✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
SAP's July 2026 Security Updates: Addressing Critical Vulnerabilities in NetWeaver and Commerce Cloud
In July 2026, SAP released security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, Commerce Cloud, and Approuter. The most severe, CVE-2026-44747, is a memory corruption issue in NetWeaver Application Server ABAP, potentially leading to unauthorized data access and system unavailability. CVE-2026-27690, an HTTP request smuggling vulnerability in SAP Approuter, could allow unauthenticated attackers to access user responses and trigger denial-of-service attacks. CVE-2026-44761 in SAP Commerce Cloud involves default credentials that enable attackers to obtain valid access tokens and manipulate data via certain APIs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/?utm_source=openai)) These vulnerabilities underscore the critical need for organizations to promptly apply security patches to prevent potential exploitation. The increasing complexity and integration of enterprise software systems make timely updates essential to maintain system integrity and protect sensitive data.
1 week ago
Kill Chain
Nightmare-Eclipse: A Deep Dive into the 2026 Windows Zero-Day Exploits
Between April and June 2026, a security researcher known as 'Nightmare-Eclipse' publicly disclosed eight zero-day vulnerabilities targeting core Windows components, including Microsoft Defender and BitLocker. These exploits, such as BlueHammer, RedSun, and UnDefend, allowed attackers to escalate privileges to SYSTEM level and disable security features. Microsoft addressed some of these vulnerabilities through patches released in April and June 2026, but others remained unpatched for extended periods, leading to active exploitation in the wild. The disclosures were timed immediately after Patch Tuesday releases, leaving systems vulnerable for weeks. This incident underscores the critical need for organizations to implement robust vulnerability management and rapid patching processes to mitigate the risks associated with zero-day exploits. The rapid disclosure and exploitation of these vulnerabilities highlight the evolving threat landscape and the importance of proactive security measures.
1 week ago
Kill Chain
Emerging Phishing Kits Bypass MFA to Compromise Microsoft 365 Accounts
In July 2026, cybersecurity researchers identified two sophisticated phishing kits, Jalisco and OmegaLord, targeting Microsoft 365 accounts. Jalisco employs device-code phishing by generating real-time OAuth device codes, tricking users into authorizing attacker-controlled devices. OmegaLord masquerades as a PDF reader to harvest login credentials and phone numbers, potentially intercepting MFA codes. Both methods effectively bypass multi-factor authentication, granting attackers unauthorized access to sensitive data stored in services like SharePoint and other SaaS platforms. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/?utm_source=openai)) This incident underscores the evolving nature of phishing attacks, highlighting the need for organizations to reassess and strengthen their authentication mechanisms. The emergence of such advanced phishing kits indicates a trend towards more sophisticated social engineering tactics capable of circumventing traditional security measures.
1 week ago
Kill Chain
Phishing Alert: LastPass and Bitwarden Users Targeted in July 2026
In July 2026, a sophisticated phishing campaign targeted users of LastPass and Bitwarden, two prominent password management services. Attackers sent emails from addresses like 'hello@lastpassnewsletter.com' and 'hello@bitwardennewsletter.com', falsely notifying recipients of updated security policies. These emails directed users to fraudulent websites impersonating DocuSign, prompting them to download malicious files purportedly compatible with both Windows and macOS systems. The domains used, such as 'lastpasscompliance[.]com' and 'bitwardencompliance[.]com', were flagged as malicious by security services. LastPass confirmed that its systems remained uncompromised and that the phishing emails did not originate from its infrastructure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/lastpass-bitwarden-users-targeted-with-fake-security-alerts/?utm_source=openai)) This incident underscores a growing trend of cybercriminals targeting password manager users through sophisticated phishing tactics. The use of legitimate-looking emails and websites to deceive users highlights the need for heightened vigilance and robust security measures. Organizations and individuals must remain alert to such evolving threats to safeguard sensitive information.
1 week ago
Kill Chain
Critical Zero-Day Vulnerability in Progress ShareFile: A Wake-Up Call for Cybersecurity
In July 2026, Progress Software identified a high-severity zero-day vulnerability in its ShareFile Storage Zone Controllers, affecting versions 5.x and 6.x. This path traversal flaw allowed authenticated administrative users to read arbitrary files, write malicious content to directories, and enumerate the server's filesystem layout. Upon discovery, Progress promptly released patched versions 5.12.5 and 6.0.2 to mitigate the issue. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/progress-confirms-sharefile-zero-day-flaw-behind-storage-zone-shutdown/?utm_source=openai)) This incident underscores the critical importance of timely patch management and proactive vulnerability assessments. Organizations are reminded to regularly update their systems and monitor for emerging threats to safeguard sensitive data and maintain operational integrity.
1 week ago
Kill Chain
Windows 11 July 2026 Patch Tuesday: Critical Updates and New Features
On July 14, 2026, Microsoft released cumulative updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These mandatory updates addressed 571 security vulnerabilities, including three zero-day exploits, and introduced new features such as improved Bluetooth reliability, enhanced Widgets experience, and Point-in-Time restore functionality. The updates also included various performance and reliability improvements across system components, including File Explorer, networking, printing, and accessibility. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5101650-and-kb5099414-cumulative-updates-released/amp/?utm_source=openai)) The release of these updates underscores the ongoing need for organizations to prioritize timely patch management. With the increasing complexity and volume of vulnerabilities, staying current with security updates is essential to protect systems against potential exploits and maintain operational integrity.
1 week ago
Kill Chain
Microsoft's KB5099539 Update: A Critical Security Release for Windows 10
On July 14, 2026, Microsoft released the Windows 10 KB5099539 extended security update, addressing 570 vulnerabilities, including two zero-day flaws actively exploited in the wild. This update is part of Microsoft's Extended Security Updates (ESU) program, which was recently extended to provide free security updates until October 12, 2027. The update includes fixes for issues such as OLE Automation compatibility, File Explorer's OneDrive shortcut malfunction, and Recycle Bin confirmation dialog errors. Additionally, it introduces security hardening changes like enforcing TDI transport registration requirements and enhancing Secure Boot certificate management. The release of KB5099539 underscores the critical importance of timely patch management, especially in light of the record-breaking number of vulnerabilities addressed. Organizations must prioritize the deployment of this update to mitigate potential security risks and ensure compliance with industry standards. The extension of the ESU program provides additional time for organizations to transition to newer operating systems while maintaining security posture.
1 week ago
Kill Chain
LabubaRAT: A New Rust-Based RAT Disguised as NVIDIA Software
In July 2026, cybersecurity researchers identified LabubaRAT, a previously undocumented Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to infiltrate Windows systems. The malware establishes a persistent foothold, enabling attackers to profile the host, identify security tools, execute commands, transfer files, capture screenshots, and proxy traffic through the compromised system. LabubaRAT employs multiple communication methods, including HTTPS, WebView2, and DNS tunneling, to maintain access even if one pathway is detected and blocked. The attack initiates with an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit. Instead of hard-coding its command-and-control (C2) information, the malware accepts runtime configurations via command-line arguments, allowing operators to define parameters such as server details and polling intervals. This flexibility enables the reuse of the same binary across different infrastructures and campaigns without modification. Once deployed, LabubaRAT conducts discovery operations to inventory installed web browsers and security products, gathering information on the host's environment to tailor its functionality accordingly. The malware's capabilities include command execution, PowerShell and JavaScript execution, screenshot capture, file upload and download, archive handling, and SOCKS5 proxy support. These features provide attackers with comprehensive control over the infected host, facilitating data exfiltration and further malicious activities. The emergence of LabubaRAT underscores the evolving sophistication of malware designed to evade detection by masquerading as legitimate software. Its use of Rust, a language known for its performance and safety features, highlights a trend among threat actors to adopt modern programming languages to develop more robust and stealthy malware. Organizations must remain vigilant and implement robust security measures to detect and mitigate such threats.
1 week ago
Kill Chain
SonicWall SMA1000 Zero-Day Vulnerabilities: Immediate Action Required
In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a post-authentication code injection vulnerability. These flaws allowed unauthenticated attackers to make unauthorized requests and authenticated administrators to execute arbitrary OS commands, respectively. Both vulnerabilities were actively exploited in zero-day attacks, prompting SonicWall to release urgent security patches. Organizations utilizing affected SMA1000 models were advised to upgrade to the latest firmware versions immediately and to inspect their systems for indicators of compromise. This incident underscores the persistent targeting of remote access solutions by threat actors, highlighting the necessity for continuous monitoring, timely patching, and comprehensive security measures to protect against evolving cyber threats.
1 week ago
Kill Chain
Microsoft's Unprecedented Patch Tuesday: 622 Vulnerabilities Addressed
On July 14, 2026, Microsoft released patches for a record-breaking 622 vulnerabilities across its product suite, including Windows, Office, Azure, Defender, and SQL Server. Notably, two zero-day vulnerabilities were actively exploited: CVE-2026-56155 in Active Directory Federation Services, allowing local privilege escalation to administrator, and CVE-2026-56164 in SharePoint Server, enabling network-based privilege escalation without authentication. Additionally, a BitLocker security feature bypass (CVE-2026-50661) was publicly disclosed prior to the patch release. ([securityweek.com](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/?utm_source=openai)) This unprecedented volume of patches underscores the increasing complexity of Microsoft's ecosystem and the growing sophistication of threat actors. Organizations are urged to prioritize applying these updates promptly to mitigate potential risks associated with these vulnerabilities.
1 week ago
Kill Chain
SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747
In July 2026, SAP released a critical security update addressing CVE-2026-44747, a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. This flaw allows authenticated attackers to exploit memory management errors, potentially leading to unauthorized data access, modification, or system unavailability. The vulnerability affects multiple versions of the SAP NetWeaver AS ABAP kernel, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. Organizations using these versions are urged to apply the provided patches promptly to mitigate the risk of exploitation. The disclosure of CVE-2026-44747 underscores the ongoing challenges in securing enterprise resource planning (ERP) systems. As these platforms are integral to business operations, vulnerabilities within them present significant risks. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to stay vigilant against emerging threats targeting critical business applications.
1 week ago
Kill Chain
Critical Vulnerability in 'Claude for Chrome' Exposes User Data
In July 2026, security researchers identified a critical vulnerability in Anthropic's 'Claude for Chrome' extension, allowing malicious browser extensions to exploit Claude's automation capabilities. This flaw enables unauthorized access to sensitive user data, including Gmail, Google Docs, and Calendar, by triggering tasks without user consent. Despite previous mitigation efforts, the vulnerability persists in version 1.0.80, posing significant security risks to users. The incident underscores the growing threat of prompt injection attacks targeting AI-powered browser extensions. As AI tools become more integrated into daily workflows, ensuring robust security measures and user awareness is paramount to prevent unauthorized data access and maintain user trust.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports