Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 102 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1213–1224 / 3490 reports
Critical Vulnerability in Progress Kemp LoadMaster: CVE-2026-8037
Financial Services4 months ago

Critical Vulnerability in Progress Kemp LoadMaster: CVE-2026-8037

In June 2026, a critical vulnerability (CVE-2026-8037) was identified in Progress Kemp LoadMaster, an application delivery controller and load balancer. This flaw allows unauthenticated attackers to execute arbitrary commands as root by sending crafted requests to the API, due to improper input sanitization in the escape_quotes() function. The vulnerability affects LoadMaster GA v7.2.63.1 and earlier, and LTSF v7.2.54.17 and earlier. Progress released patches (GA v7.2.63.2 and LTSF v7.2.54.18) to address this issue. ([thehackernews.com](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with API security and input validation flaws. Organizations are urged to promptly apply the provided patches and review their API security measures to prevent potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BioShocking Attack: A Wake-Up Call for AI Browser Security
Computer Software/Engineering4 months ago

BioShocking Attack: A Wake-Up Call for AI Browser Security

In June 2026, security firm LayerX unveiled a novel attack technique named 'BioShocking,' which exploits AI-powered browsers and assistants to extract user credentials. By presenting a malicious webpage designed as a puzzle game, attackers manipulated AI agents into disregarding their safety protocols. The agents, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension, were deceived into accessing and transmitting sensitive information, such as SSH login credentials from users' GitHub repositories, to unauthorized parties. This method leverages indirect prompt injection, where malicious commands are embedded within seemingly benign content, leading AI agents to execute unauthorized actions without detection. ([thehackernews.com](https://thehackernews.com/2026/06/new-bioshocking-attack-tricks-ai.html?utm_source=openai)) The BioShocking attack underscores the pressing need for enhanced security measures in AI-driven applications. As AI browsers become more integrated into daily workflows, their potential to access and manipulate sensitive data grows, making them attractive targets for cybercriminals. This incident highlights the importance of implementing robust safeguards, such as explicit user confirmations before accessing logged-in accounts and setting strict boundaries on AI agent capabilities, to prevent similar exploits in the future. ([layerxsecurity.com](https://layerxsecurity.com/blog/bioshocking-ai-gaming-the-ai-browser-and-escaping-its-guardrails/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical SimpleHelp Vulnerability (CVE-2026-48558) Exposes Systems to Unauthorized Access
Information Technology/IT4 months ago

Critical SimpleHelp Vulnerability (CVE-2026-48558) Exposes Systems to Unauthorized Access

In June 2026, a critical authentication bypass vulnerability, CVE-2026-48558, was identified in SimpleHelp versions 5.5.15 and earlier, as well as 6.0 pre-release versions. This flaw resides in the OpenID Connect (OIDC) authentication flow, where identity tokens are accepted without verifying their cryptographic signatures. Exploiting this vulnerability, remote unauthenticated attackers can forge tokens to gain full technician access, potentially bypassing multi-factor authentication and compromising managed endpoints. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/simplehelp-rmm-cve-2026-48558/?utm_source=openai)) The exploitation of CVE-2026-48558 underscores the escalating risks associated with remote monitoring and management (RMM) tools, which are increasingly targeted by cybercriminals. Organizations must prioritize the timely application of security patches and enhance monitoring of authentication mechanisms to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical SimpleHelp Vulnerability Exploited to Deploy TaskWeaver and Djinn Stealer
Information Technology/IT4 months ago

Critical SimpleHelp Vulnerability Exploited to Deploy TaskWeaver and Djinn Stealer

In June 2026, attackers exploited a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp's remote monitoring and management software. This flaw allowed unauthenticated attackers to create privileged technician sessions by submitting forged identity tokens. Leveraging this access, they deployed two new malware families: TaskWeaver, a heavily obfuscated Node.js loader, and Djinn Stealer, an information stealer targeting Windows, macOS, and Linux systems. Djinn Stealer harvested credentials from cloud platforms, source control systems, package registries, AI development tools, browsers, SSH, and cryptocurrency wallets. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/?utm_source=openai)) The exploitation of CVE-2026-48558 underscores the increasing targeting of remote management tools by threat actors. This incident highlights the critical need for organizations to promptly apply security patches, especially for tools that provide extensive access to IT environments. The deployment of cross-platform malware like Djinn Stealer also reflects a trend towards more versatile and widespread credential theft campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Study Reveals 282 iOS AI Apps Exposing LLM API Credentials
Computer Software/Engineering4 months ago

Study Reveals 282 iOS AI Apps Exposing LLM API Credentials

In June 2026, researchers from Wake Forest University analyzed 444 AI-powered iOS applications and discovered that 282 of them (approximately 64%) exposed exploitable LLM API credentials through network traffic. The vulnerabilities were categorized into three main types: plaintext API key transmission (19%), unauthenticated backend proxy access (33%), and JWT-based token leakage (48%). These security lapses allowed unauthorized access to AI services, potentially leading to financial losses for developers and compromising user data. Notably, only 28% of the affected applications had addressed these issues three months after being notified. This incident underscores a systemic gap in secure integration practices within the iOS ecosystem, highlighting the urgent need for developers to implement robust security measures when integrating large language models into mobile applications. The prevalence of such vulnerabilities calls for enhanced developer awareness, explicit security guidance from AI service providers, and potential platform-level enforcement to mitigate risks associated with credential leakage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GuardFall: Exposing Shell Injection Vulnerabilities in AI Coding Agents
Computer Software/Engineering4 months ago

GuardFall: Exposing Shell Injection Vulnerabilities in AI Coding Agents

In June 2026, Adversa AI disclosed a vulnerability named 'GuardFall' affecting ten out of eleven popular open-source AI coding agents. This flaw allows attackers to bypass safety checks using decades-old shell injection techniques, enabling the execution of malicious commands that can delete files or exfiltrate sensitive data such as SSH keys and cloud credentials. The vulnerability arises because these agents rely on blocklists that fail to account for how the Bash shell processes commands, leading to discrepancies between filtered and executed commands. ([thehackernews.com](https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html?utm_source=openai)) This incident underscores the persistent risks associated with AI coding agents, especially as they become more integrated into development workflows. The exploitation of longstanding shell injection methods highlights the need for robust security measures and continuous vigilance in the deployment of AI tools to prevent potential supply chain attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Apple's June 2026 Security Updates: Over 25 Vulnerabilities Patched
Financial Services4 months ago

Apple's June 2026 Security Updates: Over 25 Vulnerabilities Patched

In June 2026, Apple released security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, addressing over 25 vulnerabilities. The majority of these issues were found in WebKit and related web technologies, potentially leading to crashes, memory corruption, or data disclosure. Additionally, vulnerabilities in the kernel and IOGPUFamily were patched. Notably, Apple expedited these updates in response to concerns about AI-assisted hacking tools, aiming to reduce the window between vulnerability disclosure and patch deployment. ([macrumors.com](https://www.macrumors.com/2026/06/29/apple-ios-26-5-2-early-release/?utm_source=openai)) This proactive approach underscores the growing threat posed by AI-enhanced cyberattacks, highlighting the necessity for organizations to adopt agile security practices and promptly apply software updates to mitigate emerging risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Malicious Chromium Extension Exploits AI Branding for Search Hijacking
Financial Services4 months ago

Malicious Chromium Extension Exploits AI Branding for Search Hijacking

In June 2026, a malicious Chromium-based browser extension impersonating the AI-powered search engine Perplexity AI was discovered. This extension intercepted user search queries and real-time suggestions, routing them through attacker-controlled infrastructure before redirecting to legitimate search providers. The primary objective appeared to be data collection for potential misuse, such as profiling or targeted advertising. Microsoft Threat Intelligence reported the extension to Google, leading to its removal from the Chrome Web Store. This incident underscores the evolving tactics of threat actors leveraging AI-related branding to enhance the credibility of their malicious tools. The use of legitimate APIs and advanced permissions highlights the need for heightened vigilance and robust security measures to protect against sophisticated browser-based threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GitHub Advisory Database Overwhelmed by Record Vulnerability Reports
Computer Software/Engineering4 months ago

GitHub Advisory Database Overwhelmed by Record Vulnerability Reports

In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories, marking a fivefold increase over its typical monthly output and the highest in its history. This surge reflects a structural change in the vulnerability disclosure ecosystem, with private vulnerability reports escalating from approximately 550 per week in January to over 3,000 per week by May. Repository advisories and CVE requests have similarly increased, leading to extended review times and a backlog in processing new advisories. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai)) The unprecedented volume of vulnerability reports underscores the need for enhanced coordination among researchers, maintainers, and security teams. It also highlights the importance of submitting complete and accurate vulnerability data to expedite the review process. As the ecosystem adapts to this new scale, stakeholders must collaborate to maintain the quality and timeliness of advisory publications. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Black Basta Ransomware Group: A Comprehensive Analysis of Its Rise and Fall
Financial Services4 months ago

Black Basta Ransomware Group: A Comprehensive Analysis of Its Rise and Fall

Black Basta, a ransomware-as-a-service (RaaS) group, emerged in April 2022 and rapidly became a significant threat by employing double extortion tactics—encrypting victims' data and exfiltrating sensitive information to pressure organizations into paying ransoms. The group targeted over 500 organizations worldwide across various critical infrastructure sectors, including healthcare, finance, and manufacturing. Their operations involved sophisticated social engineering techniques, exploitation of known vulnerabilities, and partnerships with malware distributors like QakBot to gain initial access. In 2025, internal conflicts and law enforcement actions led to a decline in Black Basta's activities, culminating in the group's shutdown. ([techrepublic.com](https://www.techrepublic.com/article/black-basta-ransomware-attack/?utm_source=openai)) The Black Basta case underscores the evolving nature of ransomware threats, highlighting the importance of robust cybersecurity measures and proactive threat intelligence to defend against sophisticated cybercriminal operations. The group's rapid rise and eventual downfall illustrate the dynamic landscape of cyber threats and the necessity for organizations to remain vigilant and adaptable.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Malicious Perplexity Chrome Extension Compromises User Data
Financial Services4 months ago

Malicious Perplexity Chrome Extension Compromises User Data

In June 2026, Microsoft identified a malicious Chrome extension named "Search for perplexity ai" that impersonated the AI search engine Perplexity. This extension intercepted users' search queries and address bar inputs, routing them through an attacker-controlled server before redirecting to legitimate search results. The extension set itself as the default search engine upon installation, capturing every character typed into the address bar and transmitting this data, along with browser headers, IP addresses, and user agents, to the attacker's server. Microsoft reported the extension to Google, leading to its removal from the Chrome Web Store. ([thehackernews.com](https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html?utm_source=openai)) This incident underscores a growing trend of malicious browser extensions exploiting the popularity of AI tools to harvest sensitive user data. Similar campaigns have targeted users by masquerading as AI assistants, leading to significant data breaches. Organizations must remain vigilant, implementing strict policies on browser extensions and educating users about the risks associated with unverified add-ons. ([techradar.com](https://www.techradar.com/pro/security/fake-chrome-ai-extensions-targeted-over-300-000-users-to-steal-emails-personal-data-and-more?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AWS Threat Technique Catalog June 2026 Update: Enhancing Your AWS Security Posture
Financial Services4 months ago

AWS Threat Technique Catalog June 2026 Update: Enhancing Your AWS Security Posture

In June 2026, the AWS Customer Incident Response Team (AWS CIRT) updated the Threat Technique Catalog (TTC) to address emerging security challenges in container security, organizational trust, and compute hijacking. The update introduces five new entries: EKS workload modification, exploitation of public-facing applications in EKS, assuming root access into organization member accounts, compute hijacking in EKS, and inviting accounts to unknown organizations. These techniques reflect real-world incidents where threat actors exploit legitimate AWS functionalities to compromise environments, emphasizing the need for robust security measures and vigilant monitoring. This update underscores a trend where attackers leverage standard cloud operations to evade detection, highlighting the importance for organizations to enhance their security postures by implementing controls such as admission controllers, service control policies, and resource quotas, and by actively monitoring for anomalous activities within their AWS environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports