✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
FROST Attack: A New Threat to User Privacy via SSD Timing
In June 2026, researchers from Graz University of Technology unveiled a novel side-channel attack named FROST (Fingerprinting Remotely using OPFS-based SSD Timing). This attack enables malicious websites to infer users' browsing habits and application usage by exploiting SSD access time variations through JavaScript, without requiring native code execution or user permissions. By leveraging the Origin Private File System (OPFS) API, attackers can create large files that induce measurable SSD latency changes when other applications or websites are accessed, allowing them to identify specific user activities with high accuracy. ([tugraz.elsevierpure.com](https://tugraz.elsevierpure.com/de/publications/frost-fingerprinting-remotely-using-opfs-based-ssd-timing/?utm_source=openai)) The FROST attack underscores the evolving landscape of web-based privacy threats, highlighting the potential for sophisticated side-channel attacks that operate entirely within the browser environment. As web applications become more complex and integrated with local system resources, the need for robust security measures to mitigate such vulnerabilities becomes increasingly critical.
1 month ago
Kill Chain
Hades PyPI Attack: A New Wave of Supply Chain Threats
In June 2026, a sophisticated supply chain attack known as the Hades campaign targeted the Python Package Index (PyPI), compromising 37 malicious wheel artifacts across 19 packages. The attackers utilized Python's .pth files to execute code automatically during interpreter startup, downloading the Bun JavaScript runtime and running an obfuscated JavaScript payload. This payload harvested a wide range of sensitive data, including credentials for GitHub, npm, PyPI, cloud services, and Kubernetes configurations. The stolen data was exfiltrated to public GitHub repositories with descriptions such as "Hades - The End for the Damned." This incident underscores the evolving nature of supply chain attacks, highlighting the need for enhanced security measures in open-source ecosystems. The use of legitimate package features for malicious purposes demonstrates the attackers' increasing sophistication and the critical importance of vigilant package management and code review processes.
1 month ago
Kill Chain
CISA Adds Two Exploited Vulnerabilities to KEV Catalog
On June 8, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-42271 and CVE-2026-50751. CVE-2026-42271 affects BerriAI's LiteLLM versions 1.74.2 through 1.83.6, where certain endpoints allow authenticated users to execute arbitrary commands on the host system. CVE-2026-50751 impacts Check Point's Remote Access VPN and Mobile Access products using the deprecated IKEv1 protocol, enabling unauthenticated attackers to establish VPN sessions without valid credentials. Both vulnerabilities have been actively exploited, posing significant risks to federal enterprises. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-42271?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the critical need for organizations to promptly address known security flaws. As cyber threats evolve, timely remediation of such vulnerabilities is essential to maintain robust security postures and protect sensitive information from unauthorized access.
1 month ago
Kill Chain
Urgent: Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild
In June 2026, Google addressed a high-severity zero-day vulnerability, CVE-2026-11645, in Chrome's V8 JavaScript engine. This out-of-bounds read and write flaw allowed remote attackers to execute arbitrary code within the browser sandbox via crafted HTML pages. Discovered by researcher '303f06e3' in April 2026, the vulnerability was actively exploited in the wild prior to the patch release. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/google-patch-chrome-vulnerability/?utm_source=openai)) The incident underscores the persistent targeting of Chrome's V8 engine by threat actors, highlighting the need for continuous vigilance and prompt patching. Organizations should prioritize updating to Chrome version 149.0.7827.103 or later to mitigate potential risks. ([securityweek.com](https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/?utm_source=openai))
1 month ago
Kill Chain
Breaking AD Through NIS & MFA Infrastructure: A Case Study
In June 2026, a comprehensive internal network penetration test revealed a critical vulnerability arising from the integration of legacy Network Information Service (NIS) with modern Multi-Factor Authentication (MFA) systems. Attackers exploited this intersection to gain unauthorized access, leading to a full domain compromise. The breach underscored the risks associated with blending outdated infrastructure with contemporary security controls, highlighting how such integrations can inadvertently create exploitable pathways. This incident serves as a stark reminder of the importance of thoroughly evaluating trust relationships between legacy and modern systems. As organizations continue to layer new security measures onto existing infrastructures, it's crucial to assess not just individual components but also their interactions to prevent unintended vulnerabilities.
1 month ago
Kill Chain
Microsoft Teams Phishing Attack 2026: IT Support Impersonation
In June 2026, a sophisticated phishing campaign targeted Microsoft Teams users by impersonating IT support personnel. Attackers initiated chats through Teams, claiming to address account issues and requesting victims to approve multi-factor authentication (MFA) prompts. This social engineering tactic led to unauthorized access and potential data breaches. The campaign exploited the trust users place in internal communication tools, highlighting vulnerabilities in collaboration platforms. This incident underscores a growing trend where threat actors shift from traditional email phishing to exploiting trusted collaboration tools like Microsoft Teams. Organizations must enhance security measures and user awareness to mitigate such evolving threats.
1 month ago
Kill Chain
Cisco SD-WAN Zero-Day CVE-2026-20245: A Critical Security Alert
In June 2026, Cisco disclosed CVE-2026-20245, a zero-day vulnerability in its Catalyst SD-WAN Manager, marking the seventh such exploit in their SD-WAN products that year. This flaw allows authenticated attackers with netadmin privileges to execute arbitrary commands as root by uploading a crafted file, potentially leading to unauthorized configuration changes on edge devices. Exploitation requires valid credentials or prior exploitation of vulnerabilities like CVE-2026-20182 or CVE-2026-20127. Cisco has observed limited cases where this vulnerability resulted in configuration changes pushed to edge devices. As of now, no patch or workaround is available, and the company advises upgrading to fixed software released in May 2026 as a protective measure. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/?utm_source=openai)) The recurrence of such vulnerabilities underscores the critical need for organizations to maintain rigorous access controls and promptly apply security updates. The exploitation of multiple zero-days within a short period highlights the evolving threat landscape targeting network infrastructure, emphasizing the importance of proactive vulnerability management and continuous monitoring to safeguard against potential breaches.
1 month ago
Kill Chain
Check Point VPN Zero-Day Exploited by Qilin Ransomware
In early May 2026, Check Point identified a critical authentication bypass vulnerability, CVE-2026-50751, in its Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 protocol. This flaw allows unauthenticated remote attackers to establish VPN connections without valid credentials. Exploitation began on May 7, 2026, affecting a limited number of organizations globally, with at least one incident linked to the Qilin ransomware group. Check Point has released patches and mitigation measures to address this vulnerability. The exploitation of CVE-2026-50751 underscores the risks associated with using outdated protocols like IKEv1. Organizations are urged to update their systems promptly and transition to more secure configurations to prevent unauthorized access and potential ransomware attacks.
1 month ago
Kill Chain
Critical UniFi OS Vulnerabilities Enable Remote Code Execution
In May 2026, Ubiquiti's UniFi OS was found to have three critical vulnerabilities—CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910—each with a CVSS score of 10.0. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges by chaining improper access control, path traversal, and command injection vulnerabilities. The vulnerabilities affect UniFi OS Server versions 5.0.6 and earlier, potentially compromising network management systems, surveillance cameras, and physical access controls. This incident underscores the escalating risks associated with network management systems as prime targets for cyberattacks. Organizations must prioritize timely patching and robust access controls to mitigate such vulnerabilities, especially given the increasing sophistication of threat actors targeting critical infrastructure.
1 month ago
Kill Chain
Shai-Hulud Attack Compromises 19 Science-Focused PyPI Packages
In June 2026, a sophisticated supply-chain attack known as 'Shai-Hulud' compromised 19 science-focused packages on the Python Package Index (PyPI), including popular bioinformatics tools like Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH. The attackers injected malicious code into these packages, which, upon execution, attempted to download and run additional scripts designed to steal a wide array of developer credentials, such as GitHub tokens, cloud service credentials, and SSH keys. This breach underscores the vulnerability of open-source repositories to supply-chain attacks and highlights the critical need for enhanced security measures in software development workflows. The incident is part of a broader trend of increasing supply-chain attacks targeting open-source ecosystems, emphasizing the urgency for developers and organizations to implement robust security practices, including regular audits of dependencies and the use of automated tools to detect malicious code.
1 month ago
Kill Chain
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.
1 month ago
Kill Chain
Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980
In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS was exploited to compromise over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. Attackers injected malicious JavaScript into these sites, presenting visitors with fake Cloudflare verification prompts that, when followed, installed malware on their systems. This vulnerability, with a CVSS score of 9.4, allowed unauthenticated attackers to read arbitrary data from the database, leading to widespread data breaches and malware distribution. ([techtimes.com](https://www.techtimes.com/articles/317134/20260525/ghost-cms-sql-injection-hits-700-sites-harvard-duckduckgo-serve-fake-cloudflare-malware.htm?utm_source=openai)) The exploitation of this vulnerability underscores the critical importance of timely patch management. Despite a patch being available since February 2026, many organizations failed to apply it, resulting in significant security incidents. This case highlights the ongoing risks associated with unpatched software and the necessity for organizations to maintain robust vulnerability management practices. ([techradar.com](https://www.techradar.com/pro/security/ghost-cms-flaw-hijacked-to-target-hundreds-of-websites-with-clickfix-attacks-heres-how-to-stay-safe?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports