Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Exploiting AI Coding Agents: The New Frontier in Supply Chain Attacks
In June 2026, researchers at Mozilla's Zero Day Investigative Network (0DIN) identified a novel supply chain attack targeting AI coding agents. The attack involved a seemingly benign GitHub repository containing standard setup instructions. When an AI coding agent, such as Claude Code, cloned and initialized the repository, it encountered an error message prompting the execution of an initialization command. This command triggered a shell script that retrieved and executed a payload from a DNS TXT record controlled by the attacker, resulting in the establishment of an interactive shell on the developer's machine. This method allowed attackers to gain unauthorized access to sensitive information without any malicious code present in the repository itself. This incident underscores the evolving sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. As AI coding agents become more integrated into software development workflows, they present new vectors for exploitation. Organizations must enhance their security protocols to address these emerging threats, ensuring that AI tools are configured to disclose and verify the full execution chain of setup commands to prevent unauthorized code execution.
2 months ago
Kill Chain
ShinyHunters' Breach of Instructure's Canvas Platform Highlights Third-Party Risks in Education
In May 2026, the cybercriminal group ShinyHunters breached Instructure, the company behind the widely used learning management system Canvas, affecting numerous educational institutions. The attackers demanded a ransom, threatening to leak sensitive data if unpaid. This incident underscores the vulnerability of the education sector to third-party breaches, given its reliance on external vendors for critical services. ([insidehighered.com](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor?utm_source=openai)) The breach highlights the urgent need for educational institutions to enhance their third-party risk management strategies. As cyber threats targeting third-party vendors increase, schools must implement robust security measures and establish comprehensive incident response plans to mitigate potential damages.
2 months ago
Kill Chain
Critical Vulnerability in pydicom's pynetdicom Library Exposes Healthcare Systems
In June 2026, a critical vulnerability (CVE-2026-56445) was identified in the pydicom pynetdicom library, specifically affecting versions from 1.0.0 up to and including 3.0.4. This flaw resides in the qrscp application's C-STORE handler, which improperly handles attacker-supplied DICOM datasets, allowing unauthenticated attackers to write files to arbitrary paths on the server. The vulnerability poses significant risks, particularly to the healthcare sector, as it could lead to unauthorized data manipulation or system compromise. The maintainers of pynetdicom have not yet released a fix for this vulnerability. Organizations utilizing affected versions are advised to restrict network exposure of the qrscp DICOM port (default 11112) to trusted peers, implement firewall protections, and monitor for updates from the project's repository. This incident underscores the importance of securing medical imaging software against potential cyber threats.
2 months ago
Kill Chain
Critical SSRF Vulnerability in OHIF DICOM Web Viewer Framework (CVE-2026-12473)
In June 2026, a critical vulnerability (CVE-2026-12473) was identified in the OHIF DICOM Web Viewer Framework versions up to 3.12.0. This Server-Side Request Forgery (SSRF) flaw allowed attackers to steal authenticated clinicians' OIDC Bearer tokens via crafted links, potentially granting unauthorized access to sensitive patient data. The issue stemmed from two data sources—DICOMWebProxy and DICOMJSON—fetching arbitrary URL parameters without validation, leading to token exposure when requests were sent to attacker-controlled servers. ([hipaajournal.com](https://www.hipaajournal.com/high-severity-vulnerability-identified-in-ohif-viewers-dicom/?utm_source=openai)) The vulnerability was addressed with the release of version 3.12.2 on May 18, 2026. Users are strongly advised to upgrade to this version or later to mitigate the risk. This incident underscores the critical importance of validating external inputs and implementing robust security measures in healthcare applications to protect sensitive information. ([machinespirits.com](https://www.machinespirits.com/advisory/0a7f3c/?utm_source=openai))
2 months ago
Kill Chain
CISA Adds Two Known Exploited Vulnerabilities to Catalog
On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager. These vulnerabilities are actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize remediation of such high-risk vulnerabilities to protect their networks against active threats. While BOD 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to update the catalog as new vulnerabilities are identified.
2 months ago
Kill Chain
Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations
In June 2026, cybersecurity firms were targeted by a sophisticated social engineering campaign dubbed 'Poisoned Tenant.' Threat actors created fraudulent OpenAI ChatGPT organizations impersonating legitimate companies and sent authentic-looking invitations to employees, urging them to join these fake tenants. Upon acceptance, employees were granted administrative privileges, potentially exposing sensitive company information. The attackers utilized OpenAI's legitimate notification system, making the invitations appear credible and bypassing standard email security measures. This incident underscores the evolving tactics of cyber adversaries who exploit trusted platforms to execute social engineering attacks. The use of legitimate services to deliver malicious content highlights the need for organizations to enhance their security awareness training and implement robust verification processes for unsolicited invitations, even when they appear to originate from trusted sources.
2 months ago
Kill Chain
Polymarket Supply-Chain Attack Results in $3 Million Theft
In June 2026, Polymarket, a leading cryptocurrency-based prediction market platform, suffered a supply-chain attack resulting in the theft of approximately $3 million from its customers. Attackers compromised a third-party vendor, injecting malicious JavaScript into Polymarket's frontend. This script deceived users into approving fraudulent transactions, leading to unauthorized fund transfers. The platform's backend infrastructure remained unaffected, and Polymarket has committed to fully reimbursing the impacted users. This incident underscores the escalating threat of supply-chain attacks targeting financial platforms. As cybercriminals increasingly exploit third-party dependencies to infiltrate systems, organizations must enhance their security measures and conduct thorough audits of their supply chains to mitigate such risks.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Computer/Network Security
2 months ago
Kill Chain
Instructure's Canvas LMS Breached Twice by ShinyHunters in 2026
In early May 2026, Instructure's Canvas learning management system (LMS) suffered two significant cyberattacks orchestrated by the ShinyHunters group. The initial breach on April 29 led to the exfiltration of personal data from approximately 275 million users across nearly 9,000 educational institutions. Compromised information included names, email addresses, student ID numbers, and private messages. Despite Instructure's remediation efforts, ShinyHunters executed a second attack on May 7, defacing Canvas login pages to pressure the company into paying a ransom. In response, Instructure reached an agreement with the attackers, resulting in the return and purported destruction of the stolen data. ([techcrunch.com](https://techcrunch.com/2026/05/12/instructure-strikes-deal-with-hackers-who-breached-it-twice/?utm_source=openai)) This incident underscores a growing trend where cybercriminals target educational technology vendors to exploit vulnerabilities and access vast amounts of sensitive data. The attacks on Instructure highlight the critical need for robust cybersecurity measures within the edtech sector to protect against such large-scale breaches.
2 months ago
Kill Chain
Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026
In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai)) This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai))
2 months ago
Kill Chain
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
In June 2026, a sophisticated supply chain attack known as 'Miasma' compromised 32 npm packages under Red Hat's @redhat-cloud-services namespace. The attackers gained access through a compromised Red Hat employee's GitHub account, allowing them to push malicious commits that bypassed standard peer reviews. These commits exploited GitHub Actions workflows to publish trojanized package versions to the public npm registry. Upon installation, these packages executed an obfuscated payload designed to steal credentials from various platforms, including GitHub, AWS, Azure, and Google Cloud Platform. The malware also attempted to propagate by compromising additional maintainer packages and, in some cases, could destroy the maintainer’s home directory. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The Miasma campaign highlights the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package repositories to prevent unauthorized access and mitigate the risk of widespread credential theft and system compromise.
2 months ago
Kill Chain
Amazon Q Developer Vulnerability CVE-2026-12957: What You Need to Know
In June 2026, a critical vulnerability (CVE-2026-12957) was identified in Amazon Q Developer's handling of Model Context Protocol (MCP) servers. This flaw allowed malicious repositories to execute arbitrary commands on a developer's machine upon opening and trusting a workspace, potentially leading to unauthorized access to cloud credentials. The issue was promptly addressed by Amazon with the release of Language Servers for AWS version 1.69.0, mitigating the risk of exploitation. This incident underscores the growing security challenges associated with AI-powered development tools. As these tools become more integrated into the software development lifecycle, ensuring robust security measures and prompt patching of vulnerabilities is imperative to protect sensitive data and maintain trust in development environments.
2 months ago
Kill Chain
Gaslight Malware: A New Challenge for AI-Based Security on macOS
In June 2026, cybersecurity researchers identified a new macOS malware named 'Gaslight,' attributed to a North Korean-linked threat actor. This Rust-based malware functions as a backdoor and information stealer, embedding 38 fabricated system messages within its binary. These messages, formatted to resemble legitimate developer logs and error reports, aim to mislead AI-assisted malware analysis tools by simulating analysis errors, potentially causing the tools to abort or misinterpret the malware's behavior. The emergence of 'Gaslight' underscores a growing trend where threat actors develop sophisticated techniques to evade detection by AI-driven security solutions. This incident highlights the need for continuous advancement in cybersecurity defenses to counteract evolving obfuscation methods employed by adversaries.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports