Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2541 threat reports
Page 9 of 212
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 97–108 / 2541 reports
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Computer Software/Engineering3 weeks ago

Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks

NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026, to address five critical vulnerabilities affecting installations since May 2005. The flaws include three memory corruption bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that could enable remote code execution, a TLS session forgery vulnerability (CVE-2026-97629) that bypasses client certificate verification, and an HTTP/3 request smuggling issue (CVE-2026-95101). Each vulnerability requires specific configuration directives to exploit, including commonly recommended settings like shared TLS session cache and HTTP/3 support. F5 rates three memory bugs as Critical (9.2 CVSS v4.0), while NGINX considers all five medium severity. This incident highlights ongoing challenges with web infrastructure security, particularly as organizations increasingly rely on reverse proxies and load balancers for cloud-native architectures. The timing coincides with heightened scrutiny of supply chain vulnerabilities and the need for rapid patching cycles in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Help TDS Exploits 20,000+ Cloudflare Pages for Massive Tech Support Scam Campaign
Help TDS Exploits 20,000+ Cloudflare Pages for Massive Tech Support Scam Campaign
Internet3 weeks ago

Help TDS Exploits 20,000+ Cloudflare Pages for Massive Tech Support Scam Campaign

Help TDS, a long-running Traffic Distribution System active since 2017, has been linked to the Russian-language affiliate program Hotejka, suspected to be a rebrand of ROI777. The operation compromises websites to redirect users to tech support scams using browser manipulation techniques and fake Microsoft security alerts. Since April 2026, attackers have leveraged over 20,000 Cloudflare Pages domains, creating approximately 300 disposable pages daily to evade detection while directing victims to call centers where social engineers convince them to install remote access tools. This incident highlights the evolving threat landscape where traditional scams are becoming more sophisticated, leveraging legitimate cloud infrastructure and automated traffic distribution systems. The operation's eight-year persistence and estimated multi-million dollar revenue demonstrate how cybercriminals are professionalizing affiliate-based fraud models, making detection and prevention increasingly challenging for organizations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
Information Technology/IT3 weeks ago

Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps

The Panchan cryptomining worm, first identified in 2022, continues to propagate across internet-facing systems through SSH brute force attacks and stolen SSH keys. Written in Golang as a peer-to-peer botnet, Panchan employs a rootkit for persistence and leverages Discord channels for command-and-control communications. The worm creates hidden directories with high-entropy names, demonstrates unusual resource consumption, and spreads by stealing SSH credentials from infected systems to pivot to additional hosts listed in known_hosts files. Despite its rudimentary design and detection by multiple security vendors, Panchan remains effective against unpatched and poorly secured systems. This incident highlights the persistent threat of legacy malware families that continue to exploit fundamental security weaknesses in SSH configurations and access controls, demonstrating how basic security gaps enable widespread compromise campaigns.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
Marketing/Advertising/Sales3 weeks ago

AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government

In 2024, researchers at The Citizen Lab uncovered AdFection, the first documented zero-click mercenary spyware campaign delivered through targeted online advertising. The Israeli company Discover-Tech, operating as a legitimate advertising firm, facilitated infections by directing millions of devices to contact Candiru spyware servers through malicious ads displayed across 120,000 websites and 70,000 mobile apps. At least 45 devices at Al Jazeera were successfully compromised, with the spyware capable of remote device takeover, data theft, and surveillance through microphones and cameras. The campaign exposed critical vulnerabilities in the digital advertising ecosystem, prompting Google and IAB Europe to remove Discover-Tech from their vendor registries. This incident highlights the growing sophistication of surveillance-for-hire operations exploiting legitimate advertising infrastructure to conduct mass surveillance operations against media organizations, government agencies, and civil society targets worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
Financial Services3 weeks ago

OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation

In April 2024, authorities in North Macedonia dismantled the OLVX cybercrime marketplace and arrested its alleged 20-year-old administrator, identified as 'E.A.' The platform, operational since 2023, generated over $500,000 in sales by offering stolen credentials, personal data, malicious tools, and child sexual abuse material to more than 2,600 registered customers. The FBI provided intelligence support for this joint international operation, marking the first cyber collaboration between the FBI and North Macedonia. Evidence revealed the suspect sold over 1,500 sets of stolen credentials and operated associated Telegram channels facilitating various cybercrime activities including fraudulent refund schemes. This takedown reflects the growing international cooperation needed to combat cybercrime-as-a-service platforms that democratize access to stolen data and attack tools. As these marketplaces continue proliferating and lowering barriers to cybercrime entry, coordinated law enforcement efforts become increasingly critical for disrupting the underground economy fueling data breaches and identity theft.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
Information Technology/IT3 weeks ago

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. The operation disrupted a sophisticated supply chain infiltration where DPRK operatives used stolen identities, laptop farms, and remote access tools to secure employment at U.S. companies while generating revenue for the sanctioned regime. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. This incident highlights the evolving threat of state-sponsored actors infiltrating corporate supply chains through identity fraud and remote work infrastructure, representing a critical escalation in North Korea's cyber operations targeting Western technology companies and their sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Anthropic Research Reveals AI Models Approaching Worm-Like Self-Replication Capabilities
Anthropic Research Reveals AI Models Approaching Worm-Like Self-Replication Capabilities
Consumer Electronics3 weeks ago

Anthropic Research Reveals AI Models Approaching Worm-Like Self-Replication Capabilities

In October 2026, Anthropic researchers William Zhou and Daniel Freeman published groundbreaking research demonstrating that AI models are approaching the capability to self-replicate across Internet of Things (IoT) networks like autonomous worms. Their study successfully distributed Google's Gemma4-26B model across 15 inexpensive Android TV boxes and showed that advanced AI models like GLM-5.2 can autonomously complete the four-step process of identifying targets, gaining access, establishing inference on new devices, and continuing propagation. While current implementations require ideal conditions with trivial security barriers, the research indicates that smaller models may achieve similar capabilities within months, creating unprecedented challenges for network defenders. This research emerges as organizations rapidly deploy AI agents and autonomous systems across enterprise networks, often without adequate security controls. The potential for self-replicating AI threats represents a paradigm shift from traditional malware, as these systems could adapt to unfamiliar environments and operate without centralized command infrastructure, making them exceptionally difficult to contain or eliminate.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
OpenAI Insider Threat: Employee Arrested for Planting Recording Device in Executive Conference Room
OpenAI Insider Threat: Employee Arrested for Planting Recording Device in Executive Conference Room
Computer Software/Engineering3 weeks ago

OpenAI Insider Threat: Employee Arrested for Planting Recording Device in Executive Conference Room

In October 2026, Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineering lead, was arrested by the FBI for allegedly planting a sophisticated recording device in an executive conference room at OpenAI's San Francisco offices. The device, concealed in toilet paper and inserted into a USB port behind a television, was designed to capture sensitive discussions about super intelligence technology, proprietary research, and strategic business decisions. CCTV footage revealed Alfozan accessed the restricted area multiple times without authorization, while his spouse's chatbot account submitted prompts about building audio recorders and encryption methods. This incident highlights the growing threat of insider attacks targeting AI companies as they develop increasingly valuable and sensitive artificial intelligence technologies. With nation-states and competitors seeking access to proprietary AI models and research, insider threats represent a critical risk to organizations developing super intelligence capabilities and other advanced AI systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
AI Discovers Decade-Old Linux Kernel Flaw Enabling Root Privilege Escalation and VM Escape
AI Discovers Decade-Old Linux Kernel Flaw Enabling Root Privilege Escalation and VM Escape
Information Technology/IT3 weeks ago

AI Discovers Decade-Old Linux Kernel Flaw Enabling Root Privilege Escalation and VM Escape

CVE-2026-74580, dubbed 'Vghost,' is a critical Linux kernel vulnerability in the vhost subsystem that allows local users to escalate privileges to root across nearly a decade of kernel versions (4.11 to 7.2-rc4). Discovered by Tencent Zhuque Lab using AI-assisted research through their Corvus AI system, the flaw enables reliable kernel memory read/write access and can allow untrusted virtual machines to escape to the host system in specific virtualization configurations. The vulnerability affects major Linux distributions including Ubuntu, RHEL, Amazon Linux, Microsoft Azure Linux, and Oracle Linux, with patches released in August 2026. This incident highlights the growing sophistication of AI-powered vulnerability research and the persistent challenge of securing foundational infrastructure components. As threat actors increasingly leverage automation and AI for exploit development, the discovery of decade-old flaws in critical subsystems underscores the need for proactive security measures in virtualized environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Revolutionizes Cyber Attacks: Chrome Zero-Day Chain Built in 6 Days
AI Revolutionizes Cyber Attacks: Chrome Zero-Day Chain Built in 6 Days
Computer Software/Engineering3 weeks ago

AI Revolutionizes Cyber Attacks: Chrome Zero-Day Chain Built in 6 Days

In August 2026, security firm XBOW demonstrated a critical advancement in AI-assisted vulnerability research by using OpenAI's GPT-5.6 Sol model to develop a full-chain Chrome exploit in just six days. The team chained three zero-day vulnerabilities (CVE-2026-85045, CVE-2026-78952, and an animated WebP decoder bug) to achieve remote code execution on Windows systems through Chrome's nested sandbox protections. Google confirmed all vulnerabilities, implemented fixes in Chrome versions 152.0.7977.65 and 152.0.7977.82, and awarded XBOW the maximum $250,000 bounty reward. The exploit required only loading a malicious webpage, affecting an estimated 1 billion Chrome users on Windows before patching. This incident highlights the rapidly evolving threat landscape where AI-powered vulnerability research dramatically reduces the time and resources needed to develop sophisticated exploits from months to days, fundamentally lowering the barrier for advanced cyber attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Critical Privilege Escalation Flaw Discovered in Inductive Automation Ignition SCADA Software
Critical Privilege Escalation Flaw Discovered in Inductive Automation Ignition SCADA Software
Industrial Automation3 weeks ago

Critical Privilege Escalation Flaw Discovered in Inductive Automation Ignition SCADA Software

A critical privilege escalation vulnerability (CVE-2026-92817) was discovered in Inductive Automation's Ignition software, affecting versions 8.1.0-8.1.54 and 8.3.0-8.3.8. The flaw allows authenticated low-level users to exploit improper session validation in the Perspective module to gain Designer-level privileges and execute arbitrary code within the Ignition Gateway process. This vulnerability impacts critical infrastructure sectors including manufacturing and energy systems worldwide, with CVSS scores of 8.8 (v3.1) and 8.7 (v4.0). This incident highlights the growing threat to industrial control systems and the urgent need for robust privilege validation in SCADA environments. As critical infrastructure becomes increasingly connected, vulnerabilities like this demonstrate the potential for devastating operational disruptions and the importance of implementing zero trust architectures in OT environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
Computer Software/Engineering3 weeks ago

curl's Critical HTTP/2 Vulnerability: When Clients Become Targets

A critical use-after-free vulnerability (CVE-2026-92392) in curl versions 8.12.0 through 8.22.0 allows malicious servers to corrupt client memory during HTTP/2 file uploads, potentially leading to remote code execution. The flaw occurs when a malicious server stalls an upload, resets the stream while keeping the connection open, causing curl to mishandle memory references during retry operations. While exploitation requires precise knowledge of the client's build and memory layout, making successful attacks unlikely, the vulnerability affects both the curl command-line tool and libcurl library used by numerous applications. The curl project expedited their release cycle to ship version 8.23.0 with a fix on October 14, 2026. This vulnerability represents a significant escalation in client-side attack vectors, demonstrating how AI-powered vulnerability research is uncovering complex memory corruption flaws in widely-deployed networking libraries. With HTTP/2 becoming the default protocol for most applications, such vulnerabilities pose substantial risks to enterprise software supply chains and require immediate attention from security teams.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports