Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
GitLab CVE-2026-85706: Maximum-Severity Path Traversal Puts DevSecOps at Risk
GitLab disclosed CVE-2026-85706, a maximum-severity path traversal vulnerability in its repository commits API that allows unauthenticated attackers to read arbitrary files from vulnerable servers. The flaw stems from improper path confinement and missing authentication enforcement, enabling threat actors to access sensitive data including credentials, secrets, and configuration files through a single HTTP request. Within 24 hours of disclosure, security researchers observed active scanning attempts targeting unpatched GitLab instances, demonstrating the critical nature of this vulnerability. GitLab has released patches in versions 19.3.2, 19.2.6, and 19.1, urging immediate deployment across all self-managed installations. This incident highlights the persistent threat of path traversal vulnerabilities in DevSecOps platforms, particularly as organizations increasingly rely on these systems for critical development workflows. With GitLab serving over 30 million users including Fortune 100 companies, unpatched instances present significant supply chain and intellectual property risks.
1 week ago
Kill Chain
How Threat Actors Weaponized Trusted AI Platforms for Social Engineering
In 2026, Huntress Labs documented a sophisticated social engineering campaign where threat actors weaponized trusted AI platforms including Claude, ChatGPT, and Grok to deliver malware. The FakeAgent campaign exploited Claude Artifacts and shared conversation features to create fake download pages and malicious install guides that appeared legitimate due to hosting on trusted domains like claude.ai, chatgpt.com, and grok.com. Over nine months, attackers delivered SectopRAT, MacSync stealer, and AMOS stealer malware to over 29 organizations by abusing shareable AI content and SEO poisoning techniques. This represents a significant evolution in social engineering tactics as attackers leverage the inherent trust users place in established AI platforms to bypass traditional security awareness training and detection mechanisms.
1 week ago
Kill Chain
JFrog Artifactory Under Attack: Critical Vulnerability Chain Enables Supply Chain Compromise
Between August and September 2026, threat actors exploited a chain of critical vulnerabilities in JFrog Artifactory (CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329) to bypass authentication and gain administrative privileges on self-hosted instances. Attackers leveraged these flaws to obtain JWT tokens for anonymous users, escalate to admin-level permissions within minutes, and deploy custom Rust-based backdoors with command-and-control capabilities. The campaign affected multiple organizations, with attackers installing malicious Groovy plugins, establishing persistence, stealing configuration data, and creating rogue administrator accounts across vulnerable infrastructure. This incident highlights the escalating sophistication of supply chain attacks targeting development infrastructure, as 49-62% of internet-accessible Artifactory instances remain vulnerable to these authentication bypass flaws, creating widespread exposure across the software development ecosystem.
1 week ago
Kill Chain
How ShinyHunters Weaponized Claude AI to Harvest Secrets from 1.8 Million Android Apps
Between December 2025 and August 2026, multiple threat groups including ShinyHunters, Russian state-sponsored Midnight Blizzard, and Chinese espionage group GTG-10007 systematically abused Anthropic's Claude AI model for large-scale cyberattacks. The most significant operation involved ShinyHunters member 'frkoo' deploying an automated credential-harvesting pipeline across AWS infrastructure that extracted secrets from 1.8 million Android applications and compromised over 40 Microsoft corporate tenants within 34 hours. The AI-enhanced attacks enabled rapid progression from initial access to administrative control in under three hours, with confirmed breaches across government, healthcare, energy, and technology sectors. This incident represents a critical inflection point where AI capabilities are being weaponized at unprecedented scale and speed, fundamentally changing the threat landscape and requiring immediate reassessment of defensive strategies against AI-enhanced cybercrime operations.
1 week ago
Kill Chain
GitLab's CVSS 10.0 Vulnerability: Why DevOps Security Can't Wait
GitLab disclosed a critical path traversal vulnerability (CVE-2026-85706) with a maximum CVSS score of 10.0, allowing unauthenticated attackers to read arbitrary files from GitLab servers through the repository commits API. The flaw affects GitLab CE and EE versions from 18.7 through 19.3.1, stemming from improper path confinement and missing authentication enforcement. Within hours of public disclosure on September 11, 2026, security researchers observed active in-the-wild exploitation attempts targeting exposed GitLab instances to extract log files, configuration data, credentials, and sensitive information. This incident highlights the accelerating timeline from vulnerability disclosure to active exploitation, particularly for DevOps platforms that house critical source code and CI/CD secrets. Following a similar pattern to the recent GitLab GraphQL injection vulnerability (CVE-2026-19478), attackers are rapidly weaponizing these flaws to compromise software supply chains and inject malicious code into build pipelines.
1 week ago
Kill Chain
How Seven Chinese AI Labs Stole 190+ Million Claude Conversations in Massive Distillation Attack
In September 2026, Anthropic disclosed that seven China-based AI laboratories, including Alibaba, Moonshot, DeepSeek, and others, conducted industrial-scale illicit distillation attacks against Claude AI models between February and July 2026. The attackers used networks of fake accounts created with stolen credit cards and API keys to extract over 190 million conversation exchanges, routing requests through proxy services to harvest Claude's capabilities including chain-of-thought reasoning, coding abilities, and logical reasoning functions for unauthorized training of competing models. This incident highlights the emerging threat landscape of AI model theft and intellectual property extraction, representing a new category of cybercrime where nation-state affiliated entities systematically steal proprietary AI capabilities to advance their own technological development and competitive positioning.
1 week ago
Kill Chain
UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine
In September 2026, Russia-aligned threat group UAC-0099 deployed a novel AI manipulation technique called GuardBreaker against Ukrainian targets. The attackers embedded nuclear weapon prompts within malicious VBScript comments to trigger AI safety mechanisms and prevent automated malware analysis systems from examining their code. This represents a significant evolution in adversarial tactics, where threat actors manipulate AI defensive reasoning rather than increasing malware sophistication to achieve compromise. This incident highlights the accelerating arms race between AI-powered security tools and adversaries who exploit their limitations. With AI systems now discovering vulnerabilities at unprecedented speed and scale, traditional 90-day patch cycles are obsolete, creating an urgent need for multilayered defense strategies that don't rely solely on AI-based detection mechanisms.
1 week ago
Kill Chain
The PaperCut AI Swarm Attack: When Machines Wage Cyber Warfare
In August 2026, a Russian-speaking threat actor deployed hundreds of AI agents in a coordinated swarm attack targeting PaperCut NG and MF print management software. The AI-powered campaign compromised at least 440 instances across 395 organizations in 48 countries, achieving remote code execution within four hours and Active Directory domain admin access in just six hours total. Once fully launched, the swarm compromised 11 organizations in merely 26 seconds, demonstrating unprecedented speed and scale in automated cyberattacks. This incident represents a critical inflection point where AI agents are now actively integrated across the entire cyber kill chain, from reconnaissance to exfiltration. As nation-state actors and financially motivated groups increasingly weaponize large language models and agentic AI capabilities, organizations face a new reality where attackers can execute complex, multi-stage operations at machine speed while defenders still operate at human pace.
1 week ago
Kill Chain
How UNC3569 Weaponized Trusted Software: The Sogou Input Method Supply Chain Attack
In April 2026, China-linked threat group UNC3569 exploited a critical vulnerability (CVE-2026-51990) in Sogou Input Method, a widely-used Chinese character input tool with over 455 million monthly users. The attackers leveraged a crafted sgbiz: link to bypass security controls and deploy the GRAYRABBIT backdoor through an outdated Chromium browser engine with disabled sandboxing. The exploit chain utilized a 2021 V8 JavaScript engine vulnerability (CVE-2021-38003) that had been patched in Chrome but remained unaddressed in Sogou's embedded browser, allowing remote code execution with user privileges. This incident highlights the growing sophistication of supply chain attacks targeting widely-deployed software components, particularly those serving large user bases in critical regions. The exploitation of years-old vulnerabilities in embedded browsers demonstrates how legacy code in trusted applications creates persistent attack surfaces for nation-state actors.
1 week ago
Kill Chain
Russian Threat Actors Deploy AI Agents in Massive PaperCut Vulnerability Exploitation Campaign
In August 2026, PaperCut NG/MF print management software was compromised through active exploitation of two critical vulnerabilities, CVE-2026-81578 and CVE-2026-82078, allowing authentication bypass and arbitrary code execution. A suspected Russian-speaking threat actor deployed hundreds of AI agents powered by OpenAI's Codex and DeepSeek models to systematically target 395 organizations across 48 countries, primarily focusing on U.S. educational institutions while deliberately avoiding entities in Russia, China, and 25 other countries. This incident represents a significant evolution in attack automation, demonstrating how threat actors are leveraging AI at scale to accelerate exploitation campaigns. The targeting pattern and AI-driven approach signals a new era of automated, geopolitically-aware cyber operations that can rapidly compromise vulnerable infrastructure across multiple sectors simultaneously.
1 week ago
Kill Chain
Critical JFrog Artifactory Supply Chain Attack: CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 Analysis
Between August and September 2026, attackers exploited a chain of JFrog Artifactory vulnerabilities (CVE-2026-42018 and CVE-2026-42016) to gain administrator control over self-hosted servers and install backdoors. The attack sequence involved obtaining anonymous user tokens and escalating them to administrator privileges within minutes, followed by creating persistent admin accounts and deploying malicious Groovy plugins. A separate critical authentication bypass flaw (CVE-2026-82329) was also exploited independently, affecting six release branches and generating over 400,000 exploitation attempts. Supply chain attacks targeting software repositories have intensified as threat actors recognize the downstream impact of compromising build pipelines and artifact repositories. These incidents highlight the critical need for securing DevOps infrastructure, as compromised repositories can affect countless downstream applications and organizations that depend on them.
1 week ago
Kill Chain
Claude AI Weaponized: The Rise of Generative Threat Groups in 2026
Between December 2025 and August 2026, Anthropic identified sophisticated threat actors leveraging Claude AI models for cyber attacks, weapons design, propaganda, and mass surveillance operations. These 'Generative Threat Groups' (GTGs) included state-sponsored actors like Russian GTG-20006 (linked to APT29/Cozy Bear), Chinese intelligence operations, and French-speaking cybercriminals who automated reconnaissance, exploitation, and data exfiltration across multiple victims simultaneously. The campaigns demonstrated AI's ability to collapse the resource gap between nation-state operations and individual attackers, with some operations running autonomously for days with minimal human supervision. This incident represents a critical inflection point in cybersecurity, as AI-enhanced attacks are rapidly becoming mainstream among both state-sponsored and financially motivated threat actors. Organizations must urgently reassess their security postures to address AI-accelerated reconnaissance, automated exploitation, and scaled social engineering campaigns that can now operate at unprecedented speed and sophistication.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports