Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 112 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1333–1344 / 2541 reports
Checkmarx Jenkins Plugin Compromised in 2026 Supply Chain Attack
Computer Software/Engineering6 months ago

Checkmarx Jenkins Plugin Compromised in 2026 Supply Chain Attack

In May 2026, Checkmarx's Jenkins Application Security Testing (AST) plugin was compromised by the hacker group TeamPCP. The attackers published a malicious version of the plugin on the Jenkins Marketplace, embedding credential-stealing malware. This breach was facilitated by credentials obtained from a prior supply chain attack on the Trivy vulnerability scanner in March 2026. The malicious plugin, version 2026.5.09, was uploaded on May 9, 2026, and users who installed this version are advised to rotate all secrets and investigate for potential lateral movement or persistence. This incident underscores the escalating trend of supply chain attacks targeting development tools and the critical need for robust security measures in CI/CD pipelines. Organizations must remain vigilant, ensuring the integrity of third-party plugins and promptly addressing any security advisories to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
cPanel CVE-2026-41940 Exploited to Deploy Filemanager Backdoor
Internet6 months ago

cPanel CVE-2026-41940 Exploited to Deploy Filemanager Backdoor

In May 2026, a critical authentication bypass vulnerability, CVE-2026-41940, was discovered in cPanel and WebHost Manager (WHM) software, allowing unauthenticated remote attackers to gain administrative access to affected systems. Exploiting this flaw, a threat actor known as Mr_Rot13 deployed a backdoor named Filemanager, enabling unauthorized control over compromised environments. The attack involved injecting malicious code to create unauthorized sessions, leading to potential data theft, malware deployment, and system compromise. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cyber actors targeting widely used web hosting platforms. The rapid exploitation of CVE-2026-41940 highlights the critical need for organizations to promptly apply security patches and implement robust monitoring to detect and mitigate unauthorized access attempts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
TeamPCP's Supply Chain Attack on Checkmarx Jenkins AST Plugin: A Wake-Up Call for CI/CD Security
Computer Software/Engineering6 months ago

TeamPCP's Supply Chain Attack on Checkmarx Jenkins AST Plugin: A Wake-Up Call for CI/CD Security

In May 2026, the cybercriminal group TeamPCP executed a supply chain attack by publishing a malicious version of the Checkmarx Jenkins AST plugin to the Jenkins Marketplace. This compromised plugin, identified as version 2026.5.09, was designed to exfiltrate sensitive information from Jenkins instances, including GitHub tokens, cloud credentials, and SSH keys. Checkmarx promptly advised users to revert to the verified safe version 2.0.13-829.vc72453fa_1c16, released on December 17, 2025, and to rotate all potentially exposed secrets. This incident underscores the escalating threat posed by supply chain attacks targeting development tools and the necessity for organizations to implement stringent security measures within their CI/CD pipelines. The recurrence of such attacks highlights the importance of continuous monitoring and verification of third-party components to safeguard against unauthorized modifications and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ShinyHunters Breach Exposes 275 Million Canvas Users in 2026
Higher Education/Acadamia6 months ago

ShinyHunters Breach Exposes 275 Million Canvas Users in 2026

In early May 2026, Instructure, the parent company of the Canvas learning management system, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited vulnerabilities related to 'Free-For-Teacher' accounts, accessing personal information of approximately 275 million users across nearly 9,000 educational institutions worldwide. Compromised data included names, email addresses, student ID numbers, and private messages, though passwords and financial information were reportedly unaffected. The breach led to widespread disruptions, including the postponement of final exams in numerous colleges and universities. ([instructure.com](https://www.instructure.com/incident_update?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cybercriminal groups targeting educational platforms. The timing, coinciding with critical academic periods, highlights the potential for significant operational disruptions. Educational institutions must prioritize robust cybersecurity measures to safeguard sensitive user data and ensure continuity of educational services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cybercriminals Harness AI for Sophisticated Attacks in 2026
Computer Software/Engineering6 months ago

Cybercriminals Harness AI for Sophisticated Attacks in 2026

In early 2026, cybersecurity researchers observed a significant uptick in threat actors leveraging artificial intelligence (AI) to enhance their cyberattack capabilities. These adversaries utilized AI to automate reconnaissance, develop sophisticated exploits, and orchestrate complex attack sequences, leading to faster and more efficient breaches. Notably, a Russian-speaking threat actor employed generative AI tools to compromise over 600 FortiGate firewalls across 55 countries by exploiting weak credentials and exposed management interfaces. This campaign, which spanned from January 11 to February 18, 2026, underscored the evolving threat landscape where AI lowers the technical barrier for large-scale cyber intrusions. ([aws.amazon.com](https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/?utm_source=openai)) The increasing integration of AI into cyber operations has accelerated the speed and scale of attacks, challenging traditional defense mechanisms. Organizations must adapt by implementing AI-driven security solutions, enhancing threat detection capabilities, and fostering a culture of continuous cybersecurity education to mitigate the risks posed by AI-augmented adversaries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fake OpenAI Privacy Filter Repo on Hugging Face Distributes Infostealer Malware
Computer Software/Engineering6 months ago

Fake OpenAI Privacy Filter Repo on Hugging Face Distributes Infostealer Malware

In May 2026, a malicious repository named 'Open-OSS/privacy-filter' was discovered on Hugging Face, impersonating OpenAI's legitimate Privacy Filter model. This repository included a Python script that, when executed, downloaded and ran a Rust-based information stealer on Windows systems. The malware harvested sensitive data, including credentials and cryptocurrency wallet information, and exfiltrated it to a remote server. The repository reached the #1 trending position on Hugging Face, amassing approximately 244,000 downloads before its removal. This incident underscores the growing threat of supply chain attacks targeting AI model repositories. As AI adoption accelerates, adversaries are exploiting trusted platforms to distribute malware, emphasizing the need for rigorous validation of third-party code and heightened awareness of typosquatting tactics in the AI community.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google Thwarts AI-Developed Zero-Day Exploit in 2026
Computer Software/Engineering6 months ago

Google Thwarts AI-Developed Zero-Day Exploit in 2026

In May 2026, Google's Threat Intelligence Group identified a zero-day exploit developed using artificial intelligence, targeting a widely used open-source, web-based administration tool. The exploit, which allowed attackers to bypass two-factor authentication via a Python script, was intended for mass exploitation by a prominent cybercrime group known for high-profile incidents. Google promptly alerted the affected vendor, leading to the vulnerability being patched before any known attacks occurred. This incident underscores the escalating use of AI in cyberattack development, marking a significant shift in threat actor capabilities. The discovery highlights the urgent need for enhanced security measures and vigilance, as AI-driven exploits are likely to become more prevalent and sophisticated in the near future.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cybercriminals Exploit Google Ads and Claude.ai to Target Mac Users
Computer Software/Engineering6 months ago

Cybercriminals Exploit Google Ads and Claude.ai to Target Mac Users

In May 2026, attackers exploited Google Ads and legitimate Claude.ai shared chats to distribute malware targeting macOS users. By searching for 'Claude mac download,' users encountered sponsored search results that appeared to link to the official Claude.ai website but redirected them to malicious instructions. These instructions guided users to execute terminal commands that downloaded and ran malware on their systems, leading to unauthorized access and potential data exfiltration. This incident underscores a growing trend where cybercriminals leverage trusted platforms and search engine advertisements to disseminate malware. The use of legitimate AI-generated content to host malicious instructions highlights the evolving sophistication of social engineering tactics, emphasizing the need for heightened vigilance and robust security measures among users and organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Bleeding Llama: Critical Vulnerability in Ollama Exposes Sensitive Data
Computer Software/Engineering6 months ago

Bleeding Llama: Critical Vulnerability in Ollama Exposes Sensitive Data

In May 2026, a critical vulnerability, CVE-2026-7482, known as 'Bleeding Llama,' was discovered in Ollama, a widely used platform for running large language models locally. This heap out-of-bounds read flaw allows unauthenticated attackers to exfiltrate sensitive data, including environment variables, API keys, and user conversations, from the server's memory. The vulnerability affects all versions prior to 0.17.1, with an estimated 300,000 internet-exposed instances at risk. Ollama released a patch in version 0.17.1, but many servers remain unpatched due to the delayed CVE assignment and lack of awareness. The 'Bleeding Llama' incident underscores the growing security challenges in AI infrastructure, particularly with tools designed for local deployment being exposed to the internet without proper authentication. This vulnerability highlights the urgent need for organizations to implement robust security measures, including timely patching, network access controls, and monitoring of AI systems to prevent unauthorized data access and potential breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Fake OpenAI Repository on Hugging Face Delivers Infostealer Malware
Computer Software/Engineering6 months ago

Fake OpenAI Repository on Hugging Face Delivers Infostealer Malware

In May 2026, a malicious repository named 'Open-OSS/privacy-filter' was discovered on Hugging Face, impersonating OpenAI's legitimate 'Privacy Filter' project. This repository contained a 'loader.py' script that, when executed, downloaded and ran a Rust-based infostealer malware on Windows systems. The malware targeted sensitive data, including browser credentials, cryptocurrency wallets, and system information. The repository reached the top of Hugging Face's trending list with over 244,000 downloads before being removed. This incident underscores the growing trend of supply chain attacks targeting AI and machine learning platforms. As these platforms become integral to various industries, ensuring the integrity of shared repositories is paramount to prevent the distribution of malicious code.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
JDownloader Website Compromised: Malicious Installers Distribute Python RAT Malware
Computer Software/Engineering6 months ago

JDownloader Website Compromised: Malicious Installers Distribute Python RAT Malware

In early May 2026, the official website of JDownloader, a widely-used download management application, was compromised. Attackers exploited an unpatched vulnerability in the site's content management system, allowing them to modify download links without authentication. As a result, users who downloaded the Windows 'Download Alternative Installer' or the Linux shell installer between May 6 and May 7, 2026, received malicious payloads instead of legitimate software. The Windows payload deployed a heavily obfuscated Python-based remote access trojan (RAT), granting attackers unauthorized access to infected systems. The Linux installer was similarly altered to include malicious code that installed a SUID-root binary, enabling persistent unauthorized access. This incident underscores the escalating threat of supply chain attacks targeting widely-used software platforms. By compromising trusted distribution channels, attackers can disseminate malware to a vast user base, bypassing traditional security measures. Organizations must prioritize securing their software supply chains and implement robust monitoring to detect unauthorized modifications promptly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical SQL Injection Vulnerability in LiteLLM Exploited in the Wild
Computer Software/Engineering6 months ago

Critical SQL Injection Vulnerability in LiteLLM Exploited in the Wild

In April 2026, a critical SQL injection vulnerability, CVE-2026-42208, was identified in BerriAI's LiteLLM, an open-source AI proxy. This flaw allows unauthenticated attackers to execute arbitrary SQL commands via a crafted 'Authorization' header, potentially leading to unauthorized data access and modification. The vulnerability affects LiteLLM versions from 1.81.16 up to, but not including, 1.83.7. Exploitation was observed within 36 hours of disclosure, with attackers targeting sensitive database tables. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) The rapid exploitation of CVE-2026-42208 underscores the critical need for prompt vulnerability management in AI infrastructure. Organizations utilizing LiteLLM should immediately upgrade to version 1.83.7 or later to mitigate this risk. ([advisories.gitlab.com](https://advisories.gitlab.com/pypi/litellm/CVE-2026-42208/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports