Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 84 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 997–1008 / 2541 reports
OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security
Computer Software/Engineering4 months ago

OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security

In early 2026, the OpenClaw AI agent ecosystem experienced a significant supply chain attack. Malicious actors uploaded over 800 compromised skills to ClawHub, OpenClaw's official skill marketplace, embedding infostealers and enabling agentic financial fraud. This breach exposed more than 135,000 instances, highlighting critical vulnerabilities in AI agent platforms. The incident underscores the urgent need for enhanced security measures in AI supply chains, as attackers increasingly exploit these platforms to distribute malware and conduct sophisticated cyber operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cordyceps Vulnerabilities Threaten Over 300 GitHub Repositories
Computer Software/Engineering4 months ago

Cordyceps Vulnerabilities Threaten Over 300 GitHub Repositories

In June 2026, cybersecurity firm Novee identified a systemic class of vulnerabilities, dubbed 'Cordyceps,' within GitHub Actions workflows. These flaws enable unauthenticated attackers to hijack continuous integration and continuous deployment (CI/CD) pipelines by exploiting insecure configurations in YAML files. The vulnerabilities affect repositories from major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, potentially compromising software supply chains and exposing sensitive credentials. ([securityweek.com](https://www.securityweek.com/exploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking/?utm_source=openai)) This incident underscores the escalating risks associated with CI/CD pipeline security, especially as AI-driven coding tools proliferate. Organizations must prioritize securing their development workflows to prevent similar supply chain attacks, which are becoming increasingly sophisticated and widespread. ([mallory.ai](https://www.mallory.ai/stories/019ef4cf-b141-7c22-b785-3b7e99e1c73f?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft and Partners Execute Unprecedented Takedown of Amadey and StealC Cybercrime Tools
Financial Services4 months ago

Microsoft and Partners Execute Unprecedented Takedown of Amadey and StealC Cybercrime Tools

In June 2026, Microsoft, in collaboration with international law enforcement agencies and industry partners, executed a court-authorized operation to simultaneously disrupt the Amadey botnet and StealC infostealer. These tools, often used in tandem by cybercriminals, were linked to over 140,000 infected computers globally in early May 2026. The operation targeted more than 200 command-and-control servers, significantly hindering the infrastructure supporting these malware families. This coordinated effort marked a strategic shift in cyber defense, emphasizing the importance of disrupting interconnected cybercrime tools to enhance the effectiveness of takedown operations. The success of this operation underscores the necessity for collaborative approaches in combating sophisticated cyber threats that exploit modular, pay-as-you-go models to escalate attacks rapidly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
LastPass Data Breach via Klue Supply Chain Attack in 2026
Computer Software/Engineering4 months ago

LastPass Data Breach via Klue Supply Chain Attack in 2026

In June 2026, LastPass experienced a data breach resulting from a supply chain attack on Klue, a third-party market intelligence platform integrated with LastPass's Salesforce environment. Attackers exploited compromised OAuth tokens obtained from Klue to access LastPass customer data, including names, phone numbers, email addresses, physical addresses, support case information, and sales-related data. Importantly, LastPass's core products, services, and customer vaults remained unaffected. ([blog.lastpass.com](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and supply chain vulnerabilities. Organizations must reassess their security postures, particularly concerning external partnerships, to mitigate potential threats arising from interconnected systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer
Financial Services4 months ago

New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer

In June 2026, a new macOS ClickFix campaign emerged, utilizing Terminal commands to silently download, mount, and execute info-stealing malware from malicious disk image (DMG) files. This attack infects Mac devices with the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallet data, Keychain information, messaging app data, and user documents. The campaign begins with a fake CAPTCHA page instructing users to open Terminal and paste a malicious command, leading to the automatic execution of the malware. This method represents an evolution in ClickFix attacks, combining social engineering with automated malware deployment to enhance stealth and effectiveness. The significance of this incident lies in the increasing sophistication of social engineering attacks targeting macOS users. By leveraging trusted system utilities and deceptive prompts, attackers can bypass traditional security measures and user vigilance. This trend underscores the need for enhanced user education, robust endpoint protection, and continuous monitoring to detect and mitigate such evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Xsolis Data Breach 2026: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences4 months ago

Xsolis Data Breach 2026: A Wake-Up Call for Healthcare Cybersecurity

In January 2026, healthcare technology company Xsolis experienced a data breach affecting nearly 1.4 million individuals. The breach resulted from a targeted phishing attack on January 20, 2026, which allowed unauthorized access to Xsolis's network. The attackers accessed files containing sensitive personal and health information, including names, addresses, dates of birth, Social Security numbers, health insurance details, and medical treatment information. Xsolis detected the unauthorized activity on January 22, 2026, promptly contained the breach, and initiated an investigation with external cybersecurity experts. The company has since notified affected individuals and implemented additional security measures to prevent future incidents. This incident underscores the persistent threat of phishing attacks in the healthcare sector, highlighting the critical need for robust cybersecurity measures and employee training to protect sensitive patient data. The breach also raises concerns about potential identity theft and fraud for the affected individuals, emphasizing the importance of vigilance and proactive monitoring of personal information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Malicious npm Packages Masquerade as PostCSS Tools to Deploy Windows RAT
Computer Software/Engineering4 months ago

Malicious npm Packages Masquerade as PostCSS Tools to Deploy Windows RAT

In June 2026, cybersecurity researchers identified a series of malicious npm packages masquerading as legitimate PostCSS tools. These packages, including 'aes-decode-runner-pro', 'postcss-minify-selector', and 'postcss-minify-selector-parser', were designed to deliver a Windows-based Remote Access Trojan (RAT) upon installation. The packages were published over the past month by an npm user named 'abdrizak'. The malicious code was heavily obfuscated, leveraging techniques like Base64 and XOR encoding, as well as minification, to resist analysis and detection efforts. Upon installation, the packages retrieved a malicious script from a remote server, executing it silently to deploy the RAT on Windows systems. ([research.jfrog.com](https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat/?utm_source=openai)) This incident underscores the persistent threat of supply chain attacks within the npm ecosystem. Attackers continue to exploit the trust in widely used open-source packages to distribute malware, highlighting the need for enhanced vigilance and security measures among developers and organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
AIR's Experiment Unveils Critical Security Gaps in AI Agent Skill Marketplaces
Computer Software/Engineering4 months ago

AIR's Experiment Unveils Critical Security Gaps in AI Agent Skill Marketplaces

In June 2026, security firm AIR conducted an experiment to highlight vulnerabilities in AI agent skill marketplaces. They created a fake AI agent skill named 'brand-landingpage,' which purported to assist users in building landing pages using Google's Stitch design tool. This skill was submitted to a popular skill marketplace and promoted via an Instagram ad, ultimately reaching approximately 26,000 agents, including those on corporate accounts. Notably, all security scanners tested by AIR marked the skill as safe. The payload was intentionally benign, merely collecting users' email addresses to demonstrate the ease with which malicious skills could bypass existing security measures. This incident underscores the pressing need for enhanced security protocols in AI agent skill ecosystems, as traditional trust signals such as GitHub stars and scanner verdicts proved insufficient in detecting potential threats. The reliance on external links within skills, which can be altered post-review, presents a significant risk, emphasizing the necessity for continuous monitoring and comprehensive vetting processes to safeguard against supply chain attacks in AI environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
DifyTap Vulnerabilities: A Wake-Up Call for AI Platform Security
Computer Software/Engineering4 months ago

DifyTap Vulnerabilities: A Wake-Up Call for AI Platform Security

In June 2026, security researchers identified four critical vulnerabilities, collectively termed 'DifyTap,' in the Dify AI platform. These flaws—CVE-2026-41947, CVE-2026-41948, CVE-2026-41949, and CVE-2026-41950—allowed unauthorized access to sensitive data, including private AI chat histories and documents across tenants. Exploitation could lead to significant data breaches and compromise of AI applications. The DifyTap vulnerabilities underscore the escalating risks associated with AI platforms, emphasizing the need for robust security measures and prompt patch management to protect sensitive information and maintain trust in AI-driven services.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
GitHub Actions Enhances Security with 'actions/checkout' v7 Update
Computer Software/Engineering4 months ago

GitHub Actions Enhances Security with 'actions/checkout' v7 Update

In June 2026, GitHub enhanced the security of its software supply chain by updating the 'actions/checkout' action to block common 'pwn request' attack patterns. These attacks exploit the 'pull_request_target' workflow trigger to execute malicious code with full workflow privileges. Effective June 18, 2026, 'actions/checkout' version 7 and later versions refuse to fetch fork pull request code in 'pull_request_target' and 'workflow_run' workflows by default, unless explicitly configured otherwise. This change aims to prevent unauthorized code execution and protect repositories from potential compromises. This update is particularly relevant now due to the increasing prevalence of supply chain attacks targeting CI/CD pipelines. By enforcing stricter defaults, GitHub addresses a critical vulnerability that has been exploited in recent incidents, thereby strengthening the overall security posture of the developer community.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Guarding AI Memory: Microsoft's Comprehensive Security Approach
Computer Software/Engineering4 months ago

Guarding AI Memory: Microsoft's Comprehensive Security Approach

In June 2026, Microsoft published an article titled 'Guarding AI Memory,' highlighting the critical importance of securing AI memory systems. The article discusses how AI memory transforms AI systems from stateless tools into learning collaborators, thereby increasing their attack surface. It emphasizes that without memory, attackers need to achieve their objectives in a single prompt, whereas with AI memory, they can shape behavior gradually over time or plant memories that influence agent reasoning after the original context is gone and user awareness is lower. Microsoft outlines a defense-in-depth approach to protect AI memory, spanning every layer of the stack: storage, retrieval, model interaction, and user control. This approach includes implementing sanitization checks on memory writes, governing stored memories with existing data policies, and providing observability through audit logs. The article also presents a guiding framework for building safe AI memory, emphasizing principles such as establishing intent and provenance before persistence, enforcing boundaries outside the model, treating retrieval as a risk decision, providing full lifecycle visibility for security teams, and keeping users in control. This publication underscores the evolving threat landscape in AI systems and the necessity for robust security measures to protect AI memory from potential attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
OpenAI's 'Patch the Planet' Initiative: A New Era in Open-Source Security
Computer Software/Engineering4 months ago

OpenAI's 'Patch the Planet' Initiative: A New Era in Open-Source Security

In June 2026, OpenAI, in collaboration with Trail of Bits, launched 'Patch the Planet,' an initiative aimed at enhancing the security of critical open-source software. This program pairs OpenAI's advanced AI models, such as GPT-5.5-Cyber, with human security engineers to identify vulnerabilities, develop patches, and assist maintainers in integrating these fixes. Early participants include projects like cURL, Go, Python, Sigstore, and pyca/cryptography. The initiative has already led to the discovery of hundreds of security issues and the merging of numerous patches, significantly improving the security posture of these foundational software components. ([techcrunch.com](https://techcrunch.com/2026/06/22/openai-launches-new-initiative-to-help-find-and-patch-open-source-bugs/?utm_source=openai)) The relevance of this initiative is underscored by the increasing reliance on open-source software in critical infrastructure and the persistent challenges in maintaining its security. By combining AI-driven analysis with expert human intervention, 'Patch the Planet' addresses the pressing need for scalable and efficient vulnerability remediation in the open-source ecosystem.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports