✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Dutch Authorities Dismantle €100 Million Investment Fraud Network
In July 2026, Dutch authorities dismantled a sophisticated international investment fraud scheme that operated 20 call centers across multiple countries, employing over 700 individuals posing as financial advisors. The organization is estimated to have defrauded tens of thousands of victims, amassing over €100 million per month at its peak. The fraudsters built trust with victims over extended periods, introducing them to realistic-looking investment platforms that displayed fictitious profits. Victims were persuaded to increase their investments, often through cryptocurrency transfers, while the criminals siphoned the funds and presented fake dashboards showing inflated returns. This incident underscores the evolving complexity and scale of cyber-enabled financial fraud, highlighting the need for enhanced vigilance and regulatory measures in the financial sector. The use of sophisticated social engineering tactics and the exploitation of cryptocurrency platforms for illicit gains reflect broader trends in cybercrime, necessitating continuous adaptation of security strategies by organizations and individuals alike.
1 week ago
Kill Chain
Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts
In July 2026, a critical vulnerability named 'PromptFiction' was discovered in Anthropic's Claude Desktop application. This flaw allowed attackers to automatically submit malicious prompts to the AI assistant without any user interaction, leveraging a custom URI scheme ('claude://') to execute commands upon clicking a crafted link. Exploiting this, attackers could exfiltrate sensitive user data and potentially execute remote code on the victim's machine. The vulnerability was promptly patched in Claude Desktop version 1.1.2321. This incident underscores the evolving nature of prompt injection attacks, highlighting the need for robust security measures in AI applications to prevent unauthorized access and data breaches.
1 week ago
Kill Chain
Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution
In early 2026, multiple critical vulnerabilities were discovered in the Cursor AI-integrated development environment (IDE), notably CVE-2026-50548 and CVE-2026-50549. These flaws allowed attackers to escape the IDE's sandbox environment, enabling remote code execution (RCE) on developers' machines. Exploits involved manipulating the working directory parameter and leveraging symbolic link (symlink) manipulation to bypass security controls. The vulnerabilities posed significant risks, including unauthorized access to source code, sensitive data exposure, and potential compromise of development environments. ([csoonline.com](https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html?utm_source=openai)) The discovery of these vulnerabilities underscores the growing security challenges associated with AI-assisted development tools. As organizations increasingly adopt such tools to enhance productivity, it is imperative to implement robust security measures to mitigate risks associated with prompt injection attacks and sandbox escapes. This incident highlights the need for continuous monitoring and updating of AI development environments to safeguard against emerging threats.
1 week ago
Kill Chain
Critical Cursor Vulnerability Exposes Windows Systems to Malicious Code Execution
In July 2026, a critical vulnerability was discovered in the Cursor development environment, allowing malicious actors to execute arbitrary code on Windows systems. By placing a malicious file named 'git.exe' in the root of a Git repository, attackers could achieve code execution when the repository was opened in Cursor, without any user prompt or warning. This flaw granted attackers access to developers' credentials, including SSH keys and cloud tokens, posing significant security risks. Despite being reported in December 2025, the vulnerability remained unpatched as of July 2026, leaving many systems exposed. This incident underscores the growing threat of supply chain attacks targeting development tools and environments. As developers increasingly rely on third-party repositories and AI-assisted coding tools, the potential for such vulnerabilities to be exploited has risen, emphasizing the need for vigilant security practices and prompt patching of identified flaws.
1 week ago
Kill Chain
Critical Security Updates Released for Major Software Products
In July 2026, Mozilla, Google, Adobe, and VMware released critical security updates addressing multiple vulnerabilities across their products. Mozilla's Firefox 152.0.6 patched two critical flaws (CVE-2026-15718 and CVE-2026-15719) with public exploit code available, though no active exploitation was reported. Google's Chrome 150.0.7871.124/.125 addressed 15 security flaws, including two critical use-after-free vulnerabilities (CVE-2026-15764 and CVE-2026-15765) in the Ozone component. Adobe released updates for 88 vulnerabilities, including critical issues in ColdFusion, Commerce, Experience Manager, and Illustrator. VMware also issued patches for multiple critical vulnerabilities in its products. These updates highlight the ongoing need for organizations to promptly apply security patches to mitigate risks associated with publicly disclosed vulnerabilities. The presence of exploit code increases the urgency for immediate action to prevent potential exploitation.
1 week ago
Kill Chain
SAP's July 2026 Security Updates: Addressing Critical Vulnerabilities in NetWeaver and Commerce Cloud
In July 2026, SAP released security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, Commerce Cloud, and Approuter. The most severe, CVE-2026-44747, is a memory corruption issue in NetWeaver Application Server ABAP, potentially leading to unauthorized data access and system unavailability. CVE-2026-27690, an HTTP request smuggling vulnerability in SAP Approuter, could allow unauthenticated attackers to access user responses and trigger denial-of-service attacks. CVE-2026-44761 in SAP Commerce Cloud involves default credentials that enable attackers to obtain valid access tokens and manipulate data via certain APIs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/?utm_source=openai)) These vulnerabilities underscore the critical need for organizations to promptly apply security patches to prevent potential exploitation. The increasing complexity and integration of enterprise software systems make timely updates essential to maintain system integrity and protect sensitive data.
1 week ago
Kill Chain
Uncovering the BoryptGrab Infostealer: Nearly 300 Fake GitHub Repositories Distribute Malware
In July 2026, a sophisticated cyber campaign was uncovered involving nearly 300 fraudulent GitHub repositories that impersonated legitimate software projects to distribute the BoryptGrab infostealer malware. These repositories targeted users searching for security tools, cryptocurrency services, financial applications, developer utilities, secure email providers, macOS utilities, and gaming software. The malware was capable of harvesting data from over 19 web browsers, extracting information from 32 cryptocurrency wallets, and exfiltrating sensitive details from messaging and social media applications. The campaign utilized deceptive landing pages with trust-inducing elements to lure victims into downloading malicious ZIP archives containing trojanized DLL files and legitimate executables, which, when executed, loaded the infostealer into memory. This incident underscores a growing trend where threat actors exploit trusted platforms like GitHub to disseminate malware, leveraging search engine optimization (SEO) techniques to enhance the visibility of malicious repositories. The use of legitimate-looking repositories and sophisticated social engineering tactics highlights the evolving nature of cyber threats and the need for heightened vigilance when downloading software from online sources.
1 week ago
Kill Chain
LabubaRAT: A New Rust-Based RAT Disguised as NVIDIA Software
In July 2026, cybersecurity researchers identified LabubaRAT, a previously undocumented Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to infiltrate Windows systems. The malware establishes a persistent foothold, enabling attackers to profile the host, identify security tools, execute commands, transfer files, capture screenshots, and proxy traffic through the compromised system. LabubaRAT employs multiple communication methods, including HTTPS, WebView2, and DNS tunneling, to maintain access even if one pathway is detected and blocked. The attack initiates with an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit. Instead of hard-coding its command-and-control (C2) information, the malware accepts runtime configurations via command-line arguments, allowing operators to define parameters such as server details and polling intervals. This flexibility enables the reuse of the same binary across different infrastructures and campaigns without modification. Once deployed, LabubaRAT conducts discovery operations to inventory installed web browsers and security products, gathering information on the host's environment to tailor its functionality accordingly. The malware's capabilities include command execution, PowerShell and JavaScript execution, screenshot capture, file upload and download, archive handling, and SOCKS5 proxy support. These features provide attackers with comprehensive control over the infected host, facilitating data exfiltration and further malicious activities. The emergence of LabubaRAT underscores the evolving sophistication of malware designed to evade detection by masquerading as legitimate software. Its use of Rust, a language known for its performance and safety features, highlights a trend among threat actors to adopt modern programming languages to develop more robust and stealthy malware. Organizations must remain vigilant and implement robust security measures to detect and mitigate such threats.
1 week ago
Kill Chain
SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747
In July 2026, SAP released a critical security update addressing CVE-2026-44747, a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. This flaw allows authenticated attackers to exploit memory management errors, potentially leading to unauthorized data access, modification, or system unavailability. The vulnerability affects multiple versions of the SAP NetWeaver AS ABAP kernel, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. Organizations using these versions are urged to apply the provided patches promptly to mitigate the risk of exploitation. The disclosure of CVE-2026-44747 underscores the ongoing challenges in securing enterprise resource planning (ERP) systems. As these platforms are integral to business operations, vulnerabilities within them present significant risks. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to stay vigilant against emerging threats targeting critical business applications.
1 week ago
Kill Chain
Critical Vulnerability in 'Claude for Chrome' Exposes User Data
In July 2026, security researchers identified a critical vulnerability in Anthropic's 'Claude for Chrome' extension, allowing malicious browser extensions to exploit Claude's automation capabilities. This flaw enables unauthorized access to sensitive user data, including Gmail, Google Docs, and Calendar, by triggering tasks without user consent. Despite previous mitigation efforts, the vulnerability persists in version 1.0.80, posing significant security risks to users. The incident underscores the growing threat of prompt injection attacks targeting AI-powered browser extensions. As AI tools become more integrated into daily workflows, ensuring robust security measures and user awareness is paramount to prevent unauthorized data access and maintain user trust.
1 week ago
Kill Chain
Critical Vulnerability in Cursor IDE: Automatic Execution of Malicious Code in Compromised Repositories
In July 2026, a critical vulnerability was discovered in Cursor IDE, an AI-powered coding platform. This flaw allows attackers to embed a malicious 'git.exe' file within a repository. When a developer opens such a compromised project, Cursor automatically executes the malicious binary without any warnings or prompts, leading to potential unauthorized code execution on the developer's machine. Despite being reported to Cursor in December 2025, the vulnerability remains unpatched, posing significant risks to developers using the platform. This incident underscores the growing security challenges associated with AI-assisted development tools. As these platforms become more integrated into software development workflows, they present new attack vectors that can be exploited by threat actors. The lack of prompt remediation highlights the need for developers and organizations to remain vigilant, implement robust security measures, and advocate for timely patches from software vendors to mitigate emerging threats.
1 week ago
Kill Chain
ShinyHunters' Year-Long Exploitation of OAuth in Salesforce Breaches
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters orchestrated a series of data extortion attacks targeting corporate Salesforce environments. By exploiting trust relationships through OAuth connections, they gained unauthorized access without exploiting platform vulnerabilities. Their methods included voice phishing to trick employees into approving malicious connected apps, stealing OAuth tokens from compromised software vendors, and leveraging misconfigured guest access to Salesforce sites. These tactics allowed them to exfiltrate sensitive CRM data from numerous organizations across various industries. This incident underscores the evolving threat landscape where attackers exploit trusted integrations and social engineering to bypass traditional security measures. Organizations must enhance their monitoring of OAuth activities, audit third-party app permissions, and educate employees on the risks of social engineering to mitigate such sophisticated attacks.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports