Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 89 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 1057–1068 / 2541 reports
Understanding the 'SearchLeak' Vulnerability in Microsoft 365 Copilot (CVE-2026-42824)
Computer Software/Engineering4 months ago

Understanding the 'SearchLeak' Vulnerability in Microsoft 365 Copilot (CVE-2026-42824)

In June 2026, a critical vulnerability known as 'SearchLeak' (CVE-2026-42824) was discovered in Microsoft 365 Copilot. This flaw allowed attackers to craft malicious links that, when accessed by a user, could exfiltrate sensitive data such as emails, meeting notes, and documents from OneDrive and SharePoint. The attack exploited a parameter-to-prompt injection (P2P) technique, enabling unauthorized data disclosure over the network. Microsoft promptly addressed the issue by releasing a patch to mitigate the vulnerability. The 'SearchLeak' incident underscores the evolving nature of AI-driven cyber threats, particularly those targeting large language model (LLM) systems integrated into enterprise environments. It highlights the necessity for organizations to implement robust security measures, including prompt isolation and output sanitization, to protect against sophisticated prompt-injection attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
Internet4 months ago

CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation

In May 2026, a critical vulnerability (CVE-2026-54420) was identified in the LiteSpeed cPanel Plugin versions prior to 2.4.8, allowing users with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux or CageFS. This flaw, resulting from improper handling of symbolic links, was actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog on June 15, 2026. Administrators were urged to upgrade to LiteSpeed WHM Plugin v5.3.2.1 or later to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-54420?utm_source=openai)) The incident underscores the persistent threat posed by privilege escalation vulnerabilities in widely used web hosting environments. It highlights the importance of timely patch management and vigilant monitoring to prevent unauthorized access and potential system compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Breach Infinite Campus: 137,000 School Staff Accounts Exposed
Primary/Secondary Education4 months ago

ShinyHunters Breach Infinite Campus: 137,000 School Staff Accounts Exposed

In March 2026, the ShinyHunters extortion group infiltrated Infinite Campus's Salesforce instance, compromising personal information of over 137,000 school staff members. The stolen data included names, email addresses, phone numbers, physical addresses, and support tickets. Infinite Campus, a leading EdTech provider serving over 3,200 school districts across the United States, confirmed the breach but stated that the majority of the exposed information was publicly available directory data. This incident underscores the escalating trend of cybercriminals targeting educational institutions and their service providers. The breach highlights the critical need for robust security measures and vigilant monitoring of third-party platforms to safeguard sensitive information in the education sector.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OptinMonster WordPress Plugin Hacked in CDN Supply-Chain Attack
Computer Software/Engineering4 months ago

OptinMonster WordPress Plugin Hacked in CDN Supply-Chain Attack

In June 2026, a supply-chain attack targeted WordPress plugins OptinMonster, TrustPulse, and PushEngage, all managed by Awesome Motive. Attackers exploited a vulnerability in the UpdraftPlus plugin to access Awesome Motive's marketing server, obtaining credentials for their content delivery network (CDN). They then injected malicious JavaScript into CDN-hosted files, which, when loaded by websites using these plugins, created rogue administrator accounts and installed backdoor plugins, granting full control over the compromised sites. This incident underscores the critical need for robust security measures in third-party integrations and highlights the growing trend of supply-chain attacks targeting widely-used software components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
North Korean Hackers Exploit Developer Tools in Sophisticated Phishing Campaign
Computer Software/Engineering4 months ago

North Korean Hackers Exploit Developer Tools in Sophisticated Phishing Campaign

In early 2026, a North Korean state-sponsored threat actor, identified as UNK_DeadDrop, launched a sophisticated phishing campaign targeting software developers across nearly 100 organizations, primarily in the United States. The attackers sent over 250 emails between April and May, masquerading as recruitment offers or code review requests. These emails directed recipients to clone malicious GitHub or GitLab repositories, which, when opened in code editors like Visual Studio Code, executed embedded malware. This approach enabled the attackers to steal cryptocurrency wallets and sensitive developer credentials. ([theregister.com](https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526?utm_source=openai)) This incident underscores a significant evolution in cyberattack methodologies, where adversaries exploit trusted developer tools and workflows to deliver malware. The campaign's scale and sophistication highlight the increasing targeting of the tech industry by state-sponsored actors, emphasizing the need for heightened vigilance and robust security measures within development environments. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical LiteLLM Vulnerabilities Expose AI Gateways to Unauthenticated RCE
Computer Software/Engineering4 months ago

Critical LiteLLM Vulnerabilities Expose AI Gateways to Unauthenticated RCE

In May 2026, a critical vulnerability chain was discovered in LiteLLM, an open-source AI gateway widely used to interface with over 100 large language model providers. The primary flaw, CVE-2026-42271, is a command injection vulnerability affecting versions 1.74.2 through 1.83.6. This vulnerability allows authenticated users, including those with low-privilege internal-user keys, to execute arbitrary commands on the host system by exploiting two Model Context Protocol (MCP) test endpoints. When combined with CVE-2026-48710, an authentication bypass in the Starlette web framework, attackers can achieve unauthenticated remote code execution, granting them full control over the server. This chain of vulnerabilities exposes sensitive API keys and secrets stored by the proxy, potentially compromising connected AI systems and enabling lateral movement within enterprise networks. The active exploitation of these vulnerabilities underscores the increasing targeting of AI gateway infrastructures by threat actors. Organizations relying on LiteLLM are urged to upgrade to version 1.83.7 or later, which addresses these issues by implementing stricter authorization controls and updating dependencies. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, emphasizing the urgency for immediate remediation to prevent potential breaches and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
U.S. Government Restricts Access to Anthropic's Advanced AI Models
Computer Software/Engineering4 months ago

U.S. Government Restricts Access to Anthropic's Advanced AI Models

In June 2026, the U.S. government issued an export control directive requiring Anthropic to suspend access to its advanced AI models, Fable 5 and Mythos 5, for all foreign nationals, including those within the United States. This action was taken due to national security concerns over potential vulnerabilities that could allow the models to be exploited for identifying software flaws. As a result, Anthropic disabled these models for all users to ensure compliance. This unprecedented move underscores the growing tension between technological advancement and national security, highlighting the challenges in regulating AI technologies. The directive has sparked international debate over the balance between innovation and security, with European leaders expressing concerns about overreliance on American AI providers and advocating for greater technological sovereignty.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Massive WordPress Plugin Supply Chain Attack Exposes Over 1.2 Million Sites
Computer Software/Engineering4 months ago

Massive WordPress Plugin Supply Chain Attack Exposes Over 1.2 Million Sites

In June 2026, a sophisticated supply chain attack targeted WordPress sites utilizing the PushEngage, OptinMonster, and TrustPulse plugins. Malicious actors tampered with JavaScript files served by these plugins, embedding code that, when loaded by a logged-in administrator, created unauthorized admin accounts and installed concealed backdoors. This breach potentially compromised over 1.2 million websites, granting attackers full control to exfiltrate data, deploy malware, or manipulate site content. The attack was active for varying durations across the plugins, with OptinMonster and TrustPulse affected for approximately 25 minutes on June 12, while PushEngage's exposure extended over several hours into June 14. This incident underscores the escalating threat of supply chain attacks within the WordPress ecosystem, highlighting the critical need for vigilant monitoring of third-party plugins and the implementation of robust security measures to detect and mitigate unauthorized code modifications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling the Threat: 152 Malicious Chrome Extensions Compromise User Security
Computer Software/Engineering4 months ago

Unveiling the Threat: 152 Malicious Chrome Extensions Compromise User Security

In June 2026, cybersecurity researchers uncovered a network of 152 Google Chrome extensions, primarily offering live wallpaper functionalities, that were distributing potentially unwanted programs (PUPs). These extensions, spanning 38 separate Chrome Web Store publisher accounts and three brand backends—tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com—had collectively amassed 105,000 installations. Despite claiming not to collect user data, the extensions' privacy policies revealed the logging of IP addresses, ISPs, click counts, and referrers, with data shared with Google AdSense, DoubleClick, and third-party ad partners. Additionally, some extensions manipulated browser behavior to simulate organic search traffic, thereby fabricating the origin of their own traffic. This incident underscores the persistent threat posed by malicious browser extensions, which can compromise user privacy and security. The deceptive practices employed highlight the need for vigilant monitoring of browser add-ons and the importance of scrutinizing privacy policies, even for seemingly benign applications.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-11645
Computer Software/Engineering4 months ago

Google Patches Actively Exploited Chrome Zero-Day Vulnerability CVE-2026-11645

In June 2026, Google addressed a high-severity zero-day vulnerability, CVE-2026-11645, in its Chrome browser. This flaw, an out-of-bounds read and write issue in the V8 JavaScript engine, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to mitigate the risk. Users were urged to update to version 149.0.7827.103 to secure their systems. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/?utm_source=openai)) This incident underscores the persistent targeting of widely used software by threat actors and highlights the critical importance of timely software updates. The exploitation of such vulnerabilities can lead to significant data breaches and system compromises, emphasizing the need for robust cybersecurity practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Evil MSI Background: Unveiling the 2026 Phishing Campaign
Computer Software/Engineering4 months ago

Evil MSI Background: Unveiling the 2026 Phishing Campaign

In June 2026, a sophisticated phishing campaign emerged, leveraging WeTransfer links to distribute malicious JavaScript files. These scripts, upon execution, utilized obfuscation techniques to decode and run PowerShell commands, which subsequently downloaded additional payloads, including a .NET DLL designed to manipulate Windows Task Scheduler. This method facilitated the execution of further malicious activities, potentially leading to persistent system compromise. The campaign notably exploited legitimate cloud services like Cloudflare Workers and R2 storage to host and distribute its malicious components, thereby enhancing its stealth and effectiveness. This incident underscores a growing trend where threat actors increasingly abuse trusted cloud platforms to host and disseminate malware, complicating detection and mitigation efforts. The use of obfuscated scripts and legitimate services highlights the evolving sophistication of phishing attacks, emphasizing the need for enhanced vigilance and advanced security measures to detect and prevent such threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Anthropic's AI Models Disabled Amid National Security Concerns
Computer Software/Engineering4 months ago

Anthropic's AI Models Disabled Amid National Security Concerns

In June 2026, the U.S. government ordered Anthropic to suspend foreign access to its advanced AI models, Fable 5 and Mythos 5, citing national security concerns over potential 'jailbreaking' vulnerabilities that could bypass safety restrictions. This directive led Anthropic to disable these models entirely to comply with export controls, affecting both foreign nationals and certain employees. The incident underscores the challenges in balancing AI innovation with security, as similar capabilities exist in other publicly accessible models. The government's stringent response highlights the growing scrutiny over AI technologies and their potential misuse, emphasizing the need for robust security measures and regulatory frameworks in the rapidly evolving AI landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports