The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Pwn2Own Ireland 2026 Exposes 98 Critical Zero-Days Worth $1.2M
The Pwn2Own Ireland 2026 hacking contest concluded with security researchers earning $1,262,000 in rewards after successfully exploiting 98 zero-day vulnerabilities across mobile devices, AI infrastructure, and IoT systems. Over three days, 29 research teams targeted seven categories including Samsung Galaxy S26, Google Pixel 10, OpenAI Codex, Oracle Autonomous AI Database, and various smart home and healthcare devices. Ikotas Labs emerged as the winner with $361,000 in earnings and 42.5 Master of Pwn points, highlighted by their $300,000 chain exploit against the Google Pixel 10. This year's contest demonstrates the accelerating pace of vulnerability discovery in modern technology stacks, particularly in AI-powered systems and mobile platforms that are increasingly integrated into enterprise environments. The 98 zero-days discovered represent a significant increase from previous years, highlighting the expanding attack surface as organizations adopt AI infrastructure and interconnected smart devices.
16 hours ago
Kill Chain
Critical Citrix NetScaler RCE Vulnerability Demands Immediate Action
Citrix issued an urgent security advisory on October 9, 2026, warning administrators to immediately patch CVE-2026-107406, a critical remote code execution vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers or Service Providers. The memory overflow flaw allows attackers to execute arbitrary code or trigger denial-of-service conditions on vulnerable systems. With over 21,000 NetScaler instances exposed on the internet according to Shadowserver data, the attack surface is significant, though Citrix reports no active exploitation at publication time. This vulnerability highlights the continuing trend of critical infrastructure attacks targeting identity and access management systems. Following a pattern of recent NetScaler zero-day exploits used in ransomware campaigns, organizations face increasing pressure to maintain rapid patch cycles for internet-facing authentication infrastructure as threat actors prioritize high-value gateway systems for initial access and lateral movement.
16 hours ago
Kill Chain
Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis
In October 2026, attackers began exploiting CVE-2026-102255, a maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 secure remote access appliances. The flaw affects the Appliance WorkPlace interface on models 6210, 7210, and 8200v, allowing unauthenticated remote attackers to force appliances to issue requests on their behalf and access internal functionality. Security researchers detected exploitation attempts targeting the WorkPlace Extraweb interface using crafted OPTIONS requests to reach internal CouchDB services with default credentials. Over 400 SMA1000 appliances remain exposed online, representing significant risk to enterprise VPN infrastructure used by managed service providers, corporations, and government agencies. This incident follows a pattern of SMA1000 vulnerabilities being actively exploited, with CISA cataloging 19 SonicWall flaws as exploited in the wild over four years, including 13 linked to ransomware operations. The rapid weaponization demonstrates how critical infrastructure components become prime targets for threat actors seeking network access and lateral movement opportunities.
16 hours ago
Kill Chain
GhostAction Campaign: How Compromised GitHub Maintainers Exposed Thousands of Repositories
The GhostAction campaign, active since September 2025, has escalated dramatically in October 2026 with attackers compromising high-profile GitHub maintainer accounts including Takashi Kitao (pyxel game engine) and Henry Wu (Uber's athenadriver author). Using stolen personal access tokens, threat actors injected malicious GitHub Actions workflows disguised as security audits into over 500 repositories across tens of thousands of projects. These workflows systematically exfiltrate CI/CD secrets, cloud credentials, AI API keys, and historical git data to attacker-controlled infrastructure via unencrypted HTTP connections, representing one of the largest supply chain attacks targeting developer infrastructure. This incident highlights the critical vulnerability of modern software supply chains as organizations increasingly rely on automated CI/CD pipelines and cloud-native development practices. The attack's sophisticated targeting of maintainer accounts and abuse of trusted automation workflows demonstrates how threat actors are evolving to exploit the interconnected nature of open-source ecosystems.
17 hours ago
Kill Chain
AgentCorruption: How One AI Prompt Nearly Broke AWS Security
In December 2025, Zenity Labs discovered 'AgentCorruption,' a critical vulnerability in AWS Bedrock AgentCore that allowed attackers to compromise entire AWS environments through a single malicious prompt to AI agents. The flaw exploited AWS Instance Metadata Services (IMDS) access within Firecracker MicroVMs, enabling lateral movement across all AgentCore resources in affected regions. Attackers could obtain temporary credentials, invoke additional agents, access secrets from AWS Secrets Manager, and poison agent memory through overprivileged default roles and insufficient network isolation. This incident highlights the growing security risks as organizations rapidly deploy AI agents in cloud environments without proper isolation controls. The vulnerability demonstrates how AI and cloud security intersect, creating new attack vectors that traditional security measures may not adequately address.
23 hours ago
Kill Chain
Social Engineering AI Agents: The Evolution of Business Email Compromise
As artificial intelligence agents become increasingly integrated into business operations with elevated system privileges, cybercriminals are developing sophisticated social engineering techniques to manipulate these autonomous systems. Unlike traditional business email compromise (BEC) attacks that target human decision-makers, threat actors are now crafting attacks specifically designed to exploit AI agents' logical processes and decision trees. These attacks leverage prompt injection techniques, context manipulation, and adversarial inputs to trick AI systems into executing unauthorized transactions, data transfers, or administrative actions. The financial and operational impact mirrors traditional BEC schemes but with potentially greater scale and automation capabilities. This emerging threat vector represents a critical evolution in social engineering as organizations rapidly deploy AI agents for financial transactions, supply chain management, and customer service operations without adequate security controls.
23 hours ago
Kill Chain
Critical Citrix NetScaler SAML Vulnerability Exposes Identity Infrastructure to RCE Attacks
Citrix disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS score of 9.5. The flaw affects systems configured as SAML identity providers or service providers, potentially enabling remote code execution or denial-of-service attacks. The vulnerability was discovered by security researchers from JPMorgan Chase and affects multiple NetScaler versions, with patches now available across affected product lines. This incident underscores the ongoing security challenges facing identity infrastructure as organizations increasingly rely on SAML-based authentication systems for cloud and hybrid environments.
23 hours ago
Kill Chain
Three Teams Crack Google Pixel 10 Security at Pwn2Own Ireland 2026
At Pwn2Own Ireland 2026 on October 8, three security research teams successfully demonstrated remote exploits against fully patched Google Pixel 10 devices, earning a combined $562,500 in prizes. Ikotas Labs claimed the top $300,000 prize by chaining multiple vulnerabilities, while Xint and a third team led by Dimitrios Valsamaras also achieved successful remote code execution. The exploits targeted various attack vectors including web browsers and wireless protocols (NFC, Wi-Fi, Bluetooth, baseband), with two of the three exploits utilizing previously known but unpatched vulnerabilities. This incident highlights the persistent vulnerability landscape in mobile devices and the effectiveness of coordinated security research in uncovering critical flaws. The high success rate at Pwn2Own Ireland 2026, with 51 of 63 scheduled attempts succeeding across multiple device categories, underscores the ongoing challenges in securing consumer technology platforms.
23 hours ago
Kill Chain
AhsayCBS Zero-Day Exploitation: When Backup Security Becomes a Cryptojacking Gateway
In October 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes. The attackers chained an authentication bypass flaw with a command injection vulnerability to achieve remote code execution on affected systems. Exploitation began just three days after CVE publication, targeting five organizations initially. Post-compromise activities included reconnaissance, web shell deployment, and installation of AI-assisted PowerShell scripts designed to evade detection by monitoring and terminating Windows Task Manager during mining operations. This incident highlights the accelerating pace of zero-day weaponization and the evolution of cryptojacking campaigns toward more sophisticated evasion techniques, including AI-generated scripts and legitimate process impersonation.
23 hours ago
Kill Chain
AnyPwn Exploit Exposes Critical AnyDesk Linux Vulnerability
In October 2026, security researchers published a working exploit called AnyPwn targeting a critical pre-authentication remote code execution vulnerability in AnyDesk Linux version 8.0.2. The flaw, silently patched in June 2026 with version 8.0.3, allows attackers to gain root access through a heap buffer overflow in the session protocol without requiring user approval. The vulnerability stems from improper 32-bit arithmetic overflow checking when calculating payload buffer sizes, enabling attackers to corrupt adjacent heap objects and execute arbitrary commands via ROP chains. Despite being patched months ago, AnyDesk provided no CVE assignment or security advisory, describing the fix only as a crash bug resolution. This incident highlights the growing risk of silent security patches in remote access tools, particularly as hybrid work environments increase reliance on such software. The publication of working exploit code significantly raises the threat level for unpatched systems.
1 day ago
Kill Chain
MonsterCloud Ransomware Recovery Fraud: When Incident Response Goes Wrong
In September 2024, Zohar Pinhasi, CEO of MonsterCloud, was indicted on federal wire fraud charges for operating a deceptive ransomware recovery scheme from 2018 to 2023. Pinhasi falsely claimed his company possessed proprietary decryption tools to recover ransomware-encrypted data without paying criminals. Instead, he secretly paid ransoms using client funds while charging inflated fees up to twice the actual ransom amount. The scheme affected hundreds of clients across the US and Canada, with MonsterCloud collecting over $19 million in fees while paying approximately $8 million in ransoms. This case highlights the growing sophistication of fraud within the ransomware economy, where bad actors exploit victims' desperation during crisis situations. The incident demonstrates how the lack of transparency and regulation in the ransomware recovery industry creates opportunities for exploitation, making it critical for organizations to verify the legitimacy and methods of incident response providers.
1 day ago
Kill Chain
Critical Cisco Nexus Vulnerabilities Enable Complete Switch Takeover
In October 2026, Cisco disclosed five critical vulnerabilities (CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, and CVE-2026-76465) in its NX-OS data center operating system affecting Nexus 3000 and 9000 Series switches. These flaws stem from validation failures in NX-API, Next Generation OAM (NGOAM), and MPLS OAM features, allowing remote attackers to execute arbitrary code with root privileges or cause denial-of-service conditions. The vulnerabilities require specific features to be enabled but can lead to complete switch compromise when exploited through crafted HTTP requests or malicious network packets. These vulnerabilities highlight the growing attack surface of critical network infrastructure as data centers become increasingly complex and feature-rich. With network switches serving as foundational components of enterprise and cloud environments, successful exploitation could enable lateral movement, traffic interception, and complete network compromise across multi-cloud deployments.
1 day ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports