Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
PyTorch Lightning Supply Chain Attack: A Wake-Up Call for Developers
In April 2026, versions 2.6.2 and 2.6.3 of the PyTorch Lightning package were compromised and published on the Python Package Index (PyPI). These versions contained malicious code that, upon import, initiated a background process to download and execute an obfuscated JavaScript payload. This payload targeted sensitive information, including environment files, API keys, GitHub tokens, and credentials stored in browsers such as Chrome, Firefox, and Brave. Additionally, it interacted with cloud service APIs (AWS, Azure, GCP) to exfiltrate credentials and had the capability to execute arbitrary system commands. This incident underscores the escalating threat of supply chain attacks in the software development ecosystem. The compromise of widely-used packages like PyTorch Lightning highlights the need for enhanced vigilance and robust security measures in managing software dependencies to prevent unauthorized access and data breaches.
4 months ago
Kill Chain
Weaver E-cology CVE-2026-22679 Exploitation: A Critical Security Alert
In mid-March 2026, attackers began exploiting CVE-2026-22679, a critical unauthenticated remote code execution vulnerability in Weaver E-cology 10.0, an enterprise office automation platform. The flaw resides in an exposed debug API endpoint that allows user-supplied parameters to reach backend Remote Procedure Call (RPC) functionality without authentication or input validation. This enables attackers to execute arbitrary system commands on the server. The attacks commenced five days after the vendor released a security update on March 12, 2026, and two weeks before the vulnerability was publicly disclosed. The exploitation involved multiple phases, including initial reconnaissance through ping commands, attempts to deploy PowerShell-based payloads, and the use of obfuscated, fileless PowerShell scripts to fetch remote scripts. Despite these efforts, the attackers did not establish a persistent session on the targeted hosts.
4 months ago
Kill Chain
Rising Threat: Amazon SES Phishing Abuse in 2026
In May 2026, cybersecurity researchers identified a significant increase in phishing campaigns exploiting Amazon Simple Email Service (SES). Attackers leveraged exposed AWS Identity and Access Management (IAM) access keys, often found in public GitHub repositories, .ENV files, Docker images, and publicly accessible S3 buckets, to send convincing phishing emails that bypass standard security filters. These emails, appearing to originate from trusted sources, included fake document-signing notifications and sophisticated business email compromise (BEC) attacks, leading to unauthorized access and financial losses. This trend underscores the critical need for organizations to implement stringent security measures, such as enforcing least-privilege IAM policies, enabling multi-factor authentication, regularly rotating access keys, and applying IP-based access restrictions. The rise in such attacks highlights the evolving tactics of cybercriminals and the importance of proactive defense strategies to protect sensitive information and maintain trust.
4 months ago
Kill Chain
Exploitation of Amazon SES in Phishing and BEC Attacks: A 2026 Analysis
In early 2026, cybercriminals exploited Amazon Simple Email Service (SES) to conduct sophisticated phishing and Business Email Compromise (BEC) attacks. By leveraging exposed AWS Identity and Access Management (IAM) access keys, attackers sent large volumes of phishing emails that passed standard authentication checks, such as SPF, DKIM, and DMARC. These emails often impersonated trusted services like DocuSign, leading recipients to malicious sites designed to harvest sensitive information. The abuse of Amazon's legitimate infrastructure allowed these phishing campaigns to evade traditional email security measures, resulting in significant data breaches and financial losses for targeted organizations. This incident underscores a growing trend where attackers exploit trusted cloud services to enhance the credibility and effectiveness of their phishing campaigns. The increasing sophistication of such attacks highlights the urgent need for organizations to implement robust security measures, including strict IAM policies, regular key rotation, and comprehensive employee training to recognize and respond to phishing attempts.
4 months ago
Kill Chain
Kaikatsu Club Data Breach 2025: A Wake-Up Call for Cybersecurity in the AI Era
In January 2025, Kaikatsu Club, Japan's largest internet café chain, suffered a significant data breach when a 17-year-old high school student from Osaka exploited vulnerabilities in the company's application server. Utilizing a self-developed program, the attacker illicitly accessed and extracted approximately 7.25 million customer records, including personal information. The breach led to the temporary suspension of certain application functions, disrupting business operations. The individual was arrested in December 2025 under Japan's Unauthorized Access Prohibition Act. This incident underscores the growing accessibility of sophisticated cyberattack tools, even to individuals with limited resources, highlighting the urgent need for robust cybersecurity measures and continuous monitoring to protect sensitive customer data.
4 months ago
Kill Chain
Telegram Mini Apps Exploited for Crypto Scams and Malware Distribution
In May 2026, cybersecurity researchers uncovered a large-scale fraud operation exploiting Telegram's Mini App feature to conduct cryptocurrency scams, impersonate reputable brands, and distribute Android malware. Dubbed FEMITBOT, the platform utilizes Telegram bots and embedded Mini Apps to create convincing, app-like experiences within the messaging platform. Threat actors impersonated brands such as Apple, Coca-Cola, and NVIDIA, using a shared backend infrastructure to display phishing sites directly within Telegram. Victims were lured into fake dashboards showing fictitious earnings, prompting them to deposit funds or download malicious Android APKs disguised as legitimate applications. This operation highlights the evolving tactics of cybercriminals leveraging trusted platforms to deceive users and distribute malware. The incident underscores the urgent need for heightened vigilance against social engineering attacks and the importance of verifying the authenticity of applications and investment opportunities. As cybercriminals continue to exploit popular platforms for malicious purposes, users must exercise caution and adhere to best practices to safeguard their digital assets and personal information.
4 months ago
Kill Chain
Microsoft Defender's False Positive on DigiCert Certificates - 2026
In late April 2026, Microsoft Defender's signature update erroneously identified legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, leading to widespread false-positive alerts and the removal of these certificates from Windows trust stores. This misclassification disrupted SSL/TLS validation and code-signing operations across numerous systems. Microsoft addressed the issue by releasing Security Intelligence update version 1.449.430.0, which corrected the false positives and restored the removed certificates. This incident underscores the critical importance of accurate threat detection mechanisms and the potential operational disruptions caused by false positives. It also highlights the necessity for organizations to have robust incident response plans to swiftly address and mitigate such issues.
4 months ago
Kill Chain
Instructure Data Breach: ShinyHunters Compromise 275 Million Records in 2026
In May 2026, Instructure, a leading educational technology company known for its Canvas learning management system, confirmed a significant data breach. The cyber extortion group ShinyHunters claimed responsibility, alleging the theft of data from nearly 9,000 schools worldwide, affecting approximately 275 million individuals. The compromised information includes names, email addresses, student ID numbers, and private messages exchanged between users. Instructure has stated that, to date, there is no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The company has implemented patches, increased monitoring, and rotated application keys as precautionary measures. This incident underscores the escalating threat posed by cyber extortion groups targeting educational institutions. The breach highlights the critical need for robust cybersecurity measures and proactive incident response strategies within the education sector to protect sensitive personal information and maintain trust.
4 months ago
Kill Chain
Critical cPanel Vulnerability CVE-2026-41940 Exploited by 'Sorry' Ransomware
In late April 2026, a critical authentication bypass vulnerability, CVE-2026-41940, was discovered in cPanel and WHM software, affecting versions released after 11.40. This flaw allows unauthenticated attackers to gain root-level access to servers, leading to potential data theft, malware deployment, or complete server compromise. Exploitation of this vulnerability has been observed in the wild, with attackers deploying the 'Sorry' ransomware to encrypt data on compromised servers. The ransomware appends the '.sorry' extension to encrypted files and demands ransom payments via Tox messaging platform. Given the widespread use of cPanel and WHM across millions of websites, the impact is substantial, with thousands of servers reportedly compromised. Administrators are urged to apply the latest security patches immediately to mitigate this threat. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) This incident underscores the critical importance of timely patch management and robust security practices in web hosting environments. The rapid exploitation of CVE-2026-41940 highlights the evolving tactics of threat actors targeting widely used infrastructure components, emphasizing the need for continuous vigilance and proactive defense measures.
4 months ago
Kill Chain
Trellix Confirms Source Code Breach in 2026
In May 2026, cybersecurity firm Trellix disclosed unauthorized access to a portion of its source code repository. Upon detection, Trellix collaborated with forensic experts and notified law enforcement. The company stated there is no evidence that the source code release or distribution process was affected or that the code was exploited. The exact data accessed and the duration of unauthorized access remain undisclosed. This incident underscores the persistent threat to software supply chains, highlighting the need for robust security measures to protect sensitive code repositories. Organizations are urged to enhance monitoring and access controls to mitigate similar risks.
4 months ago
Kill Chain
MacSync Stealer: Malicious Ads Target macOS Users
In late April 2026, a malicious advertising campaign targeted macOS users by impersonating the legitimate Homebrew package manager. Users searching for Homebrew were presented with deceptive ads leading to a counterfeit website that instructed them to execute a terminal command. This command initiated the download and installation of the MacSync Stealer malware, which exfiltrated sensitive data including browser credentials, system keychains, and cryptocurrency wallets. The campaign exploited users' trust in Homebrew and their familiarity with terminal-based installations, resulting in significant data breaches. This incident underscores a growing trend of sophisticated social engineering attacks targeting macOS platforms. The use of malicious ads and fake websites to distribute malware highlights the need for heightened vigilance among users and organizations. As macOS devices become more prevalent in both personal and professional settings, attackers are increasingly focusing on this ecosystem, necessitating robust security measures and user education to mitigate such threats.
4 months ago
Kill Chain
Critical cPanel & WHM Authentication Bypass Vulnerability (CVE-2026-41940) Discovered
In April 2026, a critical authentication bypass vulnerability, CVE-2026-41940, was discovered in cPanel & WHM, affecting versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5. This flaw allows remote, unauthenticated attackers to gain root-level administrative access by injecting arbitrary values into server-side session files, effectively bypassing all credential checks. Exploitation in the wild has been confirmed, with attackers leveraging this vulnerability to compromise entire systems, leading to data theft, malware deployment, or complete server erasure. cPanel has released patches to address this issue, and administrators are urged to update immediately to secure their systems. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) The emergence of this vulnerability underscores the critical importance of timely software updates and robust security practices. With the availability of public proof-of-concept exploits and active exploitation observed, organizations must prioritize patching and monitoring to mitigate the risk of unauthorized access and potential system compromise.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports