Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 46 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 541–552 / 3490 reports
Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise
Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise
Financial Services2 months ago

Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise

SAP released critical security updates in September 2026 addressing multiple vulnerabilities, including CVE-2026-44756, a maximum-severity CVSS 10.0 flaw in SAP Extended Passport Processing. Discovered by Onapsis and codenamed OVERPASS, this memory corruption vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands with SAP administrative privileges. The flaw affects SAP kernel code across multiple protocols including web, GUI, and RFC layers, making it reachable through internet-facing components without requiring credentials. Successful exploitation enables complete compromise of SAP business data, lateral movement to connected systems, and manipulation of critical application configurations. This incident highlights the growing threat landscape targeting enterprise resource planning systems as organizations increasingly digitize their core business processes. With SAP systems managing critical financial and operational data for thousands of enterprises globally, kernel-level vulnerabilities represent existential risks that bypass traditional authentication controls and demand immediate remediation efforts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy
ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy
Computer/Network Security2 months ago

ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy

In September 2026, security researcher Chaotic Eclipse demonstrated a critical patch bypass vulnerability dubbed 'ShieldCrash' affecting Microsoft Defender's Malware Protection Engine. This zero-day exploit bypasses the incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read operations with SYSTEM privileges on all supported Windows versions. Despite Microsoft's August 2026 patch addressing the original ShieldBreak vulnerability, the researcher revealed that specific attack vectors remained unpatched, enabling continued exploitation of the same underlying security flaw through alternative code paths. This incident highlights the growing trend of researchers discovering incomplete security patches in enterprise endpoint protection platforms, with similar vulnerabilities recently disclosed in CrowdStrike Falcon, Kaspersky, and Avast products, demonstrating systemic challenges in comprehensive vulnerability remediation across the cybersecurity industry.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection
F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection
Financial Services2 months ago

F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection

A sophisticated malware campaign targeting F5 BIG-IP Access Policy Manager appliances exploits CVE-2025-53521 to inject PHP web shells directly into memory rather than storing them on disk. The malware, tracked as c05d5254 and PoisonedRefresh, hooks Apache functions to modify three specific PHP scripts in memory when loaded, enabling command execution through normal web requests while evading traditional file-based detection. The attack chain begins with exploitation of the critical remote code execution vulnerability (CVSS 9.8) and establishes persistence through infected system binaries and installation media. This incident highlights the evolution of fileless malware techniques and the growing sophistication of infrastructure-focused attacks. As organizations increasingly rely on application delivery controllers and load balancers for critical services, attackers are developing advanced evasion techniques that challenge traditional security monitoring approaches, making network-level visibility and behavioral analysis essential for detection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise
Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise
Banking/Mortgage2 months ago

Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise

In September 2026, Google patched CVE-2026-87491, an actively exploited zero-day vulnerability in Chrome's V8 JavaScript engine that allowed remote code execution within the browser sandbox. The out-of-bounds write flaw enabled attackers to execute arbitrary code through crafted HTML pages, representing the seventh Chrome zero-day exploited in the wild during 2026. Google acknowledged active exploitation but withheld details about the attack methods and threat actors to protect users during the patch deployment phase. This incident highlights the persistent targeting of browser engines by sophisticated threat actors who continue developing novel exploitation techniques against widely-used platforms. The frequency of Chrome zero-days in 2026 demonstrates an escalation in browser-based attacks as threat actors adapt to improved endpoint security measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083
CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083
Health Care / Life Sciences2 months ago

CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083

CISA disclosed CVE-2026-85083, a critical vulnerability in CareCam Pro IP cameras (model ANJIA AJL33PC0801) that exposes hard-coded credentials in the bootloader authentication system. Attackers with physical access can exploit this weakness to gain privileged bootloader access, enabling unauthorized firmware modification and complete device compromise. The vulnerability affects devices deployed worldwide across commercial facilities, with CareCam reportedly unresponsive to coordination efforts from CISA. This incident highlights the persistent security challenges in IoT infrastructure where manufacturers continue to implement insecure authentication mechanisms. As organizations increasingly rely on IP cameras for security monitoring and operational visibility, such fundamental design flaws create significant attack surface expansion and compliance risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks
Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks
Computer Software/Engineering2 months ago

Critical AI Security Gap: DeepSeek Harness Sandbox Escape Exposes Autonomous Agent Risks

In August 2026, a critical vulnerability (CVE-2026-82533) was discovered in DeepSeek Harness, an open-source AI coding agent tool with over 216,000 GitHub stars. The flaw allowed sandboxed AI agents to disable their own security sandbox through a single command, bypassing file system protections designed to prevent untrusted code execution. Attackers could exploit this by supplying malicious text that prompted the agent to call the tool's local web interface, switching to 'danger-full-access' mode without approval prompts. The vulnerability stemmed from inadequate authentication on the local interface and improper host header validation, enabling both local sandbox escapes and potential remote exploitation through port forwarding. This incident highlights the growing security challenges in AI development tools as organizations increasingly adopt autonomous coding agents. The vulnerability demonstrates how AI agents can be manipulated to bypass their own safety mechanisms, representing a new class of security risks in the rapidly expanding AI development ecosystem.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection
Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection
Computer Software/Engineering2 months ago

Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection

In August 2026, cybersecurity researchers analyzed a 7GB infostealer dump containing data from 5,871 infected machines across 162 countries, revealing thousands of unexpired authentication tokens for AI services including Google, OpenAI, Anthropic, and others. Information stealers like Lumma Stealer and Vidar harvested session tokens, API keys, and JSON Web Tokens (JWTs) that threat actors can replay to bypass credential-based authentication and multi-factor authentication, effectively gaining unauthorized access to premium AI services without traditional login processes. The stolen data included 555 AI-related JWTs and 2,937 encrypted tokens, with 17.7% containing plaintext personally identifiable information, enabling account takeovers, resource theft, and unauthorized AI service usage sold on underground markets. This incident highlights the growing cybercriminal focus on AI credential theft as premium model access costs create strong financial incentives for stealing rather than purchasing legitimate access, while the proliferation of anti-detect browsers and session replay tools makes monetizing these stolen tokens increasingly accessible to threat actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era
Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era
Information Technology/IT2 months ago

Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era

Microsoft released its largest-ever Patch Tuesday update in September 2026, addressing 974 vulnerabilities across its product suite, including two actively exploited zero-day vulnerabilities. The massive security update included CVE-2026-81963 affecting the Windows Update Stack and CVE-2026-85880 affecting Windows Advanced Local Procedure Call, both enabling privilege escalation attacks. Microsoft's use of AI-assisted vulnerability discovery has dramatically increased the volume of disclosed vulnerabilities, with over 100 rated as critical across Windows, Office, SQL Server, and developer tools. Despite the record-breaking number of vulnerabilities, security researchers noted that active exploitation rates have not increased proportionally. This incident highlights the growing challenge organizations face in vulnerability management as AI-driven discovery tools uncover more security flaws at an unprecedented pace. The massive patch volume reflects broader industry trends where automated security research is creating larger attack surfaces while simultaneously improving defensive capabilities through faster identification of potential weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched
Government Administration2 months ago

Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched

Microsoft released Windows 10 KB5122878 as part of the September 2026 extended security update program, addressing a record-breaking 966 vulnerabilities including two actively exploited zero-day flaws. This update targets Windows 10 Enterprise LTSC users and ESU program participants, bringing systems to build 19045.7725 with critical security patches, Secure Boot certificate improvements, and fixes for Remote Desktop audio redirection issues. The massive patch release underscores the ongoing security challenges facing legacy Windows environments as Microsoft phases out mainstream support. This update highlights the critical importance of extended security programs as organizations struggle to migrate from Windows 10 amid escalating cyber threats and the growing attack surface of unpatched legacy systems.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure
PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure
Financial Services2 months ago

PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure

In September 2026, security researchers discovered a sophisticated Linux rootkit campaign targeting F5 BIG-IP APM devices. Attackers exploited CVE-2025-53521, a critical remote code execution vulnerability, to deploy the 'PoisonedRefresh' rootkit that injects fileless web shells directly into memory. The malware intercepts PHP file operations, modifies scripts in memory without altering disk files, and creates password-protected backdoors while maintaining persistence across system upgrades. This advanced attack demonstrates the evolution of infrastructure targeting, as threat actors increasingly focus on critical network appliances that provide extensive access to organizational traffic and systems. With 795 vulnerable endpoints still exposed online, this incident highlights the urgent need for robust patch management and enhanced monitoring of network infrastructure devices.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
ClickFix Campaigns Weaponize Trust: How Attackers Abuse Legitimate Services
ClickFix Campaigns Weaponize Trust: How Attackers Abuse Legitimate Services
Financial Services2 months ago

ClickFix Campaigns Weaponize Trust: How Attackers Abuse Legitimate Services

ClickFix campaigns represent a sophisticated social engineering attack vector where threat actors disguise malicious PowerShell scripts as legitimate software fixes or updates. These campaigns typically begin with phishing emails or compromised websites that present users with fake error messages, prompting them to copy and execute PowerShell commands that appear to resolve technical issues. The attacks leverage trusted platforms like GitHub, Discord, and legitimate cloud services to host malicious payloads, making detection more challenging for traditional security tools. Once executed, the malicious scripts establish persistent access through various techniques including scheduled tasks, registry modifications, and deployment of remote access tools, allowing attackers to maintain long-term presence in compromised environments. ClickFix campaigns have gained significant traction in 2024 as organizations increasingly adopt cloud-first strategies and remote work models, creating expanded attack surfaces that threat actors exploit through social engineering rather than traditional technical vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy
Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy
Computer Software/Engineering2 months ago

Grindr's £26 Million Settlement Exposes Critical Gaps in Dating App Data Privacy

In September 2026, Grindr agreed to pay £26 million ($35.1 million) to settle a U.K. class action lawsuit involving over 10,000 users whose sensitive personal data, including HIV status, was shared with third-party advertising companies Apptimize and Localytics between 2018-2020. The incident, originally exposed by Norwegian research group SINTEF in April 2018, occurred while Grindr was owned by Chinese gaming company Kunlun, before its 2020 acquisition by San Vicente Acquisition LLC. The settlement covers historical data practices that violated U.K. privacy laws through unauthorized sharing of location data, sexual orientation, and medical information for commercial advertising purposes. This incident highlights the ongoing regulatory scrutiny of data privacy violations in dating apps and social platforms, particularly as GDPR enforcement intensifies and class action lawsuits become more prevalent in addressing historical privacy breaches involving sensitive personal information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports