Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Critical Cursor Vulnerability Exposes Windows Systems to Malicious Code Execution
In July 2026, a critical vulnerability was discovered in the Cursor development environment, allowing malicious actors to execute arbitrary code on Windows systems. By placing a malicious file named 'git.exe' in the root of a Git repository, attackers could achieve code execution when the repository was opened in Cursor, without any user prompt or warning. This flaw granted attackers access to developers' credentials, including SSH keys and cloud tokens, posing significant security risks. Despite being reported in December 2025, the vulnerability remained unpatched as of July 2026, leaving many systems exposed. This incident underscores the growing threat of supply chain attacks targeting development tools and environments. As developers increasingly rely on third-party repositories and AI-assisted coding tools, the potential for such vulnerabilities to be exploited has risen, emphasizing the need for vigilant security practices and prompt patching of identified flaws.
2 months ago
Kill Chain
Critical Security Updates Released for Major Software Products
In July 2026, Mozilla, Google, Adobe, and VMware released critical security updates addressing multiple vulnerabilities across their products. Mozilla's Firefox 152.0.6 patched two critical flaws (CVE-2026-15718 and CVE-2026-15719) with public exploit code available, though no active exploitation was reported. Google's Chrome 150.0.7871.124/.125 addressed 15 security flaws, including two critical use-after-free vulnerabilities (CVE-2026-15764 and CVE-2026-15765) in the Ozone component. Adobe released updates for 88 vulnerabilities, including critical issues in ColdFusion, Commerce, Experience Manager, and Illustrator. VMware also issued patches for multiple critical vulnerabilities in its products. These updates highlight the ongoing need for organizations to promptly apply security patches to mitigate risks associated with publicly disclosed vulnerabilities. The presence of exploit code increases the urgency for immediate action to prevent potential exploitation.
2 months ago
Kill Chain
SAP's July 2026 Security Updates: Addressing Critical Vulnerabilities in NetWeaver and Commerce Cloud
In July 2026, SAP released security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, Commerce Cloud, and Approuter. The most severe, CVE-2026-44747, is a memory corruption issue in NetWeaver Application Server ABAP, potentially leading to unauthorized data access and system unavailability. CVE-2026-27690, an HTTP request smuggling vulnerability in SAP Approuter, could allow unauthenticated attackers to access user responses and trigger denial-of-service attacks. CVE-2026-44761 in SAP Commerce Cloud involves default credentials that enable attackers to obtain valid access tokens and manipulate data via certain APIs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/?utm_source=openai)) These vulnerabilities underscore the critical need for organizations to promptly apply security patches to prevent potential exploitation. The increasing complexity and integration of enterprise software systems make timely updates essential to maintain system integrity and protect sensitive data.
2 months ago
Kill Chain
Uncovering the BoryptGrab Infostealer: Nearly 300 Fake GitHub Repositories Distribute Malware
In July 2026, a sophisticated cyber campaign was uncovered involving nearly 300 fraudulent GitHub repositories that impersonated legitimate software projects to distribute the BoryptGrab infostealer malware. These repositories targeted users searching for security tools, cryptocurrency services, financial applications, developer utilities, secure email providers, macOS utilities, and gaming software. The malware was capable of harvesting data from over 19 web browsers, extracting information from 32 cryptocurrency wallets, and exfiltrating sensitive details from messaging and social media applications. The campaign utilized deceptive landing pages with trust-inducing elements to lure victims into downloading malicious ZIP archives containing trojanized DLL files and legitimate executables, which, when executed, loaded the infostealer into memory. This incident underscores a growing trend where threat actors exploit trusted platforms like GitHub to disseminate malware, leveraging search engine optimization (SEO) techniques to enhance the visibility of malicious repositories. The use of legitimate-looking repositories and sophisticated social engineering tactics highlights the evolving nature of cyber threats and the need for heightened vigilance when downloading software from online sources.
2 months ago
Kill Chain
LabubaRAT: A New Rust-Based RAT Disguised as NVIDIA Software
In July 2026, cybersecurity researchers identified LabubaRAT, a previously undocumented Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to infiltrate Windows systems. The malware establishes a persistent foothold, enabling attackers to profile the host, identify security tools, execute commands, transfer files, capture screenshots, and proxy traffic through the compromised system. LabubaRAT employs multiple communication methods, including HTTPS, WebView2, and DNS tunneling, to maintain access even if one pathway is detected and blocked. The attack initiates with an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit. Instead of hard-coding its command-and-control (C2) information, the malware accepts runtime configurations via command-line arguments, allowing operators to define parameters such as server details and polling intervals. This flexibility enables the reuse of the same binary across different infrastructures and campaigns without modification. Once deployed, LabubaRAT conducts discovery operations to inventory installed web browsers and security products, gathering information on the host's environment to tailor its functionality accordingly. The malware's capabilities include command execution, PowerShell and JavaScript execution, screenshot capture, file upload and download, archive handling, and SOCKS5 proxy support. These features provide attackers with comprehensive control over the infected host, facilitating data exfiltration and further malicious activities. The emergence of LabubaRAT underscores the evolving sophistication of malware designed to evade detection by masquerading as legitimate software. Its use of Rust, a language known for its performance and safety features, highlights a trend among threat actors to adopt modern programming languages to develop more robust and stealthy malware. Organizations must remain vigilant and implement robust security measures to detect and mitigate such threats.
2 months ago
Kill Chain
SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747
In July 2026, SAP released a critical security update addressing CVE-2026-44747, a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. This flaw allows authenticated attackers to exploit memory management errors, potentially leading to unauthorized data access, modification, or system unavailability. The vulnerability affects multiple versions of the SAP NetWeaver AS ABAP kernel, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. Organizations using these versions are urged to apply the provided patches promptly to mitigate the risk of exploitation. The disclosure of CVE-2026-44747 underscores the ongoing challenges in securing enterprise resource planning (ERP) systems. As these platforms are integral to business operations, vulnerabilities within them present significant risks. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to stay vigilant against emerging threats targeting critical business applications.
2 months ago
Kill Chain
Critical Vulnerability in 'Claude for Chrome' Exposes User Data
In July 2026, security researchers identified a critical vulnerability in Anthropic's 'Claude for Chrome' extension, allowing malicious browser extensions to exploit Claude's automation capabilities. This flaw enables unauthorized access to sensitive user data, including Gmail, Google Docs, and Calendar, by triggering tasks without user consent. Despite previous mitigation efforts, the vulnerability persists in version 1.0.80, posing significant security risks to users. The incident underscores the growing threat of prompt injection attacks targeting AI-powered browser extensions. As AI tools become more integrated into daily workflows, ensuring robust security measures and user awareness is paramount to prevent unauthorized data access and maintain user trust.
2 months ago
Kill Chain
Critical Vulnerability in Cursor IDE: Automatic Execution of Malicious Code in Compromised Repositories
In July 2026, a critical vulnerability was discovered in Cursor IDE, an AI-powered coding platform. This flaw allows attackers to embed a malicious 'git.exe' file within a repository. When a developer opens such a compromised project, Cursor automatically executes the malicious binary without any warnings or prompts, leading to potential unauthorized code execution on the developer's machine. Despite being reported to Cursor in December 2025, the vulnerability remains unpatched, posing significant risks to developers using the platform. This incident underscores the growing security challenges associated with AI-assisted development tools. As these platforms become more integrated into software development workflows, they present new attack vectors that can be exploited by threat actors. The lack of prompt remediation highlights the need for developers and organizations to remain vigilant, implement robust security measures, and advocate for timely patches from software vendors to mitigate emerging threats.
2 months ago
Kill Chain
ShinyHunters' Year-Long Exploitation of OAuth in Salesforce Breaches
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters orchestrated a series of data extortion attacks targeting corporate Salesforce environments. By exploiting trust relationships through OAuth connections, they gained unauthorized access without exploiting platform vulnerabilities. Their methods included voice phishing to trick employees into approving malicious connected apps, stealing OAuth tokens from compromised software vendors, and leveraging misconfigured guest access to Salesforce sites. These tactics allowed them to exfiltrate sensitive CRM data from numerous organizations across various industries. This incident underscores the evolving threat landscape where attackers exploit trusted integrations and social engineering to bypass traditional security measures. Organizations must enhance their monitoring of OAuth activities, audit third-party app permissions, and educate employees on the risks of social engineering to mitigate such sophisticated attacks.
2 months ago
Kill Chain
Lucide Proxy Campaign: A New Wave of Supply Chain Attacks
In May 2026, a campaign involving 148 malicious npm packages, disguised as student web proxies, covertly transformed users' browsers into nodes of a distributed denial-of-service (DDoS) botnet. These packages, branded as 'Lucide' and presented as tutoring services like 'Riverbend Tutoring' and 'Northstar Tutoring,' lured students seeking to bypass school web filters. Upon visiting these proxy sites, users' browsers loaded remote JavaScript payloads that executed DDoS attacks and injected aggressive popunder advertisements. The campaign exploited the npm ecosystem to distribute these packages, leveraging the browsers of end-users for malicious activities without their knowledge. ([research.jfrog.com](https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign/?utm_source=openai)) This incident underscores a significant evolution in supply chain threats, highlighting the vulnerability of end-user systems to malicious code distributed through trusted platforms. The attackers' use of mutable remote loaders and rapid iteration of package versions indicates a low operational security posture, focusing on maximizing short-term impact. Organizations must remain vigilant against such deceptive tactics, emphasizing the importance of scrutinizing third-party packages and educating users about the risks associated with untrusted proxy tools.
2 months ago
Kill Chain
Grok Build CLI's Unauthorized Git Repository Uploads Raise Privacy Concerns
In July 2026, security researcher cereblab discovered that xAI's Grok Build CLI (version 0.2.93) was uploading entire Git repositories, including full commit histories and files not accessed during coding tasks, to a Google Cloud Storage bucket managed by xAI. This behavior occurred even when users disabled the 'Improve the model' setting, which was presumed to prevent such data transmissions. The uploads included sensitive information, such as credentials stored in `.env` files, raising significant privacy and security concerns. xAI addressed the issue by implementing a server-side configuration change to halt these unauthorized uploads. ([breachnews.com](https://breachnews.com/research/grok-build-uploaded-entire-git-repositories-to-xai-storage-by-default/?utm_source=openai)) This incident underscores the critical importance of transparency and user consent in AI tools handling sensitive data. It highlights the need for developers to scrutinize the data practices of AI coding assistants and for organizations to implement robust data governance policies to protect proprietary information.
2 months ago
Kill Chain
Critical RabbitMQ Vulnerabilities Expose OAuth Secrets - CVE-2026-57219
In July 2026, two critical vulnerabilities were identified in RabbitMQ, a widely used open-source message broker. The most severe, CVE-2026-57219, allowed unauthenticated attackers to access the broker's OAuth client secret via an obsolete management API endpoint, potentially enabling full control over the messaging infrastructure. The second flaw, CVE-2026-57221, permitted authenticated users with no privileges to view metadata of other tenants' queues and exchanges, risking exposure of sensitive business information. Both vulnerabilities have been patched in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Organizations are urged to update their systems and rotate any exposed OAuth secrets to mitigate potential risks. ([scworld.com](https://www.scworld.com/news/rabbitmq-fixes-flaw-that-allowed-broker-takeover-via-oauth-secret-disclosure?utm_source=openai)) These incidents underscore the critical importance of securing management interfaces and promptly addressing deprecated endpoints to prevent unauthorized access and data exposure. The widespread use of RabbitMQ amplifies the potential impact, highlighting the need for vigilant security practices in managing messaging infrastructures.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports