Critical LiteLLM SQL Injection Vulnerability Exploited - CVE-2026-42208
In April 2026, a critical pre-authentication SQL injection vulnerability, identified as CVE-2026-42208, was discovered in LiteLLM, an open-source large-language model gateway. This flaw allowed unauthenticated attackers to send specially crafted Authorization headers to any LLM API route, enabling them to read and modify the proxy's database, including sensitive information such as API keys and provider credentials. Exploitation of this vulnerability began approximately 36 hours after its public disclosure, with attackers demonstrating targeted knowledge by directly accessing tables containing API keys, provider credentials, and configuration data. The maintainers addressed the issue by releasing LiteLLM version 1.83.7, which replaced string concatenation with parameterized queries to prevent such attacks. Organizations using LiteLLM were advised to upgrade immediately and rotate all stored credentials to mitigate potential compromises. This incident underscores the critical importance of prompt vulnerability management and the need for robust security practices in managing AI infrastructure. The rapid exploitation of CVE-2026-42208 highlights the increasing sophistication of threat actors and the necessity for organizations to stay vigilant against emerging vulnerabilities in widely used open-source tools.
3 months ago
Kill Chain
Vimeo's Data Breach: A Cautionary Tale of Supply Chain Vulnerabilities
In April 2026, Vimeo disclosed a data breach resulting from a security incident at Anodot, a third-party analytics vendor. Unauthorized actors accessed certain Vimeo user and customer data, including technical data, video titles, metadata, and, in some cases, customer email addresses. The breach did not compromise video content, user login credentials, or payment information. The extortion group ShinyHunters claimed responsibility, threatening to publish the stolen data unless a ransom was paid. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/video-service-vimeo-confirms-anodot-breach-exposed-user-data/?utm_source=openai)) This incident underscores the critical importance of securing third-party integrations, as attackers increasingly exploit supply chain vulnerabilities to access sensitive data. Organizations must rigorously assess and monitor their vendors' security practices to mitigate such risks.
3 months ago
Kill Chain
Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202
In April 2026, Microsoft disclosed a spoofing vulnerability in Windows Shell, identified as CVE-2026-32202, with a CVSS score of 4.3. This flaw allows unauthorized attackers to perform network-based spoofing attacks, potentially leading to information disclosure. Exploitation requires user interaction, such as executing a malicious file. Microsoft addressed this vulnerability in its April Patch Tuesday update. The active exploitation of CVE-2026-32202 underscores the persistent threat posed by nation-state actors like APT28, who have previously exploited similar vulnerabilities. Organizations must remain vigilant, as attackers continually adapt their methods to bypass security measures, emphasizing the need for timely patching and robust security practices.
3 months ago
Kill Chain
Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis
In March 2026, application security firm Checkmarx experienced a significant security breach when the LAPSUS$ threat group exploited credentials obtained from the Trivy supply chain attack, attributed to TeamPCP. This access allowed the attackers to infiltrate Checkmarx's GitHub repositories, leading to the publication of malicious code and the subsequent leak of sensitive data. The compromised data, totaling 96GB, was later made available on both dark web and clearnet platforms. Checkmarx has confirmed that the leaked data originated from their GitHub repository and is actively investigating the incident to assess the full scope of the breach. This incident underscores the escalating threat posed by supply chain attacks, where compromising a single component can have cascading effects across multiple organizations. The Checkmarx breach highlights the critical need for robust security measures within development pipelines and the importance of securing third-party tools to prevent unauthorized access and data exfiltration.
3 months ago
Kill Chain
GopherWhisper APT Group's 2026 Cyber Espionage Campaign
In April 2026, cybersecurity researchers identified a previously undocumented state-sponsored threat actor named GopherWhisper, active since at least 2023 and linked to China. This group targeted governmental institutions, notably in Mongolia, deploying a suite of custom malware primarily written in Go. GopherWhisper's toolkit includes backdoors such as LaxGopher, RatGopher, and BoxOfFriends, which exploit legitimate services like Slack, Discord, and Microsoft 365 Outlook for command-and-control communications. Additionally, the group utilized the CompactGopher tool to exfiltrate data via the file-sharing service file.io. These sophisticated tactics enabled the attackers to blend malicious activities with normal network traffic, complicating detection efforts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/?utm_source=openai)) The discovery of GopherWhisper underscores a growing trend among threat actors to abuse widely used communication platforms for cyber espionage. This incident highlights the necessity for organizations to implement robust monitoring and anomaly detection systems to identify unauthorized use of legitimate services, as traditional security measures may be insufficient against such covert operations.
3 months ago
Kill Chain
Vercel Security Breach 2026: Context.ai OAuth Compromise
In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of non-sensitive environment variables, including API keys and database credentials. The threat actor, identifying as ShinyHunters, has demanded a $2 million ransom for the stolen data. Vercel has engaged incident response experts, notified law enforcement, and advised affected customers to rotate credentials and audit deployments. The company's open-source projects, such as Next.js and Turbopack, remain unaffected. This incident underscores the critical importance of stringent third-party application security and the potential risks associated with OAuth permissions. Organizations are urged to review and tighten their third-party integrations and access controls to prevent similar supply chain attacks.
3 months ago
Kill Chain
Checkmarx KICS Supply Chain Breach: A 2026 Case Study
In April 2026, Checkmarx's KICS analysis tool suffered a significant supply chain attack. Threat actors compromised Docker images and VS Code extensions associated with KICS, embedding malware designed to harvest sensitive data from developer environments. The malware targeted credentials such as GitHub tokens, cloud service keys, and SSH keys, exfiltrating them to domains mimicking legitimate Checkmarx infrastructure. The breach was active between April 22, 2026, 14:17:59 UTC and April 22, 2026, 15:41:31 UTC, during which malicious artifacts were distributed through official channels. This incident underscores the escalating trend of supply chain attacks targeting development tools, emphasizing the need for enhanced security measures in software distribution pipelines. Organizations must remain vigilant, as such attacks can lead to widespread credential theft and unauthorized access to critical systems.
3 months ago
Kill Chain
Apple Addresses iOS Vulnerability Exposing Deleted Signal Messages
In April 2026, Apple addressed a critical vulnerability (CVE-2026-28950) in iOS and iPadOS that caused notifications marked for deletion to be unexpectedly retained on devices. This flaw allowed law enforcement agencies, notably the FBI, to extract deleted Signal message previews from an iPhone's notification database, even after the app was uninstalled. The issue was resolved through improved data redaction in iOS 26.4.2 and iPadOS 26.4.2 updates. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/23/cve-2026-28950-iphone-vulnerability-notifications-signal/?utm_source=openai)) This incident underscores the importance of comprehensive data deletion processes within operating systems, especially concerning encrypted messaging applications. It highlights the need for users to be aware of potential data remnants and for developers to ensure that sensitive information is thoroughly purged to maintain user privacy.
3 months ago
Kill Chain
Critical Vulnerability in Breeze Cache WordPress Plugin (CVE-2026-3844)
In April 2026, a critical vulnerability (CVE-2026-3844) was discovered in the Breeze Cache WordPress plugin, affecting versions up to 2.4.4. This flaw allows unauthenticated attackers to upload arbitrary files via the 'fetch_gravatar_from_remote' function, potentially leading to remote code execution and full site compromise. The issue is exploitable only when the 'Host Files Locally - Gravatars' feature is enabled, which is disabled by default. Cloudways, the plugin's developer, released version 2.4.5 to address this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai)) The active exploitation of this vulnerability underscores the persistent targeting of WordPress plugins by threat actors. Website administrators are urged to promptly update to the latest plugin version or disable the affected feature to mitigate risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai))
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports