Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 191 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2281–2292 / 2541 reports
Major Supply-Chain Exposure Discovered in Popular Software Update Tool – 2024
Computer Software/Engineering10 months ago

Major Supply-Chain Exposure Discovered in Popular Software Update Tool – 2024

In early 2024, a critical supply-chain vulnerability was identified in a widely used software update tool, threatening some of the world's largest technology enterprises. Attackers exploited insecure update mechanisms within this tool, enabling the potential injection of malware directly into production software across multiple organizations. The breach exposed businesses to risks including unauthorized access, lateral movement, and possible data theft. While no confirmed exploitation has been publicly reported to date, the threat mirrors the scale and impact of the infamous SolarWinds compromise, underscoring the profound risks inherent in trusted third-party code dependencies. This incident highlights the urgent and growing threat from software supply-chain attacks, which have rapidly increased in frequency and sophistication over the past two years. It spotlights the cybersecurity community’s intensified focus on software bill of materials (SBOM), continuous monitoring, and robust supply-chain controls as regulatory and industry expectations tighten.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WordPress Sites Under Siege: Critical Post SMTP Plugin Flaw Exposes 400,000+ Websites
Computer Software/Engineering10 months ago

WordPress Sites Under Siege: Critical Post SMTP Plugin Flaw Exposes 400,000+ Websites

In June 2024, a critical vulnerability was discovered in the Post SMTP mailer plugin for WordPress, widely used by over 400,000 sites. This flaw allows unauthenticated attackers to reset admin accounts and take full control of affected websites. Threat actors have already exploited the vulnerability by leveraging malicious password reset links, leading to complete site compromise, potential data theft, and abuse of compromised infrastructure for further attacks. The vulnerability prompted emergency patching and urgent advisories from both the plugin authors and security firms. This incident underscores the persistent threat posed by plugin vulnerabilities in the WordPress ecosystem, which remains a popular target for cybercriminals due to its vast user base. The surge in attacks exploiting supply chain and third-party plugin weaknesses highlights the need for rapid vulnerability management and robust security controls for web applications.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
U.S. Treasury Sanctions North Korean Firms for Cryptocurrency Crime and IT Fraud (2024)
Banking/Mortgage10 months ago

U.S. Treasury Sanctions North Korean Firms for Cryptocurrency Crime and IT Fraud (2024)

In June 2024, the U.S. Treasury Department sanctioned eight individuals and two companies linked to North Korea for laundering proceeds from cybercrime and IT worker schemes. These sanctioned parties allegedly funneled over $3 billion in stolen cryptocurrency and hundreds of millions in illicitly earned IT wages to the North Korean regime, supporting its weapons programs. Entities sanctioned include North Korean banking officials, an IT company operating in China, and financial institution representatives in both China and Russia, all accused of violating international sanctions, managing illicit funds, and enabling large-scale money laundering through sophisticated cyber and identity subterfuge. This incident underscores the advanced capabilities of North Korea’s cyber operations and their direct link to geopolitical threats, as well as the ongoing shift towards state-sponsored cryptocurrency theft and IT fraud as major funding sources for sanctioned regimes.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Hackers Exploit Authentication Bypass in JobMonster WordPress Theme (2024)
Human Resources/HR10 months ago

Hackers Exploit Authentication Bypass in JobMonster WordPress Theme (2024)

In June 2024, threat actors exploited a critical authentication bypass vulnerability in the JobMonster WordPress theme, enabling attackers to gain unauthorized administrative access on affected websites. The flaw, discovered and disclosed by security researchers, allowed attackers to escalate privileges and hijack admin accounts under certain misconfiguration conditions. Attackers rapidly leveraged the flaw in active campaigns, placing thousands of sites at risk of compromise, defacement, or further malware infection. The widespread usage of the JobMonster theme among job board and recruitment-firm websites amplified the potential impact and data exposure. This incident demonstrates the rising trend of web application targeting via plugin and theme vulnerabilities. The exploitation reinforces concerns around supply chain security in the WordPress ecosystem and highlights growing attacker sophistication in exploiting authentication flaws before site owners can apply available patches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Miljödata Data Breach Exposes 1.5 Million Swedish Records in 2024
Computer Software/Engineering10 months ago

Miljödata Data Breach Exposes 1.5 Million Swedish Records in 2024

In early June 2024, Swedish IT service provider Miljödata disclosed a significant data breach that exposed the personal information of approximately 1.5 million individuals. The Swedish Authority for Privacy Protection (IMY) launched an investigation after attackers gained unauthorized access to Miljödata's systems, compromising data from various organizations reliant on its software. Initial reports indicate a threat actor leveraged vulnerabilities in Miljödata's infrastructure to exfiltrate large datasets, with the breach's discovery prompting immediate shutdowns and incident response procedures. This breach underscores the increasing vulnerability of critical software suppliers to large-scale attacks. As supply chain incidents rise globally, regulators and businesses face mounting pressure to modernize controls against unencrypted data transfer, lateral movement, and delayed anomaly detection.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Malicious Android Apps on Google Play Downloaded 42 Million Times: 2024–2025 Mobile Malware Breach
Computer Software/Engineering10 months ago

Malicious Android Apps on Google Play Downloaded 42 Million Times: 2024–2025 Mobile Malware Breach

Between June 2024 and May 2025, a widespread mobile malware campaign was uncovered in which hundreds of malicious Android applications were distributed via the official Google Play Store. According to Zscaler, these apps managed to bypass Google’s initial security checks, amassing over 42 million downloads before removal. The attackers embedded various forms of malware—including adware, information stealers, and spyware—into seemingly legitimate apps ranging from utilities to lifestyle tools. Victims experienced invasive ads, data theft, and privacy breaches, affecting both consumers and businesses relying on Android devices within their enterprise environments. This breach underscores mounting challenges in mobile application vetting and the growing sophistication of threat actors targeting official app marketplaces. The scale and reach highlight the ongoing risk of mobile malware, urging organizations and users alike to adopt enhanced threat detection, segmentation, and zero trust practices to mitigate emerging mobile threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
WordPress Post SMTP Plugin Exploited in Mass Admin Account Hijacks (2024)
Computer Software/Engineering10 months ago

WordPress Post SMTP Plugin Exploited in Mass Admin Account Hijacks (2024)

In early June 2024, cybersecurity researchers identified that a critical vulnerability in the Post SMTP WordPress plugin was being actively exploited by threat actors. This vulnerability allowed attackers to hijack administrator accounts across more than 400,000 affected WordPress sites, enabling complete site control and potentially permitting installation of malicious payloads. Attackers gained initial access through the plugin's weak nonce verification, escalating privileges to compromise sites, deploy backdoors, and exfiltrate sensitive data. The incident demonstrates how widespread web application vulnerabilities can be rapidly weaponized, putting enterprises and small businesses alike at risk of data loss, defacement, or further compromise. The Post SMTP exploitation highlights a recent surge in attacks leveraging zero-day or unpatched CMS plugins on large scales, reflecting attackers’ growing focus on supply chain and SaaS-adjacent targets. As organizations increasingly depend on third-party tools and platforms, maintaining rapid patch cycles and comprehensive visibility into software components is more critical than ever.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Akira Ransomware’s Disputed Data Breach: What Happened at Apache OpenOffice (2024)
Computer Software/Engineering10 months ago

Akira Ransomware’s Disputed Data Breach: What Happened at Apache OpenOffice (2024)

In June 2024, the Akira ransomware group publicly claimed responsibility for a data breach affecting Apache OpenOffice, alleging the theft of 23 GB of sensitive corporate documents. Despite these assertions, the Apache Software Foundation conducted an internal investigation and officially disputed any evidence of compromise or unauthorized access, stating there were no indications of a breach in their infrastructure. This incident highlights the ongoing challenge organizations face with threat actor claims that may not always be substantiated but can cause reputational risk and user concern. Similar ransomware campaigns have surged in 2024, with groups leveraging public exposure even without confirming access to target data. The situation underscores the importance of proactive communication, transparent incident response, and technical validation as attackers increasingly use psychological pressure tactics in addition to technical intrusions.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How Microsoft Uncovered the SesameOp OpenAI API Backdoor: 2025 Case Study
Computer Software/Engineering10 months ago

How Microsoft Uncovered the SesameOp OpenAI API Backdoor: 2025 Case Study

In November 2025, Microsoft’s security team identified a sophisticated backdoor campaign dubbed 'SesameOp,' wherein attackers leveraged the OpenAI Assistants API as a stealthy command-and-control (C2) channel. This unconventional tactic enabled the threat actors to instruct compromised systems via encrypted and authenticated OpenAI API communications, bypassing traditional security controls and network monitoring systems. The initial access vector is under investigation, but early signs point to phishing emails weaponized with malicious loader scripts. The use of a reputable third-party AI API provided attackers with enhanced persistence and made network traffic analysis difficult, delaying detection and remediation. This incident marks a significant escalation in attacker techniques exploiting trusted generative AI platforms for C2, illustrating the growing weaponization of legitimate SaaS services. Organizations must urgently reassess how they detect, monitor, and govern API traffic, particularly for large AI-driven platforms now woven deeply into business infrastructure.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Google’s ‘Big Sleep’ AI Uncovers 5 Critical Safari WebKit Vulnerabilities
Computer Software/Engineering10 months ago

Google’s ‘Big Sleep’ AI Uncovers 5 Critical Safari WebKit Vulnerabilities

In October 2025, Apple publicly credited Google's AI-powered cybersecurity agent, 'Big Sleep', for identifying five critical vulnerabilities within the WebKit component of its Safari browser. These vulnerabilities, notably including CVE-2025-43429, could be exploited by attackers to trigger browser crashes or initiate memory corruption, potentially resulting in code execution or unauthorized system compromise. Google’s advanced AI techniques allowed rapid discovery and responsible disclosure, prompting Apple to issue urgent patches for all affected systems. This incident underscores a new trend where AI-driven security research exposes latent vulnerabilities faster than ever. It is increasingly relevant as cyber threats grow more sophisticated and organizations face regulatory pressure to promptly remediate critical flaws, especially in client-facing software like browsers.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 2025 React Native CLI Flaw Exposes Millions to Supply-Chain Attacks
Computer Software/Engineering10 months ago

Critical 2025 React Native CLI Flaw Exposes Millions to Supply-Chain Attacks

In November 2025, a critical vulnerability was disclosed in the widely used "@react-native-community/cli" npm package, exposing millions of developers and organizations that rely on React Native for application development. The flaw allowed remote, unauthenticated attackers to execute arbitrary operating system commands on systems running vulnerable versions of the CLI tool. The threat stemmed from insufficient input validation, enabling exploitation via malicious npm modules or manipulated code, creating a high-risk supply-chain attack vector. The vulnerability was swiftly patched, but it highlighted significant supply-chain security gaps across the software development ecosystem. This incident is notable for reinforcing the urgent need to secure development toolchains and underscores the increasing frequency of attacks targeting open-source software dependencies. As attackers continue to exploit weak links in the software supply chain, organizations must strengthen controls, monitoring, and vulnerability management to keep pace with evolving risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple Patches 110 Vulnerabilities in Massive 2024 Security Update
Computer Software/Engineering10 months ago

Apple Patches 110 Vulnerabilities in Massive 2024 Security Update

In early November 2024, Apple released urgently needed security updates for its operating systems, patching 110 vulnerabilities across iOS, macOS, iPadOS, watchOS, tvOS, visionOS, Safari, and Xcode. Key vulnerabilities included memory corruption flaws in ImageIO and WebKit, with previous instances of such bugs leading to remote code execution. Several vulnerabilities could allow unauthorized access to sensitive user data or privilege escalation, and most major Apple product families were impacted. No active exploitation was reported, but these vulnerabilities posed significant risks, especially if exploited in the wild. This incident underscores the importance of timely patching for organizations leveraging Apple hardware, amid escalating regulatory expectations and sophisticated exploit development targeting zero-day vulnerabilities. With Apple devices often pivotal in hybrid and remote work environments, large-scale multi-platform vulnerabilities present an attack surface of interest to both cybercriminals and nation-state actors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports