✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
GitHub's 2026 Security Breach: A Supply Chain Attack via Malicious Nx Console Extension
In May 2026, GitHub experienced a significant security breach when an employee inadvertently installed a malicious version of the Nx Console Visual Studio Code extension. This compromised extension, linked to the TanStack npm supply-chain attack orchestrated by the TeamPCP threat group, granted unauthorized access to approximately 3,800 internal repositories. The attackers exfiltrated internal source code and sensitive operational data, subsequently offering the stolen data for sale at a minimum of $50,000. GitHub promptly responded by securing the compromised device, rotating critical secrets, and initiating a comprehensive investigation to assess the full impact of the breach. This incident underscores the escalating threat posed by sophisticated supply chain attacks targeting trusted development tools and platforms. The exploitation of widely used extensions like Nx Console highlights the necessity for heightened vigilance and robust security measures within the software development ecosystem to prevent similar breaches in the future.
2 months ago
Kill Chain
Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE-2026-45498
In May 2026, Microsoft disclosed two zero-day vulnerabilities in its Defender security platform: CVE-2026-41091 and CVE-2026-45498. CVE-2026-41091 is a privilege escalation flaw in the Microsoft Malware Protection Engine, allowing attackers to gain SYSTEM privileges through improper link resolution. CVE-2026-45498 is a denial-of-service vulnerability in the Microsoft Defender Antimalware Platform, enabling threat actors to disrupt Windows devices. Both vulnerabilities were actively exploited before patches were released. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to apply patches by June 3, 2026. This incident underscores the critical need for organizations to maintain up-to-date security measures and promptly address vulnerabilities in widely used security tools.
2 months ago
Kill Chain
Critical Vulnerability in Cisco Secure Workload: CVE-2026-20223
In May 2026, Cisco disclosed a critical vulnerability (CVE-2026-20223) in its Secure Workload product, formerly known as Cisco Tetration. This flaw, due to insufficient validation and authentication in internal REST APIs, allowed unauthenticated remote attackers to gain Site Admin privileges by sending crafted API requests. Exploiting this vulnerability could enable attackers to access sensitive information and modify configurations across tenant boundaries. Cisco released software updates to address the issue and confirmed that, as of the advisory's publication, there was no evidence of exploitation in the wild. This incident underscores the critical importance of robust API security and timely patch management. Organizations are reminded to promptly apply security updates and review API access controls to mitigate risks associated with similar vulnerabilities.
2 months ago
Kill Chain
International Operation Dismantles 'First VPN' Used by Cybercriminals
In May 2026, an international law enforcement operation led by France and the Netherlands, with support from Europol and Eurojust, dismantled 'First VPN,' a virtual private network service extensively used by cybercriminals to conceal ransomware attacks, data theft, and other serious offenses. The operation resulted in the seizure of 33 servers across 27 countries, the shutdown of associated domains, and the identification of numerous users. The administrator of the service was interviewed during a house search in Ukraine. 'First VPN' had been promoted on Russian-speaking cybercrime forums as a tool for anonymity, offering services designed specifically for criminal use. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown?utm_source=openai)) This takedown underscores the increasing effectiveness of international cooperation in combating cybercrime infrastructure. It highlights the critical need for organizations to remain vigilant against services that facilitate illicit activities and to ensure robust cybersecurity measures are in place to protect against such threats.
2 months ago
Kill Chain
Google's Accidental Disclosure of Unpatched Chromium Vulnerability in 2026
In May 2026, Google inadvertently disclosed details of an unresolved vulnerability in the Chromium browser engine, affecting browsers like Chrome, Edge, and others. This flaw allows JavaScript code to continue running in the background even after the browser is closed, potentially enabling remote code execution on users' devices. Security researcher Lyra Rebane initially reported the issue in December 2022, highlighting risks such as the creation of botnets and unauthorized traffic redirection. Despite being marked as fixed in February 2026, the vulnerability remained unpatched, leading to its accidental public exposure. The incident underscores the critical importance of timely vulnerability management and the potential consequences of premature disclosure. Organizations must remain vigilant, ensuring that security patches are thoroughly tested and deployed promptly to mitigate risks associated with unpatched vulnerabilities.
2 months ago
Kill Chain
Unauthorized Access to Anthropic's Mythos AI Model Highlights Emerging Cybersecurity Risks
In April 2026, Anthropic's advanced AI model, Mythos, designed for identifying and exploiting software vulnerabilities, was accessed by unauthorized users through a third-party vendor. This breach raised significant concerns about the potential misuse of AI in cyberattacks, as Mythos has demonstrated the capability to uncover critical flaws across major operating systems and web browsers. The incident underscores the risks associated with AI-driven vulnerability discovery tools falling into the wrong hands, potentially enabling adversaries to exploit software weaknesses at an unprecedented scale. The unauthorized access to Mythos highlights the urgent need for robust security measures and governance frameworks to prevent the misuse of powerful AI tools in cybersecurity. As AI continues to evolve, organizations must reassess their security postures to address the accelerated pace of vulnerability discovery and exploitation facilitated by such technologies.
2 months ago
Kill Chain
GitHub Breach 2026: Lessons from the TeamPCP VS Code Extension Attack
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. This attack, attributed to the threat group TeamPCP, led to the exfiltration of approximately 3,800 internal repositories. The attackers advertised the stolen data for sale on a cybercrime forum, seeking at least $50,000. GitHub responded by removing the malicious extension, isolating the affected endpoint, and rotating critical credentials to mitigate further risk. This incident underscores the escalating threat of supply chain attacks targeting development tools and environments. The use of poisoned extensions to infiltrate systems highlights the need for heightened vigilance and robust security measures within the software development lifecycle.
2 months ago
Kill Chain
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability in PostgreSQL Deployments
On May 20, 2026, Drupal released security updates addressing a highly critical SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw allows anonymous attackers to send specially crafted requests, leading to arbitrary SQL injection on sites using PostgreSQL databases. Exploitation can result in information disclosure, privilege escalation, and potentially remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9, with patched versions available in 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) This incident underscores the persistent threat of SQL injection vulnerabilities in widely used content management systems. Organizations utilizing Drupal with PostgreSQL should prioritize immediate patching to mitigate potential exploitation. The ease of anonymous exploitation highlights the necessity for robust security practices and timely updates to protect sensitive data and maintain system integrity.
2 months ago
Kill Chain
GitHub Breach: Lessons in Securing Developer Tools Against Supply Chain Attacks
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious version of the Nx Console Visual Studio Code (VS Code) extension. This supply chain attack, orchestrated by the cybercriminal group TeamPCP, led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attackers exploited the compromised extension to harvest sensitive data, including source code and operational information. GitHub promptly detected the intrusion, removed the malicious extension, isolated the affected endpoint, and initiated an internal investigation to assess the full impact and prevent further unauthorized access. This incident underscores the escalating threat of supply chain attacks targeting developer tools and extensions. The rapid proliferation of such attacks highlights the critical need for organizations to implement stringent security measures, conduct regular audits of third-party tools, and foster a culture of security awareness among developers to mitigate potential vulnerabilities.
2 months ago
Kill Chain
Critical Linux Kernel Vulnerability Discovered After Nine Years
In May 2026, cybersecurity researchers disclosed a nine-year-old vulnerability in the Linux kernel, identified as CVE-2026-46333, also known as 'ssh-keysign-pwn'. This flaw allows unprivileged local users to access sensitive files and execute arbitrary commands with root privileges on default installations of major distributions like Debian, Fedora, and Ubuntu. The vulnerability originates from improper privilege management in the kernel's __ptrace_may_access() function, introduced in November 2016. Exploitation can lead to the disclosure of critical files such as /etc/shadow and SSH host private keys, posing significant security risks. The discovery of this long-standing vulnerability underscores the importance of continuous security assessments and prompt patching in open-source software. With a proof-of-concept exploit publicly available, organizations are urged to apply the latest kernel updates immediately to mitigate potential threats.
2 months ago
Kill Chain
Critical Privilege Escalation Vulnerability in Microsoft Defender (CVE-2026-41091)
In May 2026, Microsoft disclosed a critical vulnerability in Microsoft Defender, identified as CVE-2026-41091, which allows local privilege escalation due to improper link resolution before file access. This flaw enables authenticated attackers to gain SYSTEM privileges by exploiting how Defender processes symbolic and hard links, potentially leading to unauthorized code execution with elevated rights. The vulnerability has been actively exploited in the wild, prompting immediate security advisories and patch releases. The active exploitation of CVE-2026-41091 underscores the persistent targeting of security software by threat actors to escalate privileges and compromise systems. Organizations are urged to apply the latest patches to Microsoft Defender promptly to mitigate this risk and prevent potential breaches resulting from this vulnerability.
2 months ago
Kill Chain
Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials
In May 2026, a supply chain attack targeted the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account, publishing malicious versions of popular data-visualization packages. This led to widespread impact, as the malicious code propagated through dependencies like echarts-for-react, affecting CI/CD pipelines and cloud workloads. The payload, a 499 KB obfuscated JavaScript file, executed silently during npm install, aiming to steal credentials from GitHub Actions environments. Key features included multi-platform credential theft, process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery, indicating a sophisticated focus on CI/CD environments. This incident underscores the escalating threat of supply chain attacks, particularly targeting CI/CD environments. The attack's sophistication, including SLSA provenance forgery, highlights the need for enhanced security measures in software development pipelines to prevent unauthorized access and data breaches.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports