✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Microsoft's July 2026 Patch Tuesday: A Record 570 Security Flaws Fixed
In July 2026, Microsoft released a record-breaking Patch Tuesday update, addressing 570 security vulnerabilities across its software products. This unprecedented volume, nearly triple the previous month's count, includes 59 critical flaws and three zero-day vulnerabilities actively exploited in the wild. Notably, CVE-2026-56155 affects Active Directory Federation Services, and CVE-2026-56164 impacts Microsoft SharePoint, both allowing privilege escalation. Additionally, CVE-2026-50661 is a BitLocker bypass that could grant attackers access to encrypted data if they have physical device access. Microsoft attributes this surge in identified vulnerabilities to advancements in artificial intelligence, which have accelerated the discovery and analysis of security flaws. This significant increase underscores the evolving cybersecurity landscape, where AI not only aids defenders in identifying vulnerabilities but also empowers attackers to develop exploits more rapidly. Organizations must prioritize timely patch management and adopt proactive security measures to mitigate the risks associated with these newly disclosed vulnerabilities.
1 hour ago
Kill Chain
Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts
In July 2026, a critical vulnerability named 'PromptFiction' was discovered in Anthropic's Claude Desktop application. This flaw allowed attackers to automatically submit malicious prompts to the AI assistant without any user interaction, leveraging a custom URI scheme ('claude://') to execute commands upon clicking a crafted link. Exploiting this, attackers could exfiltrate sensitive user data and potentially execute remote code on the victim's machine. The vulnerability was promptly patched in Claude Desktop version 1.1.2321. This incident underscores the evolving nature of prompt injection attacks, highlighting the need for robust security measures in AI applications to prevent unauthorized access and data breaches.
2 hours ago
Kill Chain
Urgent: SonicWall SMA1000 Zero-Day Vulnerabilities Under Active Exploitation
In July 2026, SonicWall disclosed two critical zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances: CVE-2026-15409 and CVE-2026-15410. CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability allowing unauthenticated attackers to make the appliance send requests to unintended locations. CVE-2026-15410 is a code injection flaw enabling authenticated administrators to execute arbitrary operating system commands. Both vulnerabilities have been actively exploited in the wild, potentially leading to unauthorized access and control over affected systems. SonicWall has released patches to address these issues and urges immediate updates to mitigate risks. ([sonicwall.com](https://www.sonicwall.com/ja-jp/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ?utm_source=openai)) The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to gain initial footholds into organizational networks. This incident highlights the critical importance of promptly applying security patches and maintaining vigilant monitoring of network appliances to prevent unauthorized access and potential data breaches.
2 hours ago
Kill Chain
Critical Cursor Vulnerability Exposes Windows Systems to Malicious Code Execution
In July 2026, a critical vulnerability was discovered in the Cursor development environment, allowing malicious actors to execute arbitrary code on Windows systems. By placing a malicious file named 'git.exe' in the root of a Git repository, attackers could achieve code execution when the repository was opened in Cursor, without any user prompt or warning. This flaw granted attackers access to developers' credentials, including SSH keys and cloud tokens, posing significant security risks. Despite being reported in December 2025, the vulnerability remained unpatched as of July 2026, leaving many systems exposed. This incident underscores the growing threat of supply chain attacks targeting development tools and environments. As developers increasingly rely on third-party repositories and AI-assisted coding tools, the potential for such vulnerabilities to be exploited has risen, emphasizing the need for vigilant security practices and prompt patching of identified flaws.
2 hours ago
Kill Chain
Security Researcher Releases 'LegacyHive' Windows Zero-Day Exploit Post Patch Tuesday
On July 15, 2026, security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released a proof-of-concept (PoC) exploit named 'LegacyHive.' This exploit targets a vulnerability in the Windows User Profile Service (ProfSvc), allowing an authenticated attacker to load registry hives associated with other user accounts, potentially leading to privilege escalation. The PoC requires another standard user credential and a third username, which can be an administrator account. If successful, it mounts the target user hive in the current user's classes root. Notably, this vulnerability affects all supported desktop and server versions of Windows, including those running the latest July 2026 Patch Tuesday update. The release of 'LegacyHive' underscores the ongoing tensions between independent security researchers and major software vendors regarding vulnerability disclosure practices. This incident highlights the critical need for organizations to implement robust privilege escalation defenses and to stay vigilant about applying security updates promptly to mitigate potential exploitation risks.
2 hours ago
Kill Chain
CISA Adds Four Known Exploited Vulnerabilities to Catalog
On July 14, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. The vulnerabilities include CVE-2026-15409 and CVE-2026-15410 affecting SonicWall SMA1000 Appliances, CVE-2026-56155 impacting Microsoft Active Directory Federation Services, and CVE-2026-56164 related to Microsoft SharePoint Server. These vulnerabilities are commonly exploited by malicious actors and pose significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 emphasizes the importance of promptly addressing such high-risk vulnerabilities to protect federal networks. While BOD 26-04 is mandatory for Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of vulnerabilities listed in the KEV Catalog. This proactive approach is crucial in mitigating potential threats and enhancing overall cybersecurity resilience.
3 hours ago
Kill Chain
Critical Security Updates Released for Major Software Products
In July 2026, Mozilla, Google, Adobe, and VMware released critical security updates addressing multiple vulnerabilities across their products. Mozilla's Firefox 152.0.6 patched two critical flaws (CVE-2026-15718 and CVE-2026-15719) with public exploit code available, though no active exploitation was reported. Google's Chrome 150.0.7871.124/.125 addressed 15 security flaws, including two critical use-after-free vulnerabilities (CVE-2026-15764 and CVE-2026-15765) in the Ozone component. Adobe released updates for 88 vulnerabilities, including critical issues in ColdFusion, Commerce, Experience Manager, and Illustrator. VMware also issued patches for multiple critical vulnerabilities in its products. These updates highlight the ongoing need for organizations to promptly apply security patches to mitigate risks associated with publicly disclosed vulnerabilities. The presence of exploit code increases the urgency for immediate action to prevent potential exploitation.
3 hours ago
Kill Chain
ServiceNow's June 2026 Data Exposure: A Wake-Up Call for Cloud Security
In early June 2026, ServiceNow identified a security vulnerability within its REST API that permitted unauthenticated users to access customer instance data. The flaw, present in the ‘Australia’ platform release and certain earlier versions with specific configurations, allowed unauthorized queries to sensitive data, including IT support tickets and employee records. ServiceNow applied a security update on June 5, 2026, to rectify the issue and notified affected customers directly. The incident underscores the critical importance of robust access controls and timely vulnerability management in cloud-based platforms. This event highlights the ongoing challenges in securing API endpoints against unauthorized access. As enterprises increasingly rely on cloud services for core operations, ensuring the integrity and confidentiality of data through stringent security measures becomes paramount. Organizations must remain vigilant, regularly audit their systems, and promptly address identified vulnerabilities to mitigate potential risks.
3 hours ago
Kill Chain
ADPathFinder: Comprehensive Attack Path Mapping for Enhanced Security Assessments
ADPathFinder is a cybersecurity tool designed to enhance internal assessments by mapping privilege escalation paths across Active Directory (AD), Active Directory Certificate Services (ADCS), Microsoft SQL Server (MSSQL), and System Center Configuration Manager (SCCM) environments. By integrating data from SharpHound with OpenGraph collectors like MSSQLHound and ConfigManBearPig, ADPathFinder provides a unified view of attack paths, enabling security professionals to identify and address vulnerabilities more efficiently. Additionally, it offers password auditing capabilities, tying cracked NTDS/hashcat results back to group memberships and account risks, thereby providing a comprehensive security analysis. As organizations increasingly rely on complex and interconnected systems, tools like ADPathFinder become essential in proactively identifying and mitigating potential security threats. Its ability to consolidate data from multiple sources and present a cohesive analysis allows for more effective prioritization of remediation efforts, ensuring that critical vulnerabilities are addressed promptly.
3 hours ago
Kill Chain
Microsoft's July 2026 Patch Tuesday: A Record-Breaking 622 Vulnerabilities Addressed
In July 2026, Microsoft released its largest Patch Tuesday update to date, addressing 622 vulnerabilities across its product suite. This unprecedented volume includes two zero-day vulnerabilities: CVE-2026-56155, a privilege escalation flaw in Active Directory Federation Services, and CVE-2026-56164, a similar flaw in Microsoft SharePoint Server. Both vulnerabilities were actively exploited in the wild, posing significant security risks to organizations. The surge in identified vulnerabilities is attributed to Microsoft's deployment of its multi-model agentic scanning harness (MDASH), an AI-driven tool designed to accelerate the discovery and remediation of software defects. This development underscores the growing role of artificial intelligence in cybersecurity, enabling faster identification and patching of vulnerabilities but also highlighting the increasing complexity and volume of potential security issues that organizations must manage.
4 hours ago
Kill Chain
U.S. Treasury Sanctions 1VPNS for Facilitating Ransomware Attacks
In July 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS) and its administrator, Ukrainian national Dmytro Rashevskyi, for providing services to ransomware operators. 1VPNS, operational since 2014, advertised its refusal to cooperate with law enforcement and offered anonymity services that were exploited by cybercriminals to conceal attack origins, deploy malware, and manage exfiltrated data. Victims included U.S. businesses, financial services companies, hospitals, and municipal governments. Additionally, Belarusian national Yegeniy Vladimirovich Silayev was sanctioned for selling 'cryptors'—tools designed to disguise ransomware and other malware as harmless files—to ransomware operators. These actions underscore the critical role that infrastructure providers play in facilitating cybercriminal activities and the necessity of targeting such enablers to disrupt the ransomware ecosystem. The sanctions highlight the ongoing efforts by international law enforcement to dismantle networks that support ransomware operations, emphasizing the importance of vigilance and proactive measures in cybersecurity.
4 hours ago
Kill Chain
US Sanctions 1VPNS and Affiliates for Enabling Ransomware Attacks
In July 2026, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for facilitating ransomware attacks against U.S. organizations. 1VPNS provided anonymizing services to cybercriminals, while Silayev sold cryptors that helped malware evade detection. These services enabled ransomware groups to conduct attacks resulting in billions of dollars in losses to U.S. businesses and critical infrastructure. The sanctions followed a May 2026 law enforcement operation that dismantled 1VPNS's infrastructure and arrested Rashevskyi. This incident underscores the critical role that service providers play in the cybercriminal ecosystem. By targeting these enablers, authorities aim to disrupt the infrastructure supporting ransomware operations. Organizations should be aware of the evolving threat landscape and the importance of securing their networks against such indirect threats.
19 hours ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports