Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 36 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 421–432 / 2541 reports
ChatGPT Prompt Injection Flaw Exposed Gmail Data Through Hidden Cross-Account Channels
ChatGPT Prompt Injection Flaw Exposed Gmail Data Through Hidden Cross-Account Channels
Computer Software/Engineering2 months ago

ChatGPT Prompt Injection Flaw Exposed Gmail Data Through Hidden Cross-Account Channels

In September 2026, Check Point Research disclosed a critical vulnerability in OpenAI's ChatGPT that allowed attackers to inject malicious prompts that could silently exfiltrate user data from connected applications like Gmail. The attack exploited a shared internal JFrog Artifactory service used by ChatGPT's isolated containers, creating an unauthorized communication channel between different user accounts. Attackers could plant instructions through shared conversations, custom GPTs, or user-pasted prompts that would execute hidden data theft operations while displaying normal responses to victims. OpenAI confirmed the vulnerability and took the internal service offline after disclosure. This incident highlights the emerging risks of AI systems as attack vectors, particularly as organizations increasingly integrate AI tools with sensitive business applications and data sources, making prompt injection attacks a critical new threat category requiring immediate security attention.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
WeChat Zero-Click Worm: How 1.4 Billion Users Were at Risk from Incoming Calls
WeChat Zero-Click Worm: How 1.4 Billion Users Were at Risk from Incoming Calls
Telecommunications2 months ago

WeChat Zero-Click Worm: How 1.4 Billion Users Were at Risk from Incoming Calls

In July 2026, security researchers at Calif discovered a critical zero-click vulnerability in WeChat that allowed attackers to take complete control of user accounts through incoming calls without any user interaction. The exploit worked by leveraging WeChat's contact trust system, enabling worm-like propagation where compromised accounts could automatically infect other contacts. Affecting WeChat's 1.4 billion user base across iPhone and Android platforms, the vulnerability granted attackers full access to messages, payments, and WeChat's extensive ecosystem of mini-programs and services. Tencent patched the flaw in August 2026 versions 8.0.77 for Android and 8.0.76 for iOS. This incident highlights the growing sophistication of mobile application attacks and the critical importance of securing communication platforms that serve as digital wallets and business ecosystems, particularly as zero-click exploits become increasingly weaponized against high-value messaging applications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI Reasoning Traces Theft: The 2026 Vulnerability That Exposed AI's Hidden Thoughts
AI Reasoning Traces Theft: The 2026 Vulnerability That Exposed AI's Hidden Thoughts
Computer Software/Engineering2 months ago

AI Reasoning Traces Theft: The 2026 Vulnerability That Exposed AI's Hidden Thoughts

In 2026, security researchers discovered a critical vulnerability affecting major AI providers including OpenAI, Anthropic, and Google, where encrypted reasoning traces from large language models could be stolen and decoded. The attack exploited the interchangeable nature of encrypted reasoning blocks across different sessions and models, allowing adversaries to inject traces into weaker models to extract proprietary reasoning in plaintext. This vulnerability enabled four distinct attack vectors: circumventing anti-distillation mechanisms, large-scale private data extraction, revealing hidden hazardous information, and executing invisible prompt injections. Researchers successfully extracted 367 PII artifacts and 182 credentials from 315,320 reasoning blocks scraped from public repositories, demonstrating the significant privacy and security implications. This incident highlights the emerging risks in AI security as organizations increasingly deploy autonomous AI agents and rely on cloud-based AI services, making AI-specific vulnerabilities a critical new attack surface that traditional security measures may not adequately address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
N-able N-central CVE-2026-86218: When RMM Platforms Become Attack Vectors
N-able N-central CVE-2026-86218: When RMM Platforms Become Attack Vectors
Information Technology/IT2 months ago

N-able N-central CVE-2026-86218: When RMM Platforms Become Attack Vectors

N-able released an emergency hotfix for CVE-2026-86218, a maximum-severity remote code execution vulnerability in its N-central remote monitoring and management platform used by IT departments and MSPs. The flaw allows unprivileged attackers to execute malicious code on exposed N-central instances through low-complexity attacks. With nearly 1,500 N-central servers exposed online and evidence of active exploitation flagged by Huntress cybersecurity, the company urged immediate patching to N-central 2026.3 Hotfix 4. This incident highlights the persistent targeting of remote management platforms that provide privileged access to client networks and infrastructure. RMM platforms continue to be attractive targets as they offer attackers potential access to multiple downstream organizations through a single compromise, making them critical components in supply chain attack scenarios.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
ConnectWise Issues Emergency Alert for Unpatched ScreenConnect Vulnerability
ConnectWise Issues Emergency Alert for Unpatched ScreenConnect Vulnerability
Information Technology/IT2 months ago

ConnectWise Issues Emergency Alert for Unpatched ScreenConnect Vulnerability

In September 2026, ConnectWise disclosed a critical file transfer vulnerability in ScreenConnect Remote Access that affects both cloud and on-premises deployments. The flaw, which has not yet received a CVE identifier, impacts file transfer behavior in ScreenConnect support and access sessions. ConnectWise released temporary mitigation measures requiring administrators to disable TransferFiles permissions while a permanent patch is developed. With nearly 6,000 ScreenConnect instances exposed online according to Shadowserver, this vulnerability poses significant risk to managed service providers and IT departments. This incident highlights the ongoing targeting of remote access tools by threat actors, particularly as organizations increasingly rely on cloud-hosted management platforms. ScreenConnect has been repeatedly exploited by ransomware groups and state-sponsored attackers, making this unpatched vulnerability a critical concern for enterprise security teams.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mathspace Breach Exposes 1M+ Records: How ShinyHunters Weaponized Metabase Vulnerabilities
Primary/Secondary Education2 months ago

Mathspace Breach Exposes 1M+ Records: How ShinyHunters Weaponized Metabase Vulnerabilities

On August 10, 2026, threat actors exploited a critical SQL injection vulnerability in Mathspace's self-hosted Metabase instance, gaining administrator access and stealing personal data from over 1 million students, staff, and parents across Australia and New Zealand. The attack was executed by the ShinyHunters extortion gang, who downloaded the data on August 27 before the breach was confirmed on September 3. This incident was part of a broader campaign targeting multiple organizations' Metabase installations worldwide, affecting companies including Trezor, Framework, and Tally. This breach highlights the critical importance of securing internal reporting systems and data analytics platforms, as threat actors increasingly target business intelligence tools that often have broad database access. The incident demonstrates how zero-day vulnerabilities in widely-used SaaS tools can be weaponized at scale, creating cascading impacts across multiple organizations simultaneously.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Trezor Breach Exposes 81,000 Customers: Third-Party Risk Management Failures
Trezor Breach Exposes 81,000 Customers: Third-Party Risk Management Failures
Financial Services2 months ago

Trezor Breach Exposes 81,000 Customers: Third-Party Risk Management Failures

In August 2026, cryptocurrency hardware wallet maker Trezor disclosed a significant data breach at its third-party shipping provider ShipMonk, initially affecting 14,000 customers across multiple countries. The breach expanded dramatically when it was revealed that ShipMonk had failed to delete historical customer data as contractually required, ultimately exposing personal information of 81,000 customers including names, addresses, email addresses, and phone numbers. The attack exploited a critical SQL injection zero-day vulnerability in the Metabase analytics platform, with the ShinyHunters extortion gang later claiming responsibility and sending extortion demands to ShipMonk. This incident highlights the persistent vulnerability of third-party supply chains and the critical importance of data retention policies in an era where cryptocurrency adoption is accelerating and regulatory scrutiny is intensifying. The breach demonstrates how a single compromised analytics platform can cascade across multiple organizations, affecting everything from hardware manufacturers to online service providers.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
PEEP Malware Transforms Chrome and Edge Into Persistent Backdoors
PEEP Malware Transforms Chrome and Edge Into Persistent Backdoors
Financial Services2 months ago

PEEP Malware Transforms Chrome and Edge Into Persistent Backdoors

In September 2026, cybersecurity researchers disclosed PEEP, a sophisticated post-exploitation toolkit that transforms Chrome and Edge browsers into persistent backdoors. The malware, derived from the open-source RedExt framework, masquerades as a Smart Bookmarks extension and bypasses browser security by manipulating Chromium's Secure Preferences integrity values. Once deployed on compromised systems, PEEP establishes command-and-control communications via plaintext HTTP, exfiltrates browsing data and credentials, and enables remote command execution through a native messaging host. The toolkit demonstrates advanced persistence techniques and represents a significant evolution in browser-based post-compromise frameworks. This incident highlights the growing sophistication of browser-based attack vectors as threat actors increasingly leverage trusted applications to maintain persistence and evade detection in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
StyleSmuggler Zero-Day: How Advanced Backdoors Bypass E-Commerce Security
StyleSmuggler Zero-Day: How Advanced Backdoors Bypass E-Commerce Security
Retail Industry2 months ago

StyleSmuggler Zero-Day: How Advanced Backdoors Bypass E-Commerce Security

On September 4, 2026, threat actors began exploiting a zero-day vulnerability dubbed 'StyleSmuggler' affecting all versions of Magento and Adobe Commerce platforms. The attackers leveraged PHP code injection through Magento's template system to generate fake payment failure emails, triggering code execution that deployed a sophisticated Rust-based Linux backdoor. The malware disguises itself as legitimate system processes and establishes persistent command-and-control communication using NTP traffic mimicry to evade detection. With over 160,000 Magento installations worldwide, including 14,000 high-traffic sites, this incident represents a significant supply chain risk. This attack highlights the growing trend of threat actors targeting e-commerce platforms through zero-day exploits, coinciding with increased regulatory scrutiny on supply chain security and the rising sophistication of malware that mimics legitimate network protocols to bypass traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk
Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk
Computer Software/Engineering2 months ago

Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk

In July 2026, Progress Software patched a critical vulnerability chain in Telerik UI for ASP.NET AJAX (CVE-2026-13181) that allows unauthenticated remote code execution. Security firm TantoSec released a working exploit in September 2026, demonstrating how attackers can chain a padding oracle vulnerability with unguarded type resolution to achieve code execution on vulnerable web applications. The attack requires specific non-default configurations including custom encryption keys, affecting versions 2010.1.309 through 2026.2.519. While no confirmed exploitation has been reported for these specific CVEs, the Telerik component has a history of being targeted by ransomware groups and nation-state actors through previous vulnerabilities. This incident highlights the persistent risks in web application components and the importance of timely patching, especially given Telerik's history as a favored target for sophisticated threat actors seeking initial access to enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ScreenConnect Worm: How Four-Stage VBScript Chains Are Spreading Through Remote Access Tools
ScreenConnect Worm: How Four-Stage VBScript Chains Are Spreading Through Remote Access Tools
Information Technology/IT2 months ago

ScreenConnect Worm: How Four-Stage VBScript Chains Are Spreading Through Remote Access Tools

In August 2026, cybersecurity researchers at Huntress disclosed a sophisticated worm-like malware campaign that exploited ConnectWise ScreenConnect remote access software to distribute malicious VBScript payloads. The attack utilized three distinct initial access vectors: Quick Assist tech support scams, phishing-delivered MSI installers, and fake Geek Squad refund forms. Once deployed, rogue ScreenConnect clients executed a four-stage VBScript chain (1.vbs through 4.vbs) that performed system reconnaissance, downloaded encrypted payloads from Dropbox, and deployed various malicious tools including additional backdoors, privilege escalation utilities, and cryptocurrency miners. This incident highlights the ongoing evolution of remote access tool abuse as a primary attack vector, particularly relevant as organizations continue to rely heavily on remote support solutions post-pandemic. The worm-like propagation mechanism represents a concerning advancement in malware distribution techniques, automatically infecting new systems that connect to compromised ScreenConnect instances.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Multi-Vector Cyber Campaign: Chrome Zero-Day, Router Hijacks, and Supply Chain Compromise
Multi-Vector Cyber Campaign: Chrome Zero-Day, Router Hijacks, and Supply Chain Compromise
Computer Software/Engineering2 months ago

Multi-Vector Cyber Campaign: Chrome Zero-Day, Router Hijacks, and Supply Chain Compromise

In September 2024, multiple critical cybersecurity incidents converged to highlight evolving attack vectors. A Chrome zero-day vulnerability (CVE-2024-7971) allowed remote code execution through malicious web pages, while simultaneous router hijacking campaigns compromised network infrastructure to redirect traffic. Most significantly, a supply chain attack targeting the Coder development platform delivered malicious code that harvested developer credentials and source code from compromised environments. These incidents collectively impacted thousands of organizations across technology, finance, and government sectors. These attacks represent the current threat landscape where attackers simultaneously exploit browser vulnerabilities, network infrastructure weaknesses, and developer toolchain trust relationships to maximize impact and persistence.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports