Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 104 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1237–1248 / 2541 reports
AI Uncovers Critical macOS Kernel Vulnerability in Record Time
Computer Software/Engineering5 months ago

AI Uncovers Critical macOS Kernel Vulnerability in Record Time

In May 2026, cybersecurity firm Calif utilized Anthropic's advanced AI model, Mythos Preview, to identify and exploit a kernel memory corruption vulnerability in Apple's macOS 26.4.1 running on M5 silicon. This exploit enabled privilege escalation from an unprivileged user to root access by chaining two vulnerabilities, effectively bypassing Apple's Memory Integrity Enforcement (MIE) system, a hardware-assisted security feature introduced in 2025 to mitigate memory-based exploits. The discovery underscores the potential of AI in rapidly uncovering critical system vulnerabilities, as the exploit was developed within five days. ([9to5mac.com](https://9to5mac.com/2026/05/14/calif-team-details-how-anthropic-mythos-helped-build-a-working-macos-exploit-in-five-days/?utm_source=openai)) This incident highlights the evolving cybersecurity landscape where AI tools can both uncover and potentially exploit system vulnerabilities at unprecedented speeds. Organizations must reassess their security postures to address the dual-edged nature of AI in cybersecurity, balancing its defensive capabilities against the risks of adversarial use. ([techradar.com](https://www.techradar.com/pro/security/this-work-is-a-glimpse-of-what-is-coming-security-team-lays-out-how-anthropic-mythos-helped-build-a-working-macos-exploit-in-five-days?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GitHub's 2026 Security Breach: A Supply Chain Attack via Malicious Nx Console Extension
Computer Software/Engineering5 months ago

GitHub's 2026 Security Breach: A Supply Chain Attack via Malicious Nx Console Extension

In May 2026, GitHub experienced a significant security breach when an employee inadvertently installed a malicious version of the Nx Console Visual Studio Code extension. This compromised extension, linked to the TanStack npm supply-chain attack orchestrated by the TeamPCP threat group, granted unauthorized access to approximately 3,800 internal repositories. The attackers exfiltrated internal source code and sensitive operational data, subsequently offering the stolen data for sale at a minimum of $50,000. GitHub promptly responded by securing the compromised device, rotating critical secrets, and initiating a comprehensive investigation to assess the full impact of the breach. This incident underscores the escalating threat posed by sophisticated supply chain attacks targeting trusted development tools and platforms. The exploitation of widely used extensions like Nx Console highlights the necessity for heightened vigilance and robust security measures within the software development ecosystem to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Apple's 2025 App Store Fraud Prevention Milestones
Computer Software/Engineering5 months ago

Apple's 2025 App Store Fraud Prevention Milestones

In 2025, Apple intensified its efforts to secure the App Store, preventing over $2.2 billion in potentially fraudulent transactions. The company rejected more than 2 million problematic app submissions, blocked over 1.1 billion fraudulent account creations, and terminated 193,000 developer accounts due to fraud concerns. Additionally, Apple deactivated 40.4 million customer accounts suspected of fraud and abuse, and stopped more than 5.4 million stolen credit cards from being used. These measures reflect a significant increase in Apple's proactive stance against digital fraud compared to previous years. This escalation in fraudulent activities underscores the evolving tactics of malicious actors targeting digital platforms. Apple's comprehensive approach, combining human review with advanced machine learning, highlights the necessity for continuous innovation in fraud detection and prevention strategies to maintain user trust and platform integrity.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google's Accidental Disclosure of Unpatched Chromium Vulnerability in 2026
Computer Software/Engineering5 months ago

Google's Accidental Disclosure of Unpatched Chromium Vulnerability in 2026

In May 2026, Google inadvertently disclosed details of an unresolved vulnerability in the Chromium browser engine, affecting browsers like Chrome, Edge, and others. This flaw allows JavaScript code to continue running in the background even after the browser is closed, potentially enabling remote code execution on users' devices. Security researcher Lyra Rebane initially reported the issue in December 2022, highlighting risks such as the creation of botnets and unauthorized traffic redirection. Despite being marked as fixed in February 2026, the vulnerability remained unpatched, leading to its accidental public exposure. The incident underscores the critical importance of timely vulnerability management and the potential consequences of premature disclosure. Organizations must remain vigilant, ensuring that security patches are thoroughly tested and deployed promptly to mitigate risks associated with unpatched vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Lucifer Drainer: The Rise of Drainer-as-a-Service in Cryptocurrency Theft
Financial Services5 months ago

Lucifer Drainer: The Rise of Drainer-as-a-Service in Cryptocurrency Theft

In early 2026, cybersecurity researchers uncovered the 'Lucifer Drainer,' a sophisticated Drainer-as-a-Service (DaaS) platform that facilitated large-scale cryptocurrency theft. Operating from January 2025 to early 2026, Lucifer Drainer enabled affiliates to deploy phishing websites that tricked users into connecting their crypto wallets. Once connected, malicious transactions were executed, swiftly transferring assets to attacker-controlled wallets. This operation exemplifies the industrialization of crypto theft, with the DaaS model allowing even low-skilled actors to participate in complex scams. The emergence of platforms like Lucifer Drainer underscores a significant shift in cybercriminal tactics, highlighting the need for enhanced vigilance among cryptocurrency users and platforms. The professionalization of such services indicates a growing threat landscape, necessitating robust security measures and user education to mitigate risks associated with these evolving schemes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GitHub Breach 2026: Lessons from the TeamPCP VS Code Extension Attack
Computer Software/Engineering5 months ago

GitHub Breach 2026: Lessons from the TeamPCP VS Code Extension Attack

In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. This attack, attributed to the threat group TeamPCP, led to the exfiltration of approximately 3,800 internal repositories. The attackers advertised the stolen data for sale on a cybercrime forum, seeking at least $50,000. GitHub responded by removing the malicious extension, isolating the affected endpoint, and rotating critical credentials to mitigate further risk. This incident underscores the escalating threat of supply chain attacks targeting development tools and environments. The use of poisoned extensions to infiltrate systems highlights the need for heightened vigilance and robust security measures within the software development lifecycle.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling the 2026 Android Carrier Billing Fraud Campaign
Telecommunications5 months ago

Unveiling the 2026 Android Carrier Billing Fraud Campaign

Between March 2025 and January 2026, a sophisticated Android malware campaign targeted users in Malaysia, Thailand, Romania, and Croatia. Disguised as popular applications like Messenger, TikTok, Minecraft, and Grand Theft Auto, the malware covertly enrolled victims in premium, carrier-billed services without their knowledge. The attackers employed techniques such as WebView automation, JavaScript injection, and one-time password (OTP) interception to complete fraudulent subscription processes in the background. This operation affected nearly 250 Android apps and demonstrated a high level of technical sophistication, particularly in automating the subscription process and evading detection mechanisms. This incident underscores the evolving tactics of financially motivated threat actors who exploit legitimate app functionalities to conduct fraud. The campaign's ability to bypass user interaction and leverage platform features like Google's SMS Retriever API highlights significant security gaps in mobile ecosystems. Organizations must remain vigilant, as such attacks not only lead to financial losses for consumers but also erode trust in mobile platforms and services.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Underminr Exploit: A New Threat to Web Security
Internet5 months ago

Underminr Exploit: A New Threat to Web Security

In May 2026, researchers identified a critical vulnerability named 'Underminr' that exploits weaknesses in content delivery networks (CDNs) and Domain Name System (DNS) configurations. This exploit allows threat actors to manipulate web requests, enabling them to mask malicious activities behind the trusted reputations of legitimate websites. By leveraging this technique, attackers can conduct phishing campaigns, distribute malware, and perform data exfiltration while appearing to originate from reputable domains. The widespread nature of this vulnerability poses significant risks to organizations relying on CDNs for web content delivery. The emergence of Underminr underscores the evolving tactics of cyber adversaries who are increasingly targeting foundational internet infrastructure. This trend highlights the necessity for organizations to reassess their security postures, particularly concerning third-party services like CDNs, and to implement robust monitoring and mitigation strategies to defend against such sophisticated attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability in PostgreSQL Deployments
Computer Software/Engineering5 months ago

Drupal CVE-2026-9082: Critical SQL Injection Vulnerability in PostgreSQL Deployments

On May 20, 2026, Drupal released security updates addressing a highly critical SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw allows anonymous attackers to send specially crafted requests, leading to arbitrary SQL injection on sites using PostgreSQL databases. Exploitation can result in information disclosure, privilege escalation, and potentially remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9, with patched versions available in 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) This incident underscores the persistent threat of SQL injection vulnerabilities in widely used content management systems. Organizations utilizing Drupal with PostgreSQL should prioritize immediate patching to mitigate potential exploitation. The ease of anonymous exploitation highlights the necessity for robust security practices and timely updates to protect sensitive data and maintain system integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GitHub Breach: Lessons in Securing Developer Tools Against Supply Chain Attacks
Computer Software/Engineering5 months ago

GitHub Breach: Lessons in Securing Developer Tools Against Supply Chain Attacks

In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious version of the Nx Console Visual Studio Code (VS Code) extension. This supply chain attack, orchestrated by the cybercriminal group TeamPCP, led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attackers exploited the compromised extension to harvest sensitive data, including source code and operational information. GitHub promptly detected the intrusion, removed the malicious extension, isolated the affected endpoint, and initiated an internal investigation to assess the full impact and prevent further unauthorized access. This incident underscores the escalating threat of supply chain attacks targeting developer tools and extensions. The rapid proliferation of such attacks highlights the critical need for organizations to implement stringent security measures, conduct regular audits of third-party tools, and foster a culture of security awareness among developers to mitigate potential vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials
Computer Software/Engineering5 months ago

Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials

In May 2026, a supply chain attack targeted the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account, publishing malicious versions of popular data-visualization packages. This led to widespread impact, as the malicious code propagated through dependencies like echarts-for-react, affecting CI/CD pipelines and cloud workloads. The payload, a 499 KB obfuscated JavaScript file, executed silently during npm install, aiming to steal credentials from GitHub Actions environments. Key features included multi-platform credential theft, process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery, indicating a sophisticated focus on CI/CD environments. This incident underscores the escalating threat of supply chain attacks, particularly targeting CI/CD environments. The attack's sophistication, including SLSA provenance forgery, highlights the need for enhanced security measures in software development pipelines to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GitHub's Internal Repositories Compromised in May 2026 Breach
Computer Software/Engineering5 months ago

GitHub's Internal Repositories Compromised in May 2026 Breach

In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. This incident led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attack was orchestrated by the hacker group TeamPCP, who exploited the poisoned extension to infiltrate GitHub's internal systems. GitHub promptly detected the breach, removed the malicious extension, isolated the affected endpoint, and initiated a comprehensive incident response, including rotating critical credentials. There is currently no evidence indicating that customer data stored outside of GitHub's internal repositories was impacted. ([github.blog](https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting trusted development tools. The incident highlights the necessity for heightened vigilance and robust security measures within the software development community to prevent similar exploits in the future. ([thehackernews.com](https://thehackernews.com/2026/05/github-internal-repositories-breached.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports