Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
CVE-2025-68670: Critical Remote Code Execution Vulnerability in xrdp Server
In December 2025, Kaspersky identified a critical remote code execution (RCE) vulnerability, CVE-2025-68670, in the xrdp server—a widely used open-source implementation of the Remote Desktop Protocol (RDP) for Linux systems. The flaw resides in the xrdp_wm_parse_domain_information function, which processes domain names during the Secure Settings Exchange phase of an RDP connection. By sending a specially crafted domain name, an unauthenticated attacker can exploit this vulnerability to execute arbitrary code on the target server, potentially leading to full system compromise. The xrdp maintainers promptly addressed the issue by releasing patches in versions 0.10.5, 0.9.27, and 0.10.4.1, accompanied by a security bulletin detailing the vulnerability and mitigation steps. This incident underscores the critical importance of regular security assessments and timely patch management, especially for widely used open-source software. Organizations relying on xrdp for remote desktop services should ensure they have applied the necessary updates to protect against potential exploitation of this vulnerability.
4 months ago
Kill Chain
Critical 'Dirty Frag' Vulnerability in Linux Kernel Grants Root Access
A critical local privilege escalation (LPE) vulnerability, dubbed 'Dirty Frag,' has been identified in the Linux kernel, affecting major distributions such as Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. This flaw allows unprivileged local users to gain root access by exploiting a logic error in the kernel's cryptographic module. The vulnerability has been actively exploited in the wild, with a publicly available proof-of-concept demonstrating its reliability across affected systems. Immediate patching is essential to mitigate the risk of unauthorized system control. The disclosure of 'Dirty Frag' underscores the persistent challenges in securing widely used open-source software. Organizations must prioritize timely updates and consider implementing additional security measures, such as disabling vulnerable modules or restricting access, to protect against potential exploits targeting this and similar vulnerabilities.
4 months ago
Kill Chain
PamDOORa: A New Threat to Linux Authentication Security
In May 2026, cybersecurity researchers uncovered a new Linux backdoor named PamDOORa, advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor known as "darkworm." PamDOORa is a Pluggable Authentication Module (PAM)-based post-exploitation toolkit that enables persistent SSH access through a magic password and specific TCP port combination. Additionally, it can harvest credentials from all legitimate users who authenticate through the compromised system. The backdoor also incorporates anti-forensic capabilities to tamper with authentication logs, effectively erasing traces of malicious activity. The emergence of PamDOORa highlights a growing trend of sophisticated Linux-based malware targeting authentication mechanisms to establish persistent access and exfiltrate sensitive credentials. This development underscores the need for organizations to implement robust monitoring and auditing of authentication processes to detect and mitigate such threats.
4 months ago
Kill Chain
Critical Vulnerability in MAXHUB Pivot Client Application: CVE-2025-53704
In December 2025, a critical vulnerability (CVE-2025-53704) was identified in the MAXHUB Pivot client application versions prior to v1.36.2. This flaw involved a weak password recovery mechanism, allowing remote attackers to request password resets and gain unauthorized access to user accounts without prior authentication. The vulnerability posed significant risks, including potential data breaches and unauthorized control over affected systems. The incident underscores the importance of robust authentication mechanisms and timely software updates. Organizations are advised to upgrade to version 1.36.2 or newer to mitigate this risk. This case highlights the ongoing need for vigilance against authentication vulnerabilities in widely used applications.
4 months ago
Kill Chain
Quasar Linux RAT: A New Threat to Developer Environments
In May 2026, security researchers uncovered Quasar Linux RAT (QLNX), a sophisticated Linux-based remote access trojan targeting developer systems. QLNX operates stealthily, executing filelessly from memory and employing multiple persistence mechanisms, including systemd, crontab, and .bashrc shell injection. It masquerades as kernel threads to evade detection and utilizes both userland and kernel-level rootkits to conceal its presence. The malware's primary objective is to harvest credentials from high-value files such as .npmrc, .pypirc, .git-credentials, and cloud service configurations, enabling attackers to infiltrate software supply chains and cloud infrastructures. ([roguevault.news](https://www.roguevault.news/quasar-linux-rat-supply-chain-threat/?utm_source=openai)) The emergence of QLNX underscores a growing trend of targeted attacks on developer environments, aiming to exploit the trust within software supply chains. This incident highlights the critical need for enhanced security measures in development pipelines, as the compromise of a single developer's credentials can lead to widespread distribution of malicious code, affecting numerous downstream users and systems. ([socprime.com](https://socprime.com/active-threats/qlnx-linux-rat-uses-rootkit-and-pam-backdoor/?utm_source=openai))
4 months ago
Kill Chain
CISA Adds CVE-2026-6973 to Known Exploited Vulnerabilities Catalog
On May 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities (KEV) catalog. This high-severity vulnerability affects Ivanti Endpoint Manager Mobile (EPMM) versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1, allowing authenticated users with administrative privileges to execute arbitrary code remotely. Ivanti has released patches to address this issue and urges organizations to update their systems promptly. ([redpacketsecurity.com](https://www.redpacketsecurity.com/cve-alert-cve-2026-6973-ivanti-endpoint-manager-mobile/?utm_source=openai)) The inclusion of CVE-2026-6973 in the KEV catalog underscores the ongoing threat posed by vulnerabilities in widely used enterprise management tools. Organizations are advised to prioritize the remediation of such vulnerabilities to mitigate potential risks to their networks and data. ([cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?utm_source=openai))
4 months ago
Kill Chain
Critical RCE Vulnerabilities in Microsoft's Semantic Kernel SDK
In May 2026, Microsoft disclosed critical vulnerabilities in its Semantic Kernel SDK, specifically CVE-2026-26030 and CVE-2026-25592. These flaws allowed remote code execution and arbitrary file writes through AI agent frameworks, posing significant security risks. Attackers could exploit these vulnerabilities to execute unauthorized code and manipulate file systems, potentially leading to full system compromise. The vulnerabilities were promptly addressed in subsequent updates, with Microsoft releasing patches to mitigate the risks. Organizations utilizing the Semantic Kernel SDK were urged to update to the latest versions to protect their systems from potential exploitation. This incident underscores the evolving threat landscape in AI and machine learning applications, highlighting the need for continuous vigilance and proactive security measures in the development and deployment of AI agents. As AI technologies become more integrated into critical systems, ensuring their security is paramount to prevent potential breaches and maintain trust in these advanced solutions.
4 months ago
Kill Chain
Dirty Frag: Unpatched Linux Vulnerability Grants Root Access
On May 7, 2026, a critical Linux kernel vulnerability known as 'Dirty Frag' was publicly disclosed. This flaw allows unprivileged local users to escalate their privileges to root across major Linux distributions, including Ubuntu, RHEL, Fedora, and others. Discovered by security researcher Hyunwoo Kim, Dirty Frag exploits two distinct vulnerabilities within the IPsec ESP and RxRPC modules, enabling attackers to modify read-only files in the page cache, leading to full system compromise. The premature disclosure occurred before patches were available, leaving systems vulnerable without immediate remediation options. The urgency of addressing Dirty Frag is heightened by its similarity to the recently disclosed 'Copy Fail' vulnerability (CVE-2026-31431), which also facilitates local privilege escalation. The public availability of exploit code for both vulnerabilities increases the risk of widespread exploitation. Organizations must prioritize mitigating these vulnerabilities to prevent potential system compromises and data breaches.
4 months ago
Kill Chain
Understanding the Impact of Recent SSRF Vulnerabilities in MCP Servers
In early 2026, critical vulnerabilities were discovered in MCP servers, notably in Atlassian's mcp-atlassian and Microsoft's MarkItDown. These vulnerabilities, including CVE-2026-27826, allowed unauthenticated attackers to exploit Server-Side Request Forgery (SSRF) flaws, potentially leading to remote code execution and unauthorized access to internal resources. The mcp-atlassian vulnerability stemmed from unvalidated custom HTTP headers, while MarkItDown's flaw involved improper URL validation, enabling access to cloud metadata services. ([pluto.security](https://pluto.security/blog/mcpwnfluence-cve-2026-27825-critical/?utm_source=openai)) These incidents underscore the persistent threat posed by SSRF vulnerabilities in widely used platforms. As organizations increasingly integrate MCP servers into their infrastructure, ensuring robust input validation and implementing strict access controls are imperative to prevent similar exploits and safeguard sensitive data.
4 months ago
Kill Chain
Critical Ivanti EPMM Zero-Day CVE-2026-6973 Exploited in the Wild
In May 2026, Ivanti disclosed a critical zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw allows authenticated users with administrative privileges to execute remote code, potentially compromising the entire mobile device management infrastructure. The vulnerability has been actively exploited in the wild, with Ivanti confirming limited instances of exploitation. To mitigate this risk, Ivanti released patches for EPMM versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, urging all on-premises EPMM customers to apply these updates immediately. ([thehackernews.com](https://thehackernews.com/2026/05/ivanti-epmm-cve-2026-6973-rce-under.html?utm_source=openai)) This incident underscores the persistent targeting of mobile device management systems by threat actors, highlighting the critical need for organizations to maintain up-to-date security measures and promptly apply vendor-released patches to protect sensitive data and infrastructure.
4 months ago
Kill Chain
Critical Vulnerability in Claude Chrome Extension Exposes User Data
In May 2026, a critical vulnerability was discovered in Anthropic's Claude AI Chrome extension, allowing any installed browser plugin to issue commands to the AI without user consent. This flaw enabled unauthorized actions such as accessing and exfiltrating sensitive data from Google Drive and GitHub repositories, effectively bypassing Chrome's extension security model. The vulnerability was reported to Anthropic on April 27, 2026, and a partial fix was released on May 6, 2026. However, researchers noted that the fix did not fully mitigate the issue, leaving some attack vectors open. This incident underscores the growing security challenges associated with integrating AI agents into web browsers, highlighting the need for robust security measures to prevent unauthorized access and data exfiltration.
4 months ago
Kill Chain
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports