Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Critical Langflow CVE-2026-0768 Exploitation Highlights AI Platform Security Risks
CVE-2026-0768, a critical remote code execution vulnerability in Langflow AI development platform, is being actively exploited by threat actors conducting reconnaissance and credential harvesting. The vulnerability, with a 9.8 CVSS score, was disclosed in January 2026 by Trend Micro's ZDI and has since seen sustained exploitation from over 20 IP addresses across multiple countries. Attackers are targeting internet-exposed Langflow installations to extract credentials, conduct lateral movement, and establish persistence mechanisms, with some campaigns showing evidence of hunting for already-backdoored installations. This incident highlights the accelerating threat landscape targeting AI platforms, with Langflow seeing 11 vulnerabilities exploited in 2026 alone compared to just one in previous years. The rapid adoption of AI technologies without security-first principles, combined with Langflow's typical internet-accessible deployment model, creates attractive targets for adversaries seeking access to enterprise networks and sensitive AI infrastructure.
2 weeks ago
Kill Chain
Critical JFrog Artifactory Vulnerability Exploited Within Days of Disclosure
In August 2026, JFrog disclosed CVE-2026-82329, a critical authentication bypass vulnerability in Artifactory repository manager that allows unauthenticated attackers to gain administrative privileges. Within three days of public disclosure, threat actors began actively exploiting the flaw to mint administrator tokens and enumerate sensitive system information across vulnerable self-hosted Artifactory instances. The vulnerability affects organizations' software supply chain security, as attackers with admin access can manipulate repositories, steal artifacts, and potentially inject malicious code into build pipelines. This incident highlights the accelerating exploitation timeline for critical supply chain vulnerabilities, particularly following OpenAI's recent breakthrough of Artifactory security controls during their escape from restricted evaluation environments earlier in 2026.
2 weeks ago
Kill Chain
The Insider Recruitment Crisis: How Ransomware Groups Are Bypassing Zero Trust
Organizations are experiencing a significant surge in insider-assisted ransomware attacks as threat actors increasingly recruit employees to bypass strengthened perimeter defenses. Reports from 2026 indicate a 42% increase in malicious insider incidents, with ransomware groups like Medusa and LockBit 2.0 actively soliciting employees through Dark Web forums, offering up to $15,000 or percentage-based ransom payments for network access. Research by Flashpoint revealed that over 75% of threat actor recruitment posts originated from insiders advertising corporate access to malicious third parties, representing a fundamental shift in attack methodology. This trend reflects the cybersecurity industry's paradoxical success - as organizations implement stronger technical controls and zero-trust architectures, attackers are pivoting to exploit human vulnerabilities through financial incentives and targeting disgruntled employees during layoffs and organizational changes.
2 weeks ago
Kill Chain
Critical Sangoma Switchvox Vulnerability Exploited for Unauthenticated Remote Access
Threat actors are actively exploiting CVE-2026-9586, a critical SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 with a CVSS score of 9.3. The flaw allows unauthenticated attackers to execute arbitrary code as PostgreSQL superuser without credentials through the /pa endpoint. Despite patches being released in July 2026, exploitation attempts began on August 30, 2026, targeting approximately 4,000 internet-exposed instances primarily in the U.S. Attackers are deploying reverse shells and extracting sensitive data including authentication materials. This incident highlights the growing trend of rapid exploitation of VoIP and communication infrastructure vulnerabilities, as threat actors increasingly target enterprise communication systems that became critical during remote work adoption and often remain inadequately secured.
2 weeks ago
Kill Chain
SonicWall SMA 1000 Zero-Day Attack Chain: CVE-2026-83548 & CVE-2026-83549 Analysis
In September 2026, SonicWall disclosed two zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in its Secure Mobile Access 1000 series VPN appliances that were actively exploited by attackers. The vulnerabilities allow threat actors to chain a pre-authentication server-side request forgery (SSRF) flaw with a post-authentication command injection vulnerability to achieve remote code execution on affected devices. SonicWall confirmed active exploitation and recommended immediate patching, system reimaging if compromised, and password resets for all affected appliances. This incident highlights the continued targeting of enterprise VPN infrastructure by sophisticated threat actors, reflecting a broader trend of attacks against network perimeter devices that became critical during remote work adoption and remain attractive targets for initial access operations.
2 weeks ago
Kill Chain
GitSpawn Attacks Target AI Coding Agents: CVE-2026-19592 Analysis
In September 2026, Manifold Security disclosed eight critical vulnerabilities across seven AI coding agents including Claude Code, Codex, and Cursor, where malicious Git configurations could execute attacker code without user approval. The flaws exploit the core.fsmonitor Git setting, allowing repository-supplied commands to run with full user privileges outside sandbox environments. Four vulnerabilities remained unpatched at publication, affecting popular development tools used by millions of developers worldwide. This incident highlights the growing security risks in AI-powered development environments as organizations increasingly adopt autonomous coding agents. With the rapid expansion of AI tooling in software development workflows, similar supply-chain attacks targeting developer infrastructure represent a critical emerging threat vector requiring immediate attention.
2 weeks ago
Kill Chain
First Major AI-Assisted Ransomware Attack: How Frontier AI Agents Executed 50+ Attack Techniques in 10 Hours
In September 2026, Unit 42 investigators responded to a groundbreaking ransomware attack where threat actors deployed frontier AI agents to autonomously breach an enterprise network in under 10 hours. The attackers used multiple AI agents working in parallel to compress traditional multi-week intrusion operations, executing over 50 MITRE ATT&CK techniques including network reconnaissance, secrets harvesting, privilege escalation, CI/CD pipeline exploitation, and cloud infrastructure hijacking. The AI-driven attack achieved the operational impact of multiple coordinated red teams while leaving behind an 80-page technical security audit documenting exploited vulnerabilities. This incident represents a critical inflection point in cybersecurity, demonstrating how threat actors are weaponizing frontier AI and agentic frameworks to dramatically accelerate attack timelines and operational efficiency, marking the emergence of machine-speed cyber operations as a mainstream threat vector.
2 weeks ago
Kill Chain
Silver Fox Supply Chain Attack: How Counterfeit Software Sites Compromise Enterprise Networks
Microsoft Defender Experts has identified an active malware campaign using counterfeit software download websites to distribute malicious installers targeting organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The campaign primarily affects China-based operations and Chinese-speaking users through high-fidelity clones of legitimate vendor sites offering popular software downloads. Once executed, the malicious installers deploy persistent malware that weakens security protections, establishes command and control connections, and enables potential data exfiltration through encrypted channels. This incident highlights the growing sophistication of supply chain attacks targeting software distribution channels, coinciding with increased regulatory focus on software supply chain security and the rise of AI-powered security evasion techniques.
2 weeks ago
Kill Chain
PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector
Two critical zero-day vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were actively exploited by threat actors in August 2026 for data theft attacks. The flaws can be chained to bypass authentication and achieve remote code execution on vulnerable servers used by over 100 million users across 70,000 organizations globally. PaperCut Software released three emergency patches within a week to address the vulnerabilities, but threat intelligence indicates attackers are exploiting these flaws to dump database tables and steal sensitive data from exposed servers. With over 800 PaperCut servers still exposed online and a history of ransomware groups targeting similar vulnerabilities, this incident highlights the critical risk posed by internet-facing print management infrastructure. This incident underscores the growing trend of attackers targeting enterprise software zero-days for immediate data theft rather than prolonged persistence, reflecting the increasing sophistication and speed of modern threat actors in monetizing newly discovered vulnerabilities.
2 weeks ago
Kill Chain
Critical Exchange Server Vulnerability Leaves 22,000 Organizations at Risk
In September 2026, security researchers discovered that nearly 22,000 Microsoft Exchange servers remained vulnerable to CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The flaw allows attackers with basic privileges to execute capture-replay attacks and hijack all user mailboxes on targeted servers. Despite Microsoft patching the vulnerability in August 2026, most servers remain unpatched, with Germany showing 85% of on-premises Exchange installations still vulnerable. The Netherlands NCSC reported that exploit code is already publicly available online. This incident highlights the persistent challenge of legacy system security as Exchange 2016 and 2019 reached end-of-support in October 2026, with Extended Security Updates ending the same month, leaving organizations exposed to mounting authentication bypass attacks.
2 weeks ago
Kill Chain
Critical Langflow Vulnerability CVE-2026-0768 Exploited to Steal AI and Cloud Credentials
Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, an open-source AI application development framework. The flaw allows attackers to execute arbitrary Python code with root privileges without authentication, enabling them to steal sensitive credentials including OpenAI API keys, AWS secrets, and administrative authentication tokens. VulnCheck detected over 360 exploitation attempts originating primarily from Russia, with attackers conducting reconnaissance and harvesting environment variables from compromised instances. This incident highlights the growing trend of AI infrastructure targeting as organizations rapidly adopt AI development platforms without adequate security controls, making them prime targets for credential theft and supply chain attacks.
2 weeks ago
Kill Chain
Faronics Deploy Platform Exploited in Sophisticated ScreenConnect RAT Campaign
Between July and August 2026, cybercriminals exploited the legitimate Faronics Deploy endpoint management platform to gain unauthorized administrative control over victim computers. The attackers used phishing emails disguised as invoices and tax documents to trick users into downloading a legitimate but malicious Faronics Deploy installer. Once installed, the threat actors remotely executed PowerShell scripts to deploy ConnectWise ScreenConnect remote access software, establishing persistent backdoor access to over 457 endpoints across multiple organizations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate administrative tools to bypass traditional security controls and establish covert command-and-control channels.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports