Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 172 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 2053–2064 / 3490 reports
Critical Langflow RCE Vulnerability (CVE-2026-33017) Exploited in the Wild
Computer Software/Engineering7 months ago

Critical Langflow RCE Vulnerability (CVE-2026-33017) Exploited in the Wild

In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-33017, was discovered in Langflow, an open-source framework for building AI workflows. This flaw allows unauthenticated attackers to execute arbitrary Python code on affected servers by sending crafted HTTP requests to the unsandboxed flow execution endpoint. The vulnerability affects Langflow versions 1.8.1 and earlier, potentially leading to full system compromise, data theft, and unauthorized access to sensitive information. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the increasing targeting of AI development tools by threat actors. Organizations utilizing Langflow are urged to upgrade to version 1.9.0 or later, which addresses this security issue. Additionally, it is recommended to disable or restrict access to the vulnerable endpoint, monitor for suspicious activity, and rotate API keys and credentials to mitigate potential risks. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Coruna Exploit Kit: A Cautionary Tale of Advanced Hacking Tools in Cybercriminal Hands
Telecommunications7 months ago

Coruna Exploit Kit: A Cautionary Tale of Advanced Hacking Tools in Cybercriminal Hands

In 2025, the Coruna exploit kit emerged as a sophisticated tool targeting iPhones running iOS versions 13.0 through 17.2.1. Initially deployed by a surveillance vendor for government clients, Coruna was later utilized by Russian espionage groups in attacks against Ukrainian users and by financially motivated hackers in China. The kit comprises five exploit chains and 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606, previously exploited in Operation Triangulation. These vulnerabilities enable remote code execution and privilege escalation, granting attackers full control over affected devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of government-grade hacking tools into the broader cybercriminal ecosystem. This incident highlights the urgent need for organizations to implement robust security measures, promptly apply software updates, and monitor for emerging threats to protect sensitive data and maintain operational integrity. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Understanding the Coruna iOS Exploit Kit: A 2026 Security Threat
Computer Software/Engineering7 months ago

Understanding the Coruna iOS Exploit Kit: A 2026 Security Threat

In early 2026, the Coruna iOS exploit kit emerged as a significant threat, targeting iPhones running iOS versions 13.0 through 17.2.1. This sophisticated toolkit comprises 23 exploits, including zero-day vulnerabilities, enabling attackers to execute zero-click attacks via iMessage. Initially developed for government surveillance, Coruna has since been adopted by cybercriminal groups, leading to widespread data breaches and financial losses. The kit's capabilities allow for full device compromise, granting unauthorized access to sensitive information and enabling remote control of infected devices. The proliferation of Coruna underscores the evolving landscape of mobile threats and the critical need for robust security measures to protect against advanced exploit kits. Organizations and individuals must prioritize timely software updates, implement comprehensive security protocols, and remain vigilant against emerging threats to safeguard their digital assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Anthropic's Claude Chrome Extension Highlights AI Security Risks
Computer Software/Engineering7 months ago

Critical Vulnerability in Anthropic's Claude Chrome Extension Highlights AI Security Risks

In March 2026, a critical vulnerability was discovered in Anthropic's Claude Chrome Extension, allowing malicious actors to inject prompts into the assistant without user interaction. This zero-click cross-site scripting (XSS) flaw enabled attackers to execute arbitrary commands by embedding malicious code into web pages, leading to potential data exfiltration and unauthorized actions. The vulnerability was promptly addressed by Anthropic through an emergency patch, mitigating the risk to users. This incident underscores the growing threat landscape associated with AI-powered browser extensions. As these tools become more integrated into daily workflows, they present new vectors for exploitation. Organizations must remain vigilant, ensuring that such extensions are regularly updated and monitored for security vulnerabilities to prevent similar attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling the Scarlet Goldfinch 2025 ClickFix Malware Campaign
Financial Services7 months ago

Unveiling the Scarlet Goldfinch 2025 ClickFix Malware Campaign

In 2025, the Scarlet Goldfinch threat actor launched a sophisticated malware campaign utilizing the ClickFix social engineering technique. This method deceived users into executing malicious commands under the guise of routine system verifications, leading to the installation of NetSupport Manager, a remote access tool. The campaign primarily targeted Windows systems, exploiting compromised websites to display fake browser update prompts, which, when acted upon, initiated the malware download and execution process. ([redcanary.com](https://redcanary.com/threat-detection-report/threats/scarlet-goldfinch/?utm_source=openai)) The significance of this incident lies in the evolution of social engineering tactics, highlighting the increasing sophistication of threat actors in bypassing traditional security measures. The widespread use of ClickFix underscores the necessity for enhanced user education and the implementation of robust security protocols to mitigate such deceptive attack vectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
OpenCode Systems 2026 Access Control Vulnerability Exposes SMS Messages
Telecommunications7 months ago

OpenCode Systems 2026 Access Control Vulnerability Exposes SMS Messages

In March 2026, a significant security vulnerability (CVE-2025-70614) was identified in OpenCode Systems' OC Messaging and USSD Gateway version 6.32.2. This flaw allowed authenticated users with low privileges to access SMS messages beyond their authorized scope by manipulating company or tenant identifier parameters. The vulnerability posed a substantial risk to data confidentiality across multi-tenant environments. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-70614/?utm_source=openai)) The incident underscores the critical importance of robust access control mechanisms in multi-tenant systems. Organizations are urged to review and strengthen their access control policies to prevent similar vulnerabilities and protect sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Apple's March 2026 Security Update: Essential Patches for Device Protection
Computer Software/Engineering7 months ago

Apple's March 2026 Security Update: Essential Patches for Device Protection

In March 2026, Apple released a comprehensive security update addressing 85 vulnerabilities across its operating systems, including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS. Notably, CVE-2025-43376 allowed remote attackers to view leaked DNS queries with Private Relay enabled, and CVE-2025-43534 permitted physical attackers to bypass Activation Lock on iOS devices. These vulnerabilities, among others, were patched to enhance system security and protect user data. This update underscores the critical importance of timely software updates, as unpatched vulnerabilities can be exploited by attackers to compromise devices and access sensitive information. Organizations and individuals are urged to apply these patches promptly to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Authentication Bypass Vulnerability in TP-Link Routers Exposes Networks to Attack
Telecommunications7 months ago

Critical Authentication Bypass Vulnerability in TP-Link Routers Exposes Networks to Attack

In March 2026, TP-Link disclosed a critical authentication bypass vulnerability (CVE-2026-0834) affecting Archer C20 v6.0 and Archer AX53 v1.0 routers. This flaw resides in the TP-Link Device Debug Protocol (TDDP) module, allowing unauthenticated attackers on the same network to execute administrative commands, such as factory resets and reboots, without credentials. Exploitation of this vulnerability can lead to complete configuration loss and service disruption. This incident underscores the persistent risks associated with network infrastructure vulnerabilities, particularly in consumer-grade routers. The exploitation of such flaws can facilitate broader cyberattacks, including the formation of botnets and unauthorized access to sensitive information. Organizations and individuals must prioritize timely firmware updates and implement robust network security measures to mitigate these risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
TA551 Botnet Manager Sentenced for Ransomware Attacks
Banking/Mortgage7 months ago

TA551 Botnet Manager Sentenced for Ransomware Attacks

In March 2026, Ilya Angelov, a Russian national and co-manager of the cybercriminal group TA551 (also known as Shathak or GOLD CABIN), was sentenced to two years in prison. Angelov's group operated a massive botnet that distributed malware through large-scale phishing campaigns, leading to ransomware attacks on 72 U.S. companies between 2018 and 2019. These attacks resulted in over $14 million in extortion payments. The botnet infected approximately 3,000 computers daily at its peak, facilitating the deployment of ransomware such as BitPaymer. This sentencing underscores the persistent threat posed by sophisticated cybercriminal organizations like TA551, which have been active since at least 2018. Their use of phishing campaigns to distribute malware highlights the critical need for organizations to implement robust email security measures and user awareness training to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Critical Code Injection Vulnerability in Langflow's CSV Agent Node
Computer Software/Engineering7 months ago

Critical Code Injection Vulnerability in Langflow's CSV Agent Node

In February 2026, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2026-27966, was discovered in Langflow, an open-source platform for building AI-powered agents and workflows. This flaw resides in the CSV Agent node, which, prior to version 1.8.0, hardcoded the parameter `allow_dangerous_code=True`, inadvertently exposing LangChain’s Python REPL tool (`python_repl_ast`). This misconfiguration allows unauthenticated attackers to execute arbitrary Python and OS commands on the server via prompt injection, leading to full system compromise. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27966/?utm_source=openai)) The rapid exploitation of this vulnerability underscores the critical need for organizations to promptly address security flaws in AI development tools. As AI platforms become integral to business operations, ensuring their security is paramount to prevent potential data breaches and operational disruptions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Nation-State Exploitation of Internet-Connected Cameras: A 2026 Analysis
Government Administration7 months ago

Nation-State Exploitation of Internet-Connected Cameras: A 2026 Analysis

In early 2026, nation-state actors, notably from Iran and Russia, intensified cyber operations targeting internet-connected surveillance cameras across the Gulf region and Eastern Europe. These actors exploited known vulnerabilities in IP cameras, such as those from Hikvision and Dahua, to gain unauthorized access. This access enabled real-time intelligence gathering, including monitoring military movements and assessing battle damage. The compromised devices were leveraged to support missile targeting and other strategic operations, significantly impacting regional security dynamics. ([asisonline.org](https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/march/camera-compromise-targeting/?utm_source=openai)) This incident underscores a growing trend where nation-states exploit unsecured IoT devices for espionage and military advantage. The proliferation of internet-connected cameras with inadequate security measures presents a substantial risk, highlighting the urgent need for robust cybersecurity practices and regulatory oversight to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Checkmarx 2026 Supply Chain Attack: A Wake-Up Call for CI/CD Security
Computer Software/Engineering7 months ago

Checkmarx 2026 Supply Chain Attack: A Wake-Up Call for CI/CD Security

In March 2026, the threat actor group TeamPCP executed a sophisticated supply chain attack by compromising Checkmarx's GitHub Actions, specifically the 'ast-github-action' repository. The attackers injected credential-stealing malware into all 91 tags of the repository, from v0.1-alpha through v2.3.32, enabling unauthorized access to cloud services, GitHub repositories, and CI/CD pipelines of organizations utilizing these actions. This breach underscores the critical vulnerabilities present in software supply chains and the potential for widespread impact when trusted development tools are compromised. This incident highlights the escalating trend of supply chain attacks targeting development infrastructure, emphasizing the necessity for organizations to implement stringent security measures within their CI/CD pipelines. The event also serves as a reminder of the importance of continuous monitoring and rapid response strategies to mitigate the risks associated with such sophisticated cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports