Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 108 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1285–1296 / 2541 reports
Understanding the REMUS Infostealer: A 2026 Cybersecurity Threat
Financial Services5 months ago

Understanding the REMUS Infostealer: A 2026 Cybersecurity Threat

In early 2026, the REMUS infostealer emerged as a significant threat in the cybercrime landscape. Evolving from the Lumma Stealer family, REMUS introduced advanced capabilities such as session theft, targeting password managers, and utilizing blockchain-based command-and-control mechanisms. Its rapid development and commercialization reflect a shift towards malware-as-a-service (MaaS) models, enabling continuous updates and operational scalability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/?utm_source=openai)) The emergence of REMUS underscores the increasing sophistication of cyber threats, highlighting the need for organizations to enhance their security measures against evolving malware tactics and the growing prevalence of MaaS platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites
Computer Software/Engineering5 months ago

Critical Vulnerabilities in Avada Builder Plugin Affect Over One Million WordPress Sites

In May 2026, two critical vulnerabilities were discovered in the Avada Builder WordPress plugin, affecting over one million active installations. The first, CVE-2026-4782, is an arbitrary file read vulnerability exploitable by authenticated users with at least subscriber-level access, allowing them to read sensitive files on the server. The second, CVE-2026-4798, is a time-based blind SQL injection vulnerability that can be exploited without authentication, enabling attackers to extract sensitive information from the database, including password hashes. Both vulnerabilities have been patched in version 3.15.3 of the plugin. This incident underscores the importance of timely software updates and the potential risks associated with widely used plugins. Organizations should prioritize patch management and consider implementing additional security measures to protect against similar vulnerabilities in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Node-ipc npm Package Compromised: A Wake-Up Call for Open-Source Security
Computer Software/Engineering5 months ago

Node-ipc npm Package Compromised: A Wake-Up Call for Open-Source Security

In May 2026, malicious versions of the widely used node-ipc npm package were published, introducing credential-stealing malware into applications. The compromised versions—9.1.6, 9.2.3, and 12.0.1—contained obfuscated code that, upon execution, harvested sensitive information such as cloud credentials, SSH keys, and CI/CD secrets. This data was exfiltrated through DNS TXT queries to attacker-controlled infrastructure. The attack was facilitated by the compromise of a maintainer's account, allowing unauthorized publication of these malicious versions. ([stepsecurity.io](https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises, as the reliance on third-party packages continues to grow.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Pwn2Own Berlin 2026: Critical Zero-Day Exploits in Microsoft Exchange and Windows 11
Information Technology/IT5 months ago

Pwn2Own Berlin 2026: Critical Zero-Day Exploits in Microsoft Exchange and Windows 11

During the second day of Pwn2Own Berlin 2026, security researchers demonstrated 15 unique zero-day vulnerabilities across multiple products, including Microsoft Exchange, Windows 11, and Red Hat Enterprise Linux for Workstations. Notably, Cheng-Da Tsai of the DEVCORE Research Team earned $200,000 by chaining three bugs to achieve remote code execution with SYSTEM privileges on Microsoft Exchange. Additionally, Siyeon Wi exploited an integer overflow bug to hack Windows 11, and Ben Koo of Team DDOS escalated privileges to root on Red Hat Enterprise Linux for Workstations, earning $7,500 and $10,000 respectively. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/windows-11-and-microsoft-edge-hacked-on-first-day-of-pwn2own-berlin-2026/?utm_source=openai)) This incident underscores the persistent vulnerabilities in widely used enterprise software and highlights the critical need for organizations to prioritize timely patching and robust security measures to mitigate the risks associated with zero-day exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft
Retail Industry5 months ago

Critical Vulnerability in Funnel Builder Plugin Leads to Credit Card Theft

In May 2026, a critical vulnerability in the Funnel Builder plugin for WordPress was actively exploited to inject malicious JavaScript into WooCommerce checkout pages. This flaw, present in versions prior to 3.15.0.3, allowed unauthenticated attackers to modify the plugin's global settings via an unprotected checkout endpoint, leading to the execution of malicious code on checkout pages. The injected code facilitated a payment card skimmer that stole sensitive customer information, including credit card numbers, CVVs, billing addresses, and other personal data. FunnelKit addressed the vulnerability by releasing version 3.15.0.3, urging users to update immediately and review their settings for any unauthorized scripts. This incident underscores the persistent threat posed by vulnerabilities in widely-used plugins, emphasizing the need for regular updates and vigilant monitoring of third-party components in web applications. The exploitation of such vulnerabilities can lead to significant data breaches, financial loss, and reputational damage for businesses, highlighting the critical importance of proactive cybersecurity measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Instructure's Canvas Platform Breached Twice by ShinyHunters in May 2026
Higher Education/Acadamia5 months ago

Instructure's Canvas Platform Breached Twice by ShinyHunters in May 2026

In early May 2026, Instructure's Canvas learning management system suffered two significant cyberattacks by the ShinyHunters group. The initial breach on April 29 exposed sensitive data of approximately 275 million users across nearly 9,000 educational institutions, including names, email addresses, student ID numbers, and private messages. Despite Instructure's efforts to secure the system, ShinyHunters re-compromised Canvas on May 7, defacing login pages and issuing ransom demands. The attacks disrupted operations during critical exam periods, leading to delays and cancellations of final exams at numerous colleges and universities. In response, Instructure reached an agreement with the attackers, reportedly paying a ransom to secure the return and destruction of the stolen data, though the exact terms were not disclosed. This incident underscores the escalating threat of cyberattacks targeting educational institutions and the challenges in safeguarding sensitive student and staff information. ([techradar.com](https://www.techradar.com/pro/security/us-congress-calls-instructure-ceo-as-it-investigates-canvas-breach?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Instructure Canvas Breach: A Wake-Up Call for Educational Cybersecurity
Higher Education/Acadamia5 months ago

Instructure Canvas Breach: A Wake-Up Call for Educational Cybersecurity

In May 2026, Instructure, the company behind the Canvas learning management system, suffered a significant data breach orchestrated by the hacking group ShinyHunters. The attackers exploited vulnerabilities to access and exfiltrate approximately 3.65 terabytes of data, affecting nearly 275 million individuals across 8,809 educational institutions worldwide. The compromised information included names, email addresses, student ID numbers, and private messages between students and staff. Following the initial breach, ShinyHunters escalated their attack by defacing Canvas login portals, disrupting access during critical academic periods and demanding a ransom to prevent the public release of the stolen data. This incident underscores the escalating threat posed by cybercriminal groups targeting educational institutions, highlighting the critical need for robust cybersecurity measures and incident response strategies. The breach also raises concerns about the effectiveness of paying ransoms, as Instructure's decision to negotiate with the attackers has sparked debate over best practices in handling such extortion attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenAI's Response to the TanStack npm Supply Chain Attack
Computer Software/Engineering5 months ago

OpenAI's Response to the TanStack npm Supply Chain Attack

In May 2026, OpenAI disclosed that two employee devices were compromised due to a supply chain attack involving the TanStack npm library, part of the broader 'Mini Shai-Hulud' campaign. The attackers published 84 malicious versions across 42 TanStack packages, leading to unauthorized access and credential-focused exfiltration activities. OpenAI's investigation confirmed that only limited credential material was exfiltrated, with no evidence of user data, production systems, or intellectual property being compromised. ([openai.com](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely used open-source libraries, emphasizing the need for robust security measures in software development and deployment processes. Organizations are urged to enhance their monitoring and validation of third-party components to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security
Computer Software/Engineering5 months ago

OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security

In May 2026, cybersecurity researchers identified four critical vulnerabilities in OpenClaw, an AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—enable attackers to bypass sandbox restrictions, escalate privileges, and establish persistent control over affected systems. Exploitation could lead to unauthorized data access, system configuration tampering, and the planting of backdoors, significantly compromising system integrity and security. The discovery of these vulnerabilities underscores the urgent need for robust security measures in AI agent frameworks. As AI systems become more integrated into critical operations, ensuring their security is paramount to prevent potential exploitation by malicious actors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks
Computer Software/Engineering5 months ago

mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks

Between April 14 and April 21, 2026, a DShield sensor detected 24 unique IP addresses executing the 'mdrfckr' campaign, a known botnet operation active since 2018. The attackers utilized the SSH client banner 'SSH-2.0-libssh_0.11.1' and produced the hassh fingerprint '03a80b21afa810682a776a7d42e5e6fb', indicating an evolution in their tooling. The campaign's tactics, including writing a persistent SSH key and executing reconnaissance commands, remained consistent with previous observations. This incident underscores the adaptability of threat actors in updating their tools while maintaining established attack methodologies. Organizations should enhance their detection capabilities to identify new SSH client fingerprints associated with known malicious campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot
Financial Services5 months ago

EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot

In June 2025, security researchers discovered 'EchoLeak' (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. This flaw allowed attackers to exfiltrate sensitive enterprise data, including chat logs, OneDrive files, SharePoint content, and Teams messages, without any user interaction. The attack was initiated through a crafted email that, when processed by Copilot, triggered unauthorized data access and transmission. Microsoft promptly addressed the vulnerability upon disclosure, mitigating potential exploitation. ([techrepublic.com](https://www.techrepublic.com/article/news-microsoft-365-copilot-flaw-echoleak/?utm_source=openai)) The EchoLeak incident underscores the critical need for robust security measures in AI-integrated systems. As AI becomes more embedded in enterprise environments, ensuring comprehensive logging, visibility, and compliance with emerging regulations like the EU AI Act's traceability requirements is paramount to prevent similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
Financial Services5 months ago

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

In May 2026, Palo Alto Networks' Unit 42 identified a new variant of the Gremlin Stealer malware, which has evolved from a basic credential harvester into a sophisticated modular toolkit. This variant employs advanced obfuscation techniques, including concealing malicious payloads within embedded resource files and utilizing instruction virtualization to evade detection. Gremlin Stealer targets sensitive information such as payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP and VPN credentials, exfiltrating this data to attacker-controlled servers for potential exploitation. The rapid evolution of Gremlin Stealer underscores a broader trend in the cyber threat landscape, where infostealers are becoming more sophisticated and harder to detect. This development highlights the urgent need for organizations to enhance their cybersecurity measures, particularly in monitoring and defending against advanced malware that employs complex evasion tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports