Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 119 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1417–1428 / 3490 reports
Shai-Hulud Attack Compromises 19 Science-Focused PyPI Packages
Biotechnology/Greentech5 months ago

Shai-Hulud Attack Compromises 19 Science-Focused PyPI Packages

In June 2026, a sophisticated supply-chain attack known as 'Shai-Hulud' compromised 19 science-focused packages on the Python Package Index (PyPI), including popular bioinformatics tools like Dynamo, Spateo, CoolBox, U-FISH, and Napari-UFISH. The attackers injected malicious code into these packages, which, upon execution, attempted to download and run additional scripts designed to steal a wide array of developer credentials, such as GitHub tokens, cloud service credentials, and SSH keys. This breach underscores the vulnerability of open-source repositories to supply-chain attacks and highlights the critical need for enhanced security measures in software development workflows. The incident is part of a broader trend of increasing supply-chain attacks targeting open-source ecosystems, emphasizing the urgency for developers and organizations to implement robust security practices, including regular audits of dependencies and the use of automated tools to detect malicious code.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required
Information Technology/IT5 months ago

Critical Linux Kernel Vulnerability CVE-2026-23111: Immediate Action Required

In February 2026, a critical vulnerability identified as CVE-2026-23111 was discovered in the Linux kernel's nf_tables subsystem. This flaw, resulting from an inverted genmask check in the nft_map_catchall_activate() function, allows unprivileged local users to escalate privileges to root. The vulnerability affects systems with user namespaces and nftables enabled, common configurations in many Linux distributions. Exploits leveraging this vulnerability have been publicly released, demonstrating the ease with which attackers can gain root access and potentially break out of containerized environments. The disclosure of CVE-2026-23111 underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel. The rapid development and public release of exploits for such vulnerabilities highlight the need for organizations to promptly apply security patches and review system configurations to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980
Financial Services5 months ago

Massive Exploitation of Ghost CMS Vulnerability CVE-2026-26980

In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS was exploited to compromise over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. Attackers injected malicious JavaScript into these sites, presenting visitors with fake Cloudflare verification prompts that, when followed, installed malware on their systems. This vulnerability, with a CVSS score of 9.4, allowed unauthenticated attackers to read arbitrary data from the database, leading to widespread data breaches and malware distribution. ([techtimes.com](https://www.techtimes.com/articles/317134/20260525/ghost-cms-sql-injection-hits-700-sites-harvard-duckduckgo-serve-fake-cloudflare-malware.htm?utm_source=openai)) The exploitation of this vulnerability underscores the critical importance of timely patch management. Despite a patch being available since February 2026, many organizations failed to apply it, resulting in significant security incidents. This case highlights the ongoing risks associated with unpatched software and the necessity for organizations to maintain robust vulnerability management practices. ([techradar.com](https://www.techradar.com/pro/security/ghost-cms-flaw-hijacked-to-target-hundreds-of-websites-with-clickfix-attacks-heres-how-to-stay-safe?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Hades Campaign: A New Threat to PyPI Security
Computer Software/Engineering5 months ago

Hades Campaign: A New Threat to PyPI Security

In June 2026, a sophisticated supply chain attack targeted the Python Package Index (PyPI), compromising 37 wheels across 19 packages. The attackers, adopting a 'Hades' naming convention, deployed a variant of the Shai-Hulud worm, which is known for its self-propagating and information-stealing capabilities. This malware infects software components, utilizes the access to publish malicious versions, and harvests repository accounts of downstream users. The attack chain's cross-runtime design involved the installation of Bun—a JavaScript runtime—as a heavily obfuscated JavaScript stealer before executing the payload. This incident underscores the persistent and evolving nature of software supply chain threats. The use of cross-runtime techniques and obfuscated payloads highlights the increasing sophistication of attackers, emphasizing the need for robust security measures in open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Red Hat npm Packages Compromised in June 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

Red Hat npm Packages Compromised in June 2026 Supply Chain Attack

In June 2026, a sophisticated supply chain attack was identified, involving the compromise of Red Hat's npm packages. Attackers infiltrated a Red Hat employee's GitHub account, injecting malware into numerous npm packages under the Red Hat Cloud Services namespace. This breach led to over 80,000 downloads of compromised packages within a week, targeting sensitive data such as GitHub Actions secrets, npm tokens, SSH keys, and cloud credentials. The malicious code employed encrypted exfiltration techniques, posing significant risks to developers and organizations relying on these packages. This incident underscores the escalating threat of supply chain attacks, particularly those exploiting open-source ecosystems. The attackers' use of advanced techniques, including encrypted exfiltration and targeting cloud identities, highlights the need for enhanced vigilance and robust security measures in software development and distribution processes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Check Point VPN Flaw Exploited: CVE-2026-50751
Financial Services5 months ago

Critical Check Point VPN Flaw Exploited: CVE-2026-50751

In early June 2026, Check Point Software Technologies disclosed active exploitation of a critical vulnerability, CVE-2026-50751, affecting their Remote Access VPN and Mobile Access products configured with the deprecated IKEv1 key exchange protocol. This flaw allows unauthenticated remote attackers to bypass user authentication and establish unauthorized VPN connections. Exploitation has been observed since at least May 7, 2026, with increased activity in early June, including incidents linked to a Qilin ransomware affiliate. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai)) The incident underscores the risks associated with using outdated protocols like IKEv1, which, despite being deprecated, remain in use for legacy compatibility. Organizations are urged to disable IKEv1 and apply security updates to mitigate this vulnerability. ([blog.checkpoint.com](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/amp/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AI-Generated Phishing Attacks Overwhelm SOCs in 2026
Financial Services5 months ago

AI-Generated Phishing Attacks Overwhelm SOCs in 2026

In early 2026, organizations experienced a surge in AI-generated phishing attacks, leading to an overwhelming increase in security alerts. These sophisticated campaigns utilized generative AI to craft convincing emails and evade traditional detection methods, significantly burdening Security Operations Centers (SOCs). As a result, SOCs faced challenges in effectively triaging and responding to the high volume of alerts, with only 37% of daily security alerts being investigated. This escalation in alert volume not only strained resources but also increased the risk of overlooking genuine threats, thereby elevating the overall cost and complexity of cybersecurity operations. ([prnewswire.com](https://www.prnewswire.com/news-releases/new-research-reveals-enterprises-investigate-just-37-of-daily-security-alerts-as-ai-expands-in-the-soc-302717184.html?utm_source=openai)) The proliferation of AI-driven phishing attacks underscores the urgent need for organizations to adapt their cybersecurity strategies. Traditional defense mechanisms are proving inadequate against the scale and sophistication of these threats. Implementing advanced AI-powered defenses and enhancing SOC capabilities are critical to effectively manage and mitigate the risks associated with AI-generated phishing campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Miasma Worm Infiltrates 73 Microsoft GitHub Repositories in Major 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

Miasma Worm Infiltrates 73 Microsoft GitHub Repositories in Major 2026 Supply Chain Attack

In June 2026, Microsoft faced a significant supply chain attack when the self-replicating Miasma worm compromised 73 of its GitHub repositories across organizations such as Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The worm embedded malicious code that activated upon developers cloning and opening the affected repositories in AI coding agents, leading to the harvesting of credentials for platforms including AWS, Azure, GCP, Kubernetes, npm, and GitHub. This incident underscores the evolving nature of supply chain attacks, particularly targeting AI-assisted development tools. The Miasma worm, a variant of the Mini Shai-Hulud worm, exploits the inherent trust in authenticated maintainers and signed packages, highlighting the need for enhanced security measures in software development and distribution processes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
Information Technology/IT5 months ago

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog

In early June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity vulnerability, CVE-2026-28318, affecting SolarWinds Serv-U, to its Known Exploited Vulnerabilities (KEV) catalog. This denial-of-service (DoS) flaw allows unauthenticated attackers to crash the Serv-U service by sending specially crafted POST requests with the 'Content-Encoding: deflate' header. The vulnerability has a CVSS score of 7.5 and is actively being exploited in the wild. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-28318?utm_source=openai)) The inclusion of this vulnerability in the KEV catalog underscores the critical need for organizations to promptly apply security patches. Unpatched systems remain susceptible to service disruptions, which can have significant operational and financial impacts. ([scworld.com](https://www.scworld.com/brief/hackers-actively-exploit-solarwinds-serv-u-flaw-to-crash-servers-cisa-warns?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical SolarWinds Serv-U Vulnerability (CVE-2026-28318) Under Active Exploitation
Government Administration5 months ago

Critical SolarWinds Serv-U Vulnerability (CVE-2026-28318) Under Active Exploitation

In early June 2026, a critical vulnerability identified as CVE-2026-28318 was discovered in SolarWinds Serv-U software. This flaw allows unauthenticated attackers to send specially crafted POST requests with 'Content-Encoding: deflate' headers, leading to uncontrolled resource consumption and subsequent service crashes. The vulnerability has been actively exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to their Known Exploited Vulnerabilities (KEV) catalog. Organizations utilizing affected versions of Serv-U are at significant risk of service disruptions and potential data loss. The inclusion of CVE-2026-28318 in CISA's KEV catalog underscores the urgency for organizations to address this vulnerability promptly. With active exploitation observed, it is imperative for entities using SolarWinds Serv-U to apply the recommended patches or mitigations to prevent potential service outages and safeguard sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Cisco SD-WAN Vulnerability CVE-2026-20245: Root Privilege Escalation Risk
Telecommunications5 months ago

Cisco SD-WAN Vulnerability CVE-2026-20245: Root Privilege Escalation Risk

In June 2026, Cisco disclosed a high-severity vulnerability (CVE-2026-20245) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw arises from insufficient validation of user-supplied input, allowing authenticated local attackers with netadmin privileges to execute arbitrary commands as the root user by uploading crafted files. Exploitation of this vulnerability has been observed in limited cases, leading to unauthorized configuration changes pushed to edge devices. The ongoing exploitation of this zero-day vulnerability underscores the persistent targeting of network management systems by threat actors. Organizations utilizing Cisco's SD-WAN solutions should prioritize reviewing their systems for indicators of compromise and apply recommended mitigations promptly to prevent potential breaches and maintain network integrity.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Urgent: CISA Reports Active Exploitation of SolarWinds Serv-U Vulnerability CVE-2026-28318
Government Administration5 months ago

Urgent: CISA Reports Active Exploitation of SolarWinds Serv-U Vulnerability CVE-2026-28318

In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported active exploitation of a high-severity vulnerability in SolarWinds Serv-U software, identified as CVE-2026-28318. This flaw allows unauthenticated remote attackers to crash the Serv-U service by sending specially crafted POST requests with the 'Content-Encoding: deflate' header. SolarWinds released Serv-U 15.5.4 Hotfix 1 to address this issue, advising immediate patching or, if not feasible, implementing mitigations such as restricting access to known addresses and blocking POST requests containing 'content-encoding'. The exploitation of CVE-2026-28318 underscores the persistent targeting of file transfer services by threat actors to disrupt operations. Organizations are urged to prioritize patching and enhance monitoring of their file transfer infrastructures to prevent potential service disruptions and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports