Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 169 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2017–2028 / 2541 reports
Critical jsPDF Node.js Flaw Exposes Sensitive Data via Generated PDFs
Computer Software/Engineering10 months ago

Critical jsPDF Node.js Flaw Exposes Sensitive Data via Generated PDFs

In January 2026, a critical vulnerability (CVE-2025-68428) was uncovered in the popular JavaScript PDF generation library jsPDF, impacting its Node.js builds prior to version 4.0. Attackers could exploit improper input validation in the 'loadFile' function, enabling local file inclusion and path traversal. If user-controlled data was passed as a file path to certain methods, sensitive local files could be incorporated into generated PDFs, risking data exposure or exfiltration. The flaw's severity score of 9.2 reflects the widespread use of jsPDF—over 3.5 million weekly downloads—as well as the supply-chain risk to downstream applications that integrated vulnerable versions. This incident highlights the persistent risk associated with supply-chain dependencies and their indirect impact on downstream systems. With development teams increasingly relying on open-source libraries, vulnerabilities like CVE-2025-68428 demonstrate the urgent need for vendor diligence, dependency hygiene, and layered input validation in modern application stacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
GoBruteforcer Botnet Hits Crypto Projects via AI-Configured Default Credentials
Computer Software/Engineering10 months ago

GoBruteforcer Botnet Hits Crypto Projects via AI-Configured Default Credentials

In January 2026, a significant wave of GoBruteforcer botnet attacks targeted cryptocurrency and blockchain projects by exploiting misconfigured, internet-facing servers. Attackers leveraged weak default credentials in commonly used XAMPP, MySQL, PostgreSQL, FTP, and phpMyAdmin deployments—many set up using AI-generated configuration examples. After brute-forcing access, threat actors deployed web shells and specialized utilities to scan for vulnerable cryptocurrency wallets, aiming to exfiltrate crypto assets from compromised infrastructure. Over 50,000 servers were estimated at risk, with threat actors automating large-scale scans and credential spraying campaigns over public IP space. This campaign highlights a critical trend: the proliferation of weak security settings driven by widespread adoption of AI-generated setup scripts, as well as persistent use of outdated, insecure server stacks. The convergence of automation, botnet-scale brute-forcing, and blockchain-targeted payloads marks an evolution in how cybercriminals exploit configuration drift and endpoint exposure in modern DevOps environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 2026 n8n Vulnerability Lets Attackers Remotely Execute Code Without Credentials
Information Technology/IT10 months ago

Critical 2026 n8n Vulnerability Lets Attackers Remotely Execute Code Without Credentials

In early January 2026, security researchers disclosed CVE-2026-21858 ("Ni8mare"), a critical (CVSS 10.0) vulnerability in the n8n workflow automation platform. Affecting versions up to 1.65.0, the flaw allows unauthenticated remote attackers to exploit the application's "Content-Type" processing logic, enabling arbitrary file reads and ultimately granting full system takeover by escalating to remote code execution (RCE). Attackers can leverage exposed n8n instances, retrieve sensitive admin credentials, forge session tokens, and create malicious workflows to execute system commands. Globally, over 26,000 systems were identified as potentially exposed at disclosure time, many internet-accessible, posing grave risk to organizations running n8n. This incident underscores a growing trend in supply chain and automation-tool attacks, where threat actors exploit complex integrations and insufficient access controls. The prevalence of automation platforms as central hubs for organizational secrets intensifies the impact radius. The urgent need to patch, limit internet exposure, and apply zero trust controls remains critical to prevent similar high-impact breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical RCE in n8n Workflow Platform Exposes Cloud & Self-Hosted Users (2026)
Information Technology/IT10 months ago

Critical RCE in n8n Workflow Platform Exposes Cloud & Self-Hosted Users (2026)

In January 2026, open-source workflow automation platform n8n disclosed a critical vulnerability (CVE-2026-21877) affecting both its self-hosted and cloud environments. The flaw, rated CVSS 10.0, allows authenticated users to execute arbitrary code remotely under specific conditions, potentially leading to the full compromise of affected instances. The vulnerability impacts versions >=0.123.0 and <1.121.3, and was responsibly disclosed by security researcher Théo Lelasseux. Immediate mitigation includes upgrading to version 1.121.3 or higher, and temporarily disabling certain nodes for additional protection. This incident underscores the persistent risks associated with supply chain and automation software, which are increasingly targeted due to their ubiquity and privileged access. The n8n case also reflects a trend of continuous discovery of critical flaws in widely used DevOps tooling, making timely patching and access control more important than ever.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Black Cat SEO Poisoning Campaign Unleashes Mass Infostealer Outbreak Across China
Computer Software/Engineering10 months ago

Black Cat SEO Poisoning Campaign Unleashes Mass Infostealer Outbreak Across China

Between December 7 and 20, 2025, the cybercrime gang Black Cat orchestrated a large-scale SEO poisoning campaign targeting Chinese users searching for popular software via Microsoft Bing and similar engines. By pushing fraudulent lookalike websites (e.g., mimicking Notepad++, Google Chrome, QQ International, iTools) to the top of search results, Black Cat tricked users into downloading compromised installers. When executed, these installers side-loaded backdoor trojans that exfiltrated sensitive information, such as browser data, keystrokes, and clipboard contents, back to attacker-controlled infrastructure. At least 277,800 hosts were infected in less than two weeks, with daily compromise rates peaking above 62,000 machines. This campaign marks a significant escalation in the use of SEO poisoning for initial malware access, reflecting a trend in highly targeted, financially motivated infostealer operations. As search engines become the go-to for software discovery, this incident strongly highlights the risks of relying on unverified download sources and demonstrates attackers' growing sophistication in exploiting user trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Inside the Scattered Lapsus$ Honeypot: How Researchers Turned the Tables in 2024
Financial Services10 months ago

Inside the Scattered Lapsus$ Honeypot: How Researchers Turned the Tables in 2024

In early 2024, cybersecurity researchers staged a sophisticated deception operation targeting Scattered Lapsus$, also known as ShinyHunters, by deploying a realistic but fake dataset as a honeypot. The operation was designed to lure threat actors with what appeared to be sensitive credentials and data, allowing security experts to monitor the attackers' methods and behaviors in real time. Once engaged, Scattered Lapsus$ actors attempted lateral movement and data exfiltration using various covert tools and techniques, but their actions were closely tracked and documented. This resulted in a rare glimpse into the group's tactics, techniques, and procedures, as well as validation of multiple defensive controls. This incident is particularly noteworthy as it demonstrates the growing effectiveness of proactive threat intelligence gathering through deception and honeypots. With threat groups like Lapsus$ and ShinyHunters targeting high-value data across industries, similar methods are being adopted by defenders to preemptively understand and disrupt sophisticated adversaries.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Innovative Phishing Campaign Evades Detection with HTML Table-Based QR Codes
Financial Services10 months ago

Innovative Phishing Campaign Evades Detection with HTML Table-Based QR Codes

In late December 2023, a novel phishing campaign was observed in which attackers delivered emails containing QR codes crafted not from traditional images, but rendered using HTML tables. The campaign targeted end users with messages between December 22nd and December 26th, embedding visually normal but technically 'imageless' QR codes. When scanned, these QR codes redirected victims to phishing domains customized per recipient, aiming to harvest credentials. By sidestepping standard image-based security controls, these emails successfully bypassed common email security gateways designed to detect embedded malicious QR codes. This incident highlights adversary innovation in evading current email security technologies by exploiting overlooked content formats. It underscores ongoing risks as attackers adapt tactics to defeat both legacy and modern defensive controls. As sophisticated phishing methods proliferate, organizations must focus on layered defenses and continuous user education.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical n8n Vulnerability Enables Authenticated Command Execution (CVE-2025-68668)
Computer Software/Engineering10 months ago

Critical n8n Vulnerability Enables Authenticated Command Execution (CVE-2025-68668)

In January 2026, a critical vulnerability (CVE-2025-68668) was disclosed in n8n, an open-source workflow automation platform, allowing authenticated users with workflow modification privileges to execute arbitrary system commands on the host server. The flaw, caused by a sandbox bypass in the Python Code Node (Pyodide), impacted all n8n versions from 1.0.0 up to 2.0.0. Prompted by Cyera Research Labs’ findings, the n8n team released version 2.0.0 as a fix and advised urgent security configuration changes or feature disablement as interim measures. The vulnerability poses high risks for supply-chain and SaaS environments using n8n in production, potentially enabling lateral movement or privilege escalation. This incident underscores the continued threat from vulnerabilities in low-code/no-code and automation platforms, especially as attackers increasingly leverage authenticated access and workflow manipulation to escalate privileges. Organizations should review security settings of workflow platforms due to a growing pattern of exploitation in automation pipelines.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VS Code Forks Highlight Open VSX Supply Chain Vulnerability (2026)
Computer Software/Engineering10 months ago

VS Code Forks Highlight Open VSX Supply Chain Vulnerability (2026)

In early 2026, a supply chain vulnerability involving popular AI-powered Visual Studio Code (VS Code) forks—such as Cursor, Windsurf, Google Antigravity, and Trae—was discovered. These IDEs recommended certain extensions that did not exist in the Open VSX registry, leaving the extension namespaces unclaimed and thus open to exploitation by malicious actors. Attackers could upload rogue extensions under these names, which unsuspecting developers would install due to these recommendations. Koi researchers demonstrated the risk by publishing a placeholder PostgreSQL extension on Open VSX, garnering over 500 installs, highlighting the real-world likelihood of sensitive data exposure and credential theft before the issue was mitigated by the IDE vendors and Open VSX registry maintainers. This incident underscores the persistent risk of supply chain attacks in open-source developer tooling, as adversaries increasingly exploit gaps in public code marketplaces. With threat actors targeting trusted workflows and dependency chains, organizations must elevate their scrutiny and controls around open-source software consumption.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical AdonisJS Bodyparser Flaw Exposes Servers to Arbitrary File Write (CVE-2026-21440)
Computer Software/Engineering10 months ago

Critical AdonisJS Bodyparser Flaw Exposes Servers to Arbitrary File Write (CVE-2026-21440)

In January 2026, a critical vulnerability (CVE-2026-21440, CVSS 9.2) was disclosed in the widely-used @adonisjs/bodyparser npm package, a foundational component for handling multipart form data in AdonisJS applications. The flaw, attributed to improper validation of user-supplied input, allowed remote attackers to exploit a path traversal bug, thereby enabling arbitrary file writes to affected servers. Successful exploitation could ultimately lead to full system compromise, data breach or destructive attacks, due to the broad permissions often held by server-side runtimes. The risk was amplified by the widespread use of AdonisJS across SaaS, fintech, and e-commerce platforms. This incident underscores broader supply-chain security concerns impacting open-source software ecosystems. Attackers are aggressively targeting commonly used packages to gain upstream access, making robust dependency management, real-time vulnerability monitoring, and rapid patch adoption vital defensive practices for modern development teams.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
900,000 Users Targeted: Malicious Chrome Extensions Harvest AI Chat & Browser Data
Computer Software/Engineering10 months ago

900,000 Users Targeted: Malicious Chrome Extensions Harvest AI Chat & Browser Data

In January 2026, cybersecurity researchers uncovered two malicious Chrome extensions—'Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI' and 'AI Sidebar with Deepseek, ChatGPT, Claude, and more.'—that secretly exfiltrated ChatGPT, DeepSeek conversations, and extensive browsing data from over 900,000 users. These extensions masqueraded as legitimate browser tools but harvested sensitive data by scraping web pages and Chrome tabs, transmitting this information to attacker-controlled command-and-control servers every 30 minutes. This breach potentially exposed confidential business information, intellectual property, and user identities, underscoring the heightened risks posed by seemingly innocuous browser add-ons in enterprise environments. The incident marks a broader uptick in malicious and even some legitimate browser extensions turning to 'prompt poaching'—stealing user interactions with AI and chatbots. As AI adoption accelerates, organizations face new data exposure risks, demanding updated monitoring, awareness, and policy enforcement around browser extensions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Ledger Customer Data Exposed in 2024 Global-e Third-Party Breach
Financial Services10 months ago

Ledger Customer Data Exposed in 2024 Global-e Third-Party Breach

In June 2024, Ledger, the hardware cryptocurrency wallet provider, disclosed that a third-party service provider, Global-e, suffered a security breach resulting in unauthorized exposure of customer data. Attackers gained access to Global-e’s e-commerce system, compromising customers’ names, addresses, phone numbers, and emails used for Ledger purchases. Financial information and cryptocurrencies remained unaffected, but impacted individuals could be at greater risk for phishing or other targeted attacks leveraging their leaked information. This incident underscores the growing risks organizations face from third-party vendors. As supply chain and partner ecosystems expand, attackers increasingly target less secure partners, leading to significant data exposures even when a primary company’s own systems are uncompromised.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports