✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
React2Shell (CVE-2025-55182) Exploitation in 2025
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components (RSC) versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution (RCE) via malicious HTTP POST requests, enabling attackers to execute arbitrary code on vulnerable servers. Within hours of disclosure, state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The rapid exploitation underscored the severity of the vulnerability and the need for immediate remediation. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The widespread use of React in web applications, including major platforms like Facebook, Netflix, and Airbnb, amplifies the potential impact of this vulnerability. Organizations are urged to update to patched versions 19.0.1, 19.1.2, and 19.2.1 to mitigate the risk. ([techradar.com](https://www.techradar.com/pro/security/experts-warn-this-worst-case-scenario-react-vulnerability-could-soon-be-exploited-so-patch-now?utm_source=openai))
5 months ago
Kill Chain
GitHub Codespaces RCE Vulnerability: What Developers Need to Know
In early February 2026, security researchers identified multiple attack vectors within GitHub Codespaces that allow remote code execution (RCE) when users open malicious repositories or pull requests. The vulnerability exploits how Visual Studio Code-integrated configuration files are automatically processed, enabling attackers to execute arbitrary commands, exfiltrate GitHub tokens, and access sensitive resources without explicit user approval. Microsoft has currently deemed this behavior as 'by design,' and no CVE has been assigned. ([scworld.com](https://www.scworld.com/news/vs-code-config-files-abused-to-launch-rces-via-github-codespaces?utm_source=openai)) This incident underscores the growing trend of attackers leveraging trusted development environments to execute malicious code, highlighting the need for enhanced security measures and user awareness in cloud-based development platforms.
5 months ago
Kill Chain
Aisuru/Kimwolf Botnet's Unprecedented 31.4 Tbps DDoS Attack in 2025
In December 2025, the Aisuru/Kimwolf botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 31.4 terabits per second (Tbps) and 200 million requests per second. This unprecedented assault targeted multiple companies, primarily in the telecommunications sector, and Cloudflare's own infrastructure. The attack, part of a campaign dubbed "The Night Before Christmas," was successfully mitigated by Cloudflare's automated systems, preventing significant disruptions. ([techradar.com](https://www.techradar.com/pro/security/the-biggest-ddos-attack-ever-has-been-detected-but-fortunately-you-probably-barely-noticed-it?utm_source=openai)) This incident underscores the escalating scale and sophistication of DDoS attacks, highlighting the urgent need for robust cybersecurity measures. The rapid growth of botnets like Aisuru/Kimwolf, which exploit vulnerabilities in IoT devices, poses a significant threat to global internet infrastructure. ([tomshardware.com](https://www.tomshardware.com/service-providers/network-providers/botnet-smashes-ddos-traffic-record-at-31-4-tb-s-equivalent-to-streaming-2-2-million-netflix-4k-movies-at-once-attack-was-large-enough-to-take-entire-countries-offline?utm_source=openai))
5 months ago
Kill Chain
Microsoft's 2026 Breakthrough in AI Language Model Backdoor Detection
In February 2026, Microsoft unveiled a novel approach to detect backdoors in open-weight language models, addressing the growing concern of model poisoning where adversaries embed hidden behaviors during training. This research introduces a scalable scanner capable of identifying backdoored models by analyzing distinctive attention patterns and output behaviors, thereby enhancing trust in AI systems. The significance of this development is underscored by prior findings that even minimal malicious data can implant backdoors in large language models, emphasizing the urgency for robust detection mechanisms. Microsoft's initiative represents a proactive step towards securing AI deployments against such covert threats.
5 months ago
Kill Chain
Notepad++ Supply Chain Attack: A Wake-Up Call for Software Security
Between June and December 2025, Notepad++, a widely used text editor, was compromised through a sophisticated supply chain attack attributed to Chinese state-sponsored hackers. The attackers infiltrated the hosting provider's infrastructure, allowing them to intercept and redirect update traffic to malicious servers. This enabled the delivery of backdoored versions of Notepad++ to selected users, primarily targeting sectors such as government, telecommunications, and critical infrastructure. The breach was identified in early February 2026, prompting immediate security enhancements and advisories for users to update to version 8.9.1 or later. This incident underscores the escalating threat of supply chain attacks, where adversaries exploit trusted software distribution channels to infiltrate target systems. Organizations are urged to reassess and fortify their software update mechanisms, implement stringent verification processes, and remain vigilant against such sophisticated attack vectors.
5 months ago
Kill Chain
Home Depot's 2024 GitHub Token Leak: A Cautionary Tale in Credential Management
In early 2024, a Home Depot employee inadvertently published a private GitHub access token, exposing the company's internal systems for over a year. This token granted unauthorized access to hundreds of private source code repositories, cloud infrastructure, order fulfillment, and inventory management systems. Despite multiple attempts by security researcher Ben Zimmermann to alert Home Depot, the token remained active until December 2025, when media intervention prompted its revocation. This incident underscores the critical need for robust credential management and proactive security measures to prevent unauthorized access to sensitive systems. The prolonged exposure highlights systemic gaps in credential governance and the importance of timely response to security disclosures.
5 months ago
Kill Chain
Amaranth Dragon's 2025 Exploitation of WinRAR Vulnerability: A Cybersecurity Wake-Up Call
In August 2025, the cyberespionage group Amaranth Dragon, linked to China's APT41, exploited the CVE-2025-8088 vulnerability in WinRAR to target government and law enforcement agencies across Southeast Asia. By crafting malicious RAR archives, they leveraged the vulnerability to place encrypted payloads in the Windows Startup folder, ensuring persistence upon system reboot. These attacks were characterized by the use of legitimate tools combined with the custom Amaranth Loader, which retrieved payloads from command-and-control servers concealed behind Cloudflare infrastructure, enhancing stealth and targeting precision. The continued exploitation of CVE-2025-8088 by multiple threat actors underscores the critical need for organizations to promptly update software and implement robust security measures. Despite the release of WinRAR version 7.13, which addresses this flaw, many systems remain vulnerable due to delayed patching and user unawareness, highlighting a significant gap in cybersecurity defenses.
5 months ago
Kill Chain
Critical GitLab Vulnerability CVE-2023-7028 Exploited in the Wild
In January 2024, GitLab disclosed a critical vulnerability (CVE-2023-7028) affecting versions 16.1.0 through 16.7.1 of its Community and Enterprise Editions. This flaw allowed attackers to send password reset emails to unverified email addresses, enabling account takeovers without user interaction. Exploitation of this vulnerability could lead to unauthorized access to sensitive data, code repositories, and potential supply chain attacks. ([arstechnica.com](https://arstechnica.com/security/2024/05/0-click-gitlab-hijacking-flaw-under-active-exploit-with-thousands-still-unpatched/?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-7028 to its Known Exploited Vulnerabilities catalog in May 2024, indicating active exploitation in the wild. Organizations using affected GitLab versions were urged to apply patches immediately to mitigate the risk of account hijacking and associated threats. ([computerweekly.com](https://www.computerweekly.com/news/366583457/Patch-GitLab-vuln-without-delay-users-warned?utm_source=openai))
5 months ago
Kill Chain
Eclipse Foundation's 2025 Response to Unauthorized Extension Uploads
In May 2025, the Eclipse Foundation identified a vulnerability in the Open VSX Registry's automated publishing system, potentially allowing unauthorized extension uploads. The flaw, reported by Koi Security researchers, involved inadequate isolation in build scripts, exposing a privileged token that could be exploited to publish extensions under any namespace. The issue was promptly addressed, with a fix deployed by June 24, 2025, and a comprehensive audit confirming no evidence of exploitation. As a precaution, 81 extensions were deactivated. This incident underscores the critical importance of securing automated processes in software supply chains to prevent unauthorized access and maintain trust in open-source ecosystems. The Eclipse Foundation has since implemented enhanced security measures, including sandboxing build processes and enforcing stricter credential management, to mitigate similar risks in the future.
5 months ago
Kill Chain
Understanding the n8n 2026 Authenticated RCE Vulnerability
In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. These flaws, collectively tracked as CVE-2026-25049, allowed authenticated users with permissions to create or modify workflows to execute arbitrary system commands on the host server. Exploitation of these vulnerabilities could lead to full system compromise, including unauthorized access to sensitive data and potential lateral movement within connected systems. The issues were addressed in versions 1.123.17 and 2.5.2, released in January 2026. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/critical-n8n-flaws-disclosed-along-with-public-exploits/?utm_source=openai)) This incident underscores the importance of rigorous input validation and sandboxing mechanisms in software development. It also highlights the necessity for organizations to promptly apply security patches to mitigate risks associated with known vulnerabilities.
5 months ago
Kill Chain
Microsoft Warns of Python Infostealers Targeting macOS via Fake Ads and Installers
In late 2025, Microsoft observed a surge in macOS-targeted information-stealing campaigns leveraging Python-based malware. Attackers employed social engineering tactics, including malicious advertisements and fake installers, to distribute infostealers like Atomic macOS Stealer (AMOS), MacSync, and DigitStealer. These campaigns utilized fileless execution, native macOS utilities, and AppleScript automation to harvest sensitive data such as web browser credentials, iCloud Keychain contents, and developer secrets. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai)) This trend underscores a significant shift in cyber threats, with attackers expanding their focus beyond Windows to target macOS environments. The use of cross-platform languages like Python facilitates rapid adaptation of malware across different operating systems, posing increased risks to organizations with diverse device ecosystems. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai))
5 months ago
Kill Chain
Microsoft's New Scanner Bolsters AI Security by Detecting LLM Backdoors
In February 2026, Microsoft unveiled a lightweight scanner designed to detect backdoors in open-weight large language models (LLMs). This tool identifies malicious alterations by analyzing three key behavioral signals: distinctive attention patterns triggered by specific inputs, unintended data memorization, and activation by multiple similar triggers. The scanner operates efficiently without requiring additional model training or prior knowledge of potential backdoors, making it applicable across various GPT-style models. However, it necessitates access to model files and is most effective against deterministic backdoors. This development underscores Microsoft's commitment to enhancing AI security and trustworthiness. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/04/detecting-backdoored-language-models-at-scale/?utm_source=openai)) The release of this scanner is particularly timely given the increasing integration of LLMs into critical applications. Recent research highlights the ease with which backdoors can be embedded into AI models, even with minimal malicious data. ([arstechnica.com](https://arstechnica.com/ai/2025/10/ai-models-can-acquire-backdoors-from-surprisingly-few-malicious-documents/?utm_source=openai)) Microsoft's proactive approach addresses these emerging threats, aiming to safeguard AI systems from covert manipulations that could compromise their integrity and reliability.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports