Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 15 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 169–180 / 3490 reports
AhsayCBS Critical Flaws Enable Cryptojacking Through Incomplete Patches
AhsayCBS Critical Flaws Enable Cryptojacking Through Incomplete Patches
Information Technology/IT3 weeks ago

AhsayCBS Critical Flaws Enable Cryptojacking Through Incomplete Patches

In October 2026, threat actors exploited two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in Ahsay's AhsayCBS backup software to deploy web shells and XMRig cryptocurrency miners. The flaws allowed attackers to chain authentication bypass with remote code execution capabilities on exposed systems. Initial patches released in August 2026 were incomplete, prompting Ahsay to issue emergency hotfixes in versions 10.3.4.45 and 9.15.2.70. The active exploitation led CISA to add both vulnerabilities to the Known Exploited Vulnerabilities catalog with a mandatory October 17, 2026 remediation deadline for federal agencies. This incident highlights the growing trend of cryptojacking attacks targeting enterprise backup infrastructure and the challenges of incomplete vulnerability remediation in critical business systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
Financial Services3 weeks ago

AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation

AWS Security Agent, now integrated into AWS Continuum, demonstrated autonomous penetration testing capabilities by successfully exploiting 33 of 37 recently disclosed CVEs in a controlled benchmark environment. The AI-powered agent operated from minimal starting information—just endpoint URLs and single-line hints—to discover vulnerabilities, construct working exploits, and extract hidden flags across diverse software platforms including web frameworks, container registries, ML platforms, and ecommerce stacks. The 89.2% success rate spanned eight vulnerability classes from SQL injection to complex multi-step XSS-to-admin-cookie chains, with some exploits requiring sophisticated chaining of six different attack primitives. Two failures occurred when the agent's aggressive exploitation accidentally destroyed target systems before flag extraction, highlighting the critical need for non-destructive guardrails in autonomous security testing tools. This development represents a significant advancement in AI-driven cybersecurity testing, coinciding with the rapid proliferation of AI agents across enterprise security operations and the growing sophistication of both defensive and offensive AI capabilities in 2025.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack
Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack
Government Administration3 weeks ago

Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack

Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface that enables authenticated attackers to execute arbitrary code with root privileges. The flaw affects PA-Series, VM-Series firewalls and Panorama systems, with active exploitation detected from three IP addresses geolocated in the United States. The company confirmed very limited exploitation targeting management interfaces and released patches across multiple PAN-OS versions, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog requiring federal agencies to patch by October 17, 2026. This incident reflects the continuing trend of threat actors targeting network infrastructure vulnerabilities, particularly management interfaces of critical security appliances, as organizations increasingly rely on firewall technologies for perimeter defense and zero trust architecture implementation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
Government Administration3 weeks ago

CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation

On October 14, 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities include CVE-2026-0322 affecting Palo Alto Networks PAN-OS (code injection), CVE-2026-76519 in Cisco Secure Email Gateway (path traversal), and CVE-2026-105133/105134 targeting Ahsay AhsayCBS backup solutions (authentication bypass and command injection). These vulnerabilities pose significant risks as they grant attackers substantial control over compromised systems, making them priority targets for threat actors. This KEV addition comes amid heightened focus on vulnerability management following BOD 26-04, which establishes risk-based prioritization requirements for federal agencies. The timing reflects ongoing concerns about sophisticated threat actors exploiting unpatched systems for initial access and lateral movement across enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Computer Software/Engineering3 weeks ago

Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks

NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026, to address five critical vulnerabilities affecting installations since May 2005. The flaws include three memory corruption bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that could enable remote code execution, a TLS session forgery vulnerability (CVE-2026-97629) that bypasses client certificate verification, and an HTTP/3 request smuggling issue (CVE-2026-95101). Each vulnerability requires specific configuration directives to exploit, including commonly recommended settings like shared TLS session cache and HTTP/3 support. F5 rates three memory bugs as Critical (9.2 CVSS v4.0), while NGINX considers all five medium severity. This incident highlights ongoing challenges with web infrastructure security, particularly as organizations increasingly rely on reverse proxies and load balancers for cloud-native architectures. The timing coincides with heightened scrutiny of supply chain vulnerabilities and the need for rapid patching cycles in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
Financial Services3 weeks ago

OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation

In April 2024, authorities in North Macedonia dismantled the OLVX cybercrime marketplace and arrested its alleged 20-year-old administrator, identified as 'E.A.' The platform, operational since 2023, generated over $500,000 in sales by offering stolen credentials, personal data, malicious tools, and child sexual abuse material to more than 2,600 registered customers. The FBI provided intelligence support for this joint international operation, marking the first cyber collaboration between the FBI and North Macedonia. Evidence revealed the suspect sold over 1,500 sets of stolen credentials and operated associated Telegram channels facilitating various cybercrime activities including fraudulent refund schemes. This takedown reflects the growing international cooperation needed to combat cybercrime-as-a-service platforms that democratize access to stolen data and attack tools. As these marketplaces continue proliferating and lowering barriers to cybercrime entry, coordinated law enforcement efforts become increasingly critical for disrupting the underground economy fueling data breaches and identity theft.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Information Technology/IT3 weeks ago

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
Government Administration3 weeks ago

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Financial Services3 weeks ago

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Information Technology/IT3 weeks ago

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

The U.S. Department of Justice charged 14 individuals and dismantled over 40 laptop farms across Texas in October 2026, disrupting a North Korean fraudulent IT worker scheme known as Famous Chollima. Operating from 2019 to July 2025, the operation involved North Korean IT workers using stolen U.S. identities to secure remote positions at over 70 American companies, generating approximately $3 million in revenue that was funneled back to the DPRK regime to fund nuclear weapons programs. The scheme utilized U.S.-based facilitators who hosted company laptops and enabled financial transfers, while threat actors employed sophisticated techniques including device hash spoofing and subcontracting work to South Asian and West African freelancers. This incident highlights the evolving sophistication of nation-state actors using social engineering and identity theft to penetrate corporate networks at scale. The case demonstrates how geopolitical adversaries are increasingly leveraging legitimate business processes and remote work infrastructure to circumvent sanctions and fund military programs, making insider threat detection and identity verification critical security priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Financial Services3 weeks ago

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

In October 2026, Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interfaces with a CVSS score of 8.6. The zero-day flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. Limited exploitation has been observed targeting the management interface from three identified IP addresses, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 17, 2026. This incident highlights the growing trend of sophisticated attackers targeting network infrastructure devices to establish persistent access and pivot into internal networks. As organizations increasingly rely on cloud-native architectures and zero-trust frameworks, vulnerabilities in critical security appliances represent high-value targets for threat actors seeking to bypass perimeter defenses and compromise enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Information Technology/IT3 weeks ago

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks. This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports