Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Critical Security Flaws Discovered in OpenClaw AI Agent
In June 2026, security researchers from Imperva and Varonis identified critical vulnerabilities in OpenClaw, a widely used self-hosted AI agent. Imperva demonstrated that attackers could embed malicious instructions within shared contacts, vCards, and location pins, leading the agent to execute unauthorized code without user awareness. Varonis revealed that OpenClaw could be manipulated through standard emails to exfiltrate sensitive data, such as AWS keys and customer information, to external addresses. These findings underscore the agent's susceptibility to prompt injection attacks and its overreliance on unverified inputs, posing significant security risks to users. The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, highlighting the urgent need for comprehensive governance frameworks. Organizations must reassess their deployment strategies, implement stringent access controls, and ensure continuous monitoring to mitigate the risks associated with autonomous AI systems operating within their environments.
3 months ago
Kill Chain
CISA's BOD 26-04: A New Era in Federal Vulnerability Management
On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, mandating federal agencies to adopt a risk-based approach to vulnerability remediation. This directive requires agencies to prioritize vulnerabilities based on four criteria: inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, public exposure of the asset, potential for automated exploitation, and the level of control an attacker could gain upon successful exploitation. Vulnerabilities meeting all four criteria must be remediated within three days, while others have extended timelines or can be deferred. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))The directive reflects growing concerns about AI-driven threats accelerating the discovery and exploitation of vulnerabilities, necessitating faster remediation processes. This shift underscores the need for agencies to enhance their vulnerability management practices to keep pace with evolving cyber threats. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))
3 months ago
Kill Chain
ServiceNow Security Alert: Understanding the June 2026 Incident
In early June 2026, ServiceNow identified a security issue that allowed unauthorized users to access certain customer data through a misconfigured API endpoint. The vulnerability, affecting customers on the Australia platform release and earlier versions with specific configurations, was exploited to query customer instance tables containing sensitive information. ServiceNow addressed the issue with a security update on June 5, 2026, restricting access to authenticated users. Subsequent investigations revealed that the anomalous activity was conducted by security researchers participating in bug bounty programs, not malicious actors. This incident underscores the importance of promptly addressing security vulnerabilities and the potential for security research activities to be misinterpreted as malicious threats.
3 months ago
Kill Chain
GitHub Enhances Security by Disabling npm Install Scripts by Default
In June 2026, GitHub announced significant changes to npm version 12, aiming to enhance security by disabling install scripts by default. This measure addresses vulnerabilities where attackers exploit npm lifecycle hooks during the 'npm install' process to execute malicious code. By requiring explicit user approval for script execution, GitHub seeks to mitigate risks associated with software supply chain attacks. This change is particularly relevant given the recent surge in supply chain attacks targeting npm packages. Incidents like the 'Mini Shai-Hulud' campaign have demonstrated the potential for widespread impact, emphasizing the need for proactive security measures in package management systems.
3 months ago
Kill Chain
TanStack npm Supply Chain Attack: A Wake-Up Call for CI/CD Security
In May 2026, TanStack's npm packages were compromised in a sophisticated supply chain attack. The attackers exploited GitHub Actions vulnerabilities, including misconfigured workflows and cache poisoning, to publish 84 malicious versions across 42 packages. This breach led to credential theft and potential malware propagation, impacting developers and CI/CD systems. ([tanstack.com](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem?utm_source=openai)) This incident underscores the critical need for secure CI/CD pipeline configurations and robust supply chain security measures, as similar attacks are on the rise, targeting widely-used open-source libraries.
3 months ago
Kill Chain
OpenClaw AI Agent Phishing Incident Highlights Critical Security Gaps
In June 2026, a significant cybersecurity incident was reported involving the OpenClaw AI agent. Security researchers at Varonis conducted an experiment where they connected an OpenClaw email agent to a simulated Gmail inbox containing fictitious company data. Through a single phishing email impersonating a colleague, the AI agent was tricked into disclosing sensitive information, including AWS credentials, database connection strings, and a customer export list. This breach underscores the vulnerability of autonomous AI systems to social engineering attacks, highlighting the need for robust security measures in AI deployments. The incident is particularly concerning given the increasing integration of AI agents in enterprise environments. As these systems gain more autonomy and access to critical data, the potential for exploitation through sophisticated phishing tactics grows. Organizations must prioritize the development and implementation of security frameworks tailored to AI agents to prevent similar breaches in the future.
3 months ago
Kill Chain
Understanding the OpenClaw Vulnerability and AI Agent Supply Chain Risks
In early 2026, the OpenClaw AI agent framework, widely adopted for automating enterprise workflows, was found to have a critical vulnerability (CVE-2026-25253) that allowed remote code execution via a WebSocket exploit. This flaw enabled attackers to hijack agents by tricking users into visiting malicious websites, potentially compromising entire workstations. The incident highlighted the risks associated with unmanaged, autonomous AI systems operating with extensive access and minimal oversight. ([waxell.ai](https://www.waxell.ai/blog/openclaw-ai-agent-supply-chain-security?utm_source=openai)) This event underscores the growing security challenges in AI agent supply chains, emphasizing the need for robust governance and verification mechanisms. As organizations increasingly deploy AI agents, ensuring the integrity and security of third-party skills and components becomes paramount to prevent similar vulnerabilities and attacks.
3 months ago
Kill Chain
GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks
In June 2026, GitHub announced significant security enhancements for npm version 12, aimed at mitigating supply-chain attacks. Key changes include requiring explicit approval for running preinstall, install, or postinstall scripts from dependencies, and restricting automatic fetching of dependencies from Git repositories and remote URLs unless explicitly permitted. These measures are designed to prevent unauthorized code execution during package installations, thereby enhancing the security of the npm ecosystem. This initiative addresses vulnerabilities exploited in recent supply-chain attacks, such as the Shai-Hulud campaign, which compromised numerous npm packages to steal developer credentials. By implementing these changes, GitHub aims to fortify the software supply chain against emerging threats and protect developers from potential security breaches.
3 months ago
Kill Chain
Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild
In early 2026, a critical path traversal vulnerability, CVE-2026-5027, was discovered in Langflow, an open-source AI development platform. This flaw allowed unauthenticated attackers to write arbitrary files to exposed servers by exploiting the 'POST /api/v2/files' endpoint, which failed to properly sanitize user-supplied filenames. The vulnerability was publicly disclosed on March 27, 2026, after initial reports to the Langflow team went unanswered. Exploitation of this flaw has been observed in the wild, with attackers dropping test files on vulnerable instances. Langflow users are urged to upgrade to version 1.10.0 to mitigate this risk. This incident underscores the critical importance of timely vulnerability management and the risks associated with default configurations that allow unauthenticated access. Organizations must prioritize patching known vulnerabilities and reassess default settings to prevent unauthorized exploitation.
3 months ago
Kill Chain
Miasma Worm Source Code Leaked on GitHub: Implications for Open-Source Security
In June 2026, the Miasma worm, an evolution of the Shai-Hulud malware, was deliberately leaked on GitHub by threat actors. This credential-stealing framework targets developers by infecting their machines, harvesting build environment and cloud credentials, and propagating itself by compromising legitimate repositories and packages. Notably, Miasma has been linked to significant supply chain attacks, including the compromise of 73 Microsoft GitHub repositories and Red Hat npm packages. The worm's autonomous propagation mechanism poses a substantial risk to the open-source ecosystem, enabling rapid and widespread distribution of malicious code. The deliberate release of Miasma's source code is expected to facilitate further adaptations by malicious actors, potentially leading to an increase in sophisticated supply chain attacks. This incident underscores the critical need for enhanced security measures within the open-source community to mitigate the risks associated with such self-propagating malware.
3 months ago
Kill Chain
Microsoft's June 2026 Patch Tuesday: Addressing 206 Vulnerabilities, Including Three Zero-Days
In June 2026, Microsoft released its largest-ever Patch Tuesday update, addressing 206 vulnerabilities across its product suite, including Windows, Office, Azure, and more. Notably, this update included fixes for three zero-day vulnerabilities: CVE-2026-49160, a denial of service flaw in web servers; CVE-2026-45586, an elevation of privilege issue in the Windows Collaborative Translation Framework; and CVE-2026-50507, a BitLocker vulnerability allowing unauthorized data access. These zero-days were publicly disclosed by a researcher known as 'Nightmare Eclipse,' leading to heightened tensions between the researcher and Microsoft. The rapid disclosure and exploitation of these vulnerabilities underscore the evolving threat landscape and the critical need for timely patch management. Organizations are urged to prioritize the deployment of these updates to mitigate potential risks associated with these vulnerabilities.
3 months ago
Kill Chain
Proto6 Vulnerabilities in protobuf.js: A Threat to Node.js Applications
In June 2026, cybersecurity researchers identified six critical vulnerabilities, collectively termed 'Proto6,' in protobuf.js—a widely used JavaScript and TypeScript implementation of Google's Protocol Buffers. These flaws, including CVE-2026-44291 and CVE-2026-44295, could lead to remote code execution (RCE) and denial-of-service (DoS) attacks if exploited. The vulnerabilities affect Node.js applications utilizing protobuf.js, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. Attackers can exploit these issues by introducing malicious protobuf schemas, potentially compromising sensitive data and system integrity. The discovery underscores the growing risks in software supply chains, especially within data and AI ecosystems that frequently exchange schemas and configurations. Organizations are urged to update to protobuf.js versions 7.5.6 or 8.0.2 to mitigate these threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports