✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Dirty Frag: Unpatched Linux Vulnerability Grants Root Access
On May 7, 2026, a critical Linux kernel vulnerability known as 'Dirty Frag' was publicly disclosed. This flaw allows unprivileged local users to escalate their privileges to root across major Linux distributions, including Ubuntu, RHEL, Fedora, and others. Discovered by security researcher Hyunwoo Kim, Dirty Frag exploits two distinct vulnerabilities within the IPsec ESP and RxRPC modules, enabling attackers to modify read-only files in the page cache, leading to full system compromise. The premature disclosure occurred before patches were available, leaving systems vulnerable without immediate remediation options. The urgency of addressing Dirty Frag is heightened by its similarity to the recently disclosed 'Copy Fail' vulnerability (CVE-2026-31431), which also facilitates local privilege escalation. The public availability of exploit code for both vulnerabilities increases the risk of widespread exploitation. Organizations must prioritize mitigating these vulnerabilities to prevent potential system compromises and data breaches.
2 months ago
Kill Chain
Understanding the Impact of Recent SSRF Vulnerabilities in MCP Servers
In early 2026, critical vulnerabilities were discovered in MCP servers, notably in Atlassian's mcp-atlassian and Microsoft's MarkItDown. These vulnerabilities, including CVE-2026-27826, allowed unauthenticated attackers to exploit Server-Side Request Forgery (SSRF) flaws, potentially leading to remote code execution and unauthorized access to internal resources. The mcp-atlassian vulnerability stemmed from unvalidated custom HTTP headers, while MarkItDown's flaw involved improper URL validation, enabling access to cloud metadata services. ([pluto.security](https://pluto.security/blog/mcpwnfluence-cve-2026-27825-critical/?utm_source=openai)) These incidents underscore the persistent threat posed by SSRF vulnerabilities in widely used platforms. As organizations increasingly integrate MCP servers into their infrastructure, ensuring robust input validation and implementing strict access controls are imperative to prevent similar exploits and safeguard sensitive data.
2 months ago
Kill Chain
Critical Ivanti EPMM Zero-Day CVE-2026-6973 Exploited in the Wild
In May 2026, Ivanti disclosed a critical zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw allows authenticated users with administrative privileges to execute remote code, potentially compromising the entire mobile device management infrastructure. The vulnerability has been actively exploited in the wild, with Ivanti confirming limited instances of exploitation. To mitigate this risk, Ivanti released patches for EPMM versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, urging all on-premises EPMM customers to apply these updates immediately. ([thehackernews.com](https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html?utm_source=openai)) This incident underscores the persistent targeting of mobile device management systems by threat actors, highlighting the critical need for organizations to maintain up-to-date security measures and promptly apply vendor-released patches to protect sensitive data and infrastructure.
2 months ago
Kill Chain
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In May 2026, a critical vulnerability was discovered in Anthropic's Claude AI Chrome extension, allowing any installed browser plugin to issue commands to the AI without user consent. This flaw enabled unauthorized actions such as accessing and exfiltrating sensitive data from Google Drive and GitHub repositories, effectively bypassing Chrome's extension security model. The vulnerability was reported to Anthropic on April 27, 2026, and a partial fix was released on May 6, 2026. However, researchers noted that the fix did not fully mitigate the issue, leaving some attack vectors open. This incident underscores the growing security challenges associated with integrating AI agents into web browsers, highlighting the need for robust security measures to prevent unauthorized access and data exfiltration.
2 months ago
Kill Chain
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.
2 months ago
Kill Chain
State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)
In early April 2026, Palo Alto Networks identified a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of its PAN-OS software, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. Exploitation attempts began on April 9, with successful breaches occurring a week later. Attackers deployed tools like Earthworm and ReverseSocks5 to establish covert communications and bypass network defenses. This incident underscores a growing trend of state-sponsored actors targeting network edge devices, which often lack comprehensive logging and security measures. Organizations are urged to implement robust access controls and promptly apply security patches to mitigate such vulnerabilities. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/?utm_source=openai))
2 months ago
Kill Chain
Critical Zero-Day Vulnerability in Ivanti EPMM: CVE-2026-6973 Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity remote code execution vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw, stemming from improper input validation, allows authenticated users with administrative privileges to execute arbitrary code on affected systems running EPMM versions 12.8.0.0 and earlier. Ivanti confirmed limited exploitation of this zero-day vulnerability in the wild and urged customers to update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fixes by May 10, 2026. This incident underscores the persistent threat posed by zero-day vulnerabilities and the critical importance of timely patching to maintain system security. ([securityaffairs.com](https://securityaffairs.com/191822/security/u-s-cisa-adds-a-flaw-in-ivanti-endpoint-manager-mobile-epmm-to-its-known-exploited-vulnerabilities-catalog.html?utm_source=openai))
2 months ago
Kill Chain
Critical Microsoft Vulnerabilities Exploited in Q1 2026: A Call for Immediate Action
In Q1 2026, threat actors exploited three critical vulnerabilities—CVE-2026-21509, CVE-2026-21514, and CVE-2026-21513—to compromise systems running Microsoft Office and Windows OS components. These vulnerabilities allowed attackers to bypass security features, execute malicious code, and escalate privileges, leading to unauthorized access and potential data breaches. The exploitation of these flaws underscores the importance of timely software updates and robust security measures to mitigate such risks. The active exploitation of these vulnerabilities highlights a broader trend of attackers leveraging newly discovered flaws to infiltrate systems. Organizations must remain vigilant, ensuring prompt patch management and adopting comprehensive security strategies to defend against evolving threats.
2 months ago
Kill Chain
Quantum Risk Explained: Immediate Threats to Cryptography in 2026
In 2026, advancements in quantum computing have significantly reduced the cost and complexity of breaking traditional cryptographic systems, posing immediate threats to data security. Techniques like Shor's algorithm can now be executed with fewer qubits, making previously secure encryption methods vulnerable. Organizations must urgently assess and upgrade their cryptographic protocols to mitigate these emerging risks. ([techradar.com](https://www.techradar.com/pro/encryption-breaking-technology-is-now-20x-cheaper-and-ceos-should-be-very-worried?utm_source=openai)) The urgency is underscored by the potential for 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt once quantum capabilities mature. This scenario highlights the need for immediate action to protect sensitive information from future quantum decryption threats. ([deloitte.com](https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2025/tech-trends-quantum-computing-and-cybersecurity.html?utm_source=openai))
2 months ago
Kill Chain
TrustFall Vulnerability in AI Coding Tools: A Critical Security Alert
In May 2026, researchers at Adversa AI identified a critical security issue in AI coding tools such as Claude Code, Cursor CLI, Gemini CLI, and CoPilot CLI. Malicious repositories can exploit insufficient warning dialogs to auto-approve and launch Model Context Protocol (MCP) servers without explicit user consent, leading to potential full-system compromises. This vulnerability allows attackers to execute arbitrary code, access sensitive files, install backdoors, and establish command-and-control channels, especially in continuous integration environments where no user interaction is required. The 'TrustFall' issue underscores the urgent need for enhanced security measures in AI-assisted development tools. As the adoption of such tools grows, ensuring robust permission systems and clear user warnings becomes paramount to prevent supply chain attacks and protect development environments from unauthorized code execution.
2 months ago
Kill Chain
VoidStealer Trojan Exploits Debugger-Based Technique to Bypass Chrome's Encryption
In May 2026, the VoidStealer Trojan emerged with a novel method to bypass Google Chrome's App-Bound Encryption (ABE), a security feature introduced in July 2024 to protect sensitive browser data. Unlike previous techniques requiring code injection or elevated privileges, VoidStealer leverages standard Windows debugging mechanisms to extract Chrome's master decryption key directly from memory during the brief moment it's exposed in plaintext. This approach allows attackers to access encrypted cookies and passwords without triggering traditional security alerts. The incident underscores the evolving sophistication of infostealers and the challenges in securing browser-stored data. As attackers continue to develop stealthier methods that exploit legitimate system functionalities, organizations must adopt comprehensive security strategies that go beyond relying solely on built-in browser protections.
2 months ago
Kill Chain
Critical Vulnerabilities in vm2 Node.js Library: Immediate Action Required
In May 2026, multiple critical vulnerabilities were disclosed in the vm2 Node.js library, a widely used tool for executing untrusted JavaScript code within a secure sandbox. These flaws, including CVE-2026-24118 and CVE-2026-24120, allowed attackers to escape the sandbox environment and execute arbitrary code on the host system. The vulnerabilities affected versions up to 3.10.4, with patches released in version 3.11.0. Organizations utilizing vm2 were urged to update immediately to mitigate potential exploitation risks. ([thehackernews.com](https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html?utm_source=openai)) This incident underscores the persistent challenges in securing sandbox environments and the critical importance of timely patch management. The disclosure highlights the need for continuous vigilance in monitoring and updating third-party libraries to prevent potential security breaches.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports