Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 5 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 49–60 / 3490 reports
Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk
Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk
Information Technology/IT6 days ago

Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk

In late October 2026, IBM disclosed four vulnerabilities in Langflow, the widely deployed open-source AI agent and workflow builder, affecting every release from version 1.0.0 through 1.12.8. Two of the flaws—CVE-2026-93680 and CVE-2026-110186—carry CVSS scores of 9.8 (Critical) and require no authentication, allowing remote attackers to bypass security controls entirely or execute arbitrary code on the host server. A third flaw enables a low-privileged user to abuse Langflow's Agentic Assistant to run operating system commands server-side. A public Metasploit module already targets the authentication bypass via the Model Context Protocol (MCP) endpoint. The sole remediation is upgrading to Langflow 1.13.0, released October 22, 2026; IBM offers no interim workaround. These vulnerabilities illustrate a fast-maturing AI supply-chain risk: widely adopted open-source AI orchestration frameworks carry the same critical vulnerability classes as traditional enterprise software, yet their security maturity lags significantly. With six prior Langflow CVEs already in CISA's Known Exploited Vulnerabilities catalog and a Metasploit module publicly available within days of disclosure, organizations deploying AI agent infrastructure face immediate, weaponized exploit risk.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
Telecommunications1 week ago

SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text

In October 2026, security researcher Mark Blah disclosed CVE-2026-58882, a zero-click denial-of-service vulnerability in Android's WapPushOverSms.decodeWapPdu function, dubbed 'SMS of Death.' By sending a specially crafted eight-byte WAP Push message to port 2948, an unauthenticated remote attacker can trigger a NegativeArraySizeException that crashes the com.android.phone process, severing cellular connectivity, dropping active calls—including emergency 911 calls—and potentially forcing devices into persistent reboot loops requiring factory resets. Google silently patched Android 14–17 in its October 2026 security bulletin, but Android 12 and 13 devices remain unpatched and exposed. A public proof-of-concept exploit is now available on GitHub, dramatically lowering the barrier to weaponization. The public release of a working PoC elevates this from theoretical risk to active threat. With hundreds of millions of Android 12/13 devices still in circulation globally, enterprises relying on mobile endpoints for authentication, operations, or emergency communications face immediate exposure. The incident highlights the enduring fragility of the Android patch ecosystem, where carrier and OEM delays routinely leave critical vulnerabilities open long after upstream fixes are available.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack
Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack
Government Administration1 week ago

Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack

In late October 2026, a cluster of critical vulnerabilities collectively dubbed 'Black October' shook enterprise and government security teams simultaneously. Threat actors chained PHP2SHELL (CVE affecting ~70% of websites) with a Linux kernel privilege escalation flaw called Fragnesia (CVE-2026-46300) to achieve unauthenticated remote code execution followed by full root access on 25 PAN-OS firewall and management servers across the U.S., Japan, Taiwan, and South Korea—including three U.S. government-affiliated systems. Concurrently, a critical memory corruption flaw in the Brotli decoder (CVE-2026-111497, CVSS 9.2), dubbed Node2Shell, silently fixed upstream months earlier, enabled code execution against Node.js, Python, and .NET runtimes before coordinated public disclosure on October 21, 2026. Black October underscores a dangerous trend: attackers are no longer relying on single-vulnerability exploits but are engineering multi-stage exploit chains that defeat piecemeal patching strategies. The simultaneous targeting of network infrastructure, web runtimes, and supply-chain components signals a maturation in adversarial tradecraft that demands layered, zero-trust network controls beyond endpoint patching alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How a Single ChatGPT Link Could Hand Attackers Your Private Conversations
How a Single ChatGPT Link Could Hand Attackers Your Private Conversations
Information Technology/IT1 week ago

How a Single ChatGPT Link Could Hand Attackers Your Private Conversations

In October 2026, security researchers at Parameter disclosed a critical (P1) vulnerability in ChatGPT's web frontend that allowed a malicious shared-chat link to execute attacker-controlled JavaScript inside a victim's authenticated ChatGPT session. The attack chain exploited three compounding design flaws: the MathLive math library accepted cross-frame postMessages without origin validation, those messages permitted raw HTML as keyboard-layout data, and the injected HTML could spawn an unsandboxed iframe inheriting the chatgpt.com origin. A Content Security Policy bypass via a YouTube-hosted script completed the chain. Victims needed only to open the link and click Preview once—or in a later variant, simply open the link. The attacker's code could enumerate conversations, read private chats, and call any authenticated ChatGPT API on the victim's behalf. OpenAI patched both affected frontend versions by October 26, 2026, and awarded a $5,000 bounty. This incident highlights the compounding risk of feature-rich AI platforms where third-party libraries, relaxed CSP allowlists, and cross-frame messaging intersect. As organizations embed AI assistants into daily workflows and share sensitive conversations, client-side vulnerabilities in AI platforms represent an expanding, high-value attack surface that traditional perimeter controls cannot address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UTA0576 Chains Three Ivanti Connect Secure CVEs for Stealthy Credential Theft and Root Access
UTA0576 Chains Three Ivanti Connect Secure CVEs for Stealthy Credential Theft and Root Access
Government Administration1 week ago

UTA0576 Chains Three Ivanti Connect Secure CVEs for Stealthy Credential Theft and Root Access

In October 2026, a previously undocumented threat actor tracked as UTA0576 chained three Ivanti Connect Secure vulnerabilities—an authentication bypass (CVE-2026-104935), a remote code execution flaw (CVE-2026-118527), and a local privilege escalation bug (CVE-2026-111357)—to achieve unauthenticated root-level code execution on targeted VPN appliances. Unlike typical exploitation campaigns that deploy web shells or ransomware, UTA0576 focused on credential theft and espionage: extracting credentials, harvesting Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys. CISA added two of the three CVEs to its Known Exploited Vulnerabilities catalog, mandating FCEB agency remediation by early November 2026. This campaign underscores a maturing trend of state-linked or espionage-motivated actors chaining multiple lower-severity vulnerabilities into high-impact exploit sequences targeting network edge infrastructure. As VPN appliances remain critical gateways to enterprise environments, the exfiltration of credentials and BitLocker keys signals adversaries are prioritizing persistent, covert access over disruptive attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Help Desk Impersonation to Domain Takeover: Inside the ESC1 and ESC8 AD CS Attack Chain
Help Desk Impersonation to Domain Takeover: Inside the ESC1 and ESC8 AD CS Attack Chain
Government Administration1 week ago

Help Desk Impersonation to Domain Takeover: Inside the ESC1 and ESC8 AD CS Attack Chain

In late October 2026, Microsoft Threat Intelligence documented two human-operated intrusions in which threat actors abused Microsoft Teams to impersonate IT help desk personnel, socially engineering users into granting remote desktop access via Quick Assist. Once inside, attackers staged portable Python, Bun, or Java runtimes, performed host and Active Directory reconnaissance, and exploited misconfigured Active Directory Certificate Services (AD CS) via ESC1 and ESC8 vulnerabilities. In Case 1, ESC1 template abuse yielded certificates for eight privileged accounts, enabling DCSync and subsequent data exfiltration via a renamed Rclone binary. In Case 2, PetitPotam coerced domain-controller NTLM authentication that was relayed to AD CS Web Enrollment (ESC8), converting a workstation foothold into a domain-controller Kerberos identity. These incidents highlight an accelerating pattern of identity-based intrusions that bypass traditional perimeter controls entirely. As organizations expand hybrid and cloud environments, misconfigured certificate infrastructure combined with social-engineering entry vectors represents a critical, underdefended attack surface that incident responders and security architects must prioritize immediately.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes
CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes
Information Technology/IT1 week ago

CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes

In October 2026, security researchers at Anthropic disclosed CVE-2026-98432, a critical use-after-free race condition in the Linux kernel's IPv4 TCP networking stack (CVSS 9.8) affecting kernel versions dating back to 4.4. The flaw is exploitable without authentication and, under conditions where a Multipath TCP (MPTCP) listener is active, enables full remote root code execution. Anthropic demonstrated that an unreleased Claude AI model developed a working exploit in approximately 53 minutes, bypassing KASLR to achieve arbitrary command execution as root. Widely deployed distributions including Ubuntu, RHEL, and Rocky Linux remain unpatched as of disclosure. This incident marks a watershed moment where AI-assisted offensive research accelerated exploit development against a critical infrastructure primitive—the Linux kernel itself. With Go 1.24 silently enabling MPTCP by default, the exposed attack surface is far larger than administrators realize, amplifying urgency across cloud-native, containerized, and hybrid environments running Linux workloads.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-111585: When the Machine You're Helping Attacks You Back
CVE-2026-111585: When the Machine You're Helping Attacks You Back
Information Technology/IT1 week ago

CVE-2026-111585: When the Machine You're Helping Attacks You Back

In October 2026, TeamViewer disclosed CVE-2026-111585, a high-severity vulnerability (CVSS 8.8) affecting the TeamViewer Full Client on Windows, Linux, macOS, the Windows Portable edition, and the Android Remote Control app in all versions prior to 15.83. The flaw inverts the expected attacker-victim relationship: a malicious or compromised host machine can exploit a heap overflow in screen-size negotiation to crash—and on Windows, execute arbitrary code on—the connecting viewer's system. No authentication or additional user interaction beyond accepting the session is required, making exploitation trivially accessible in default configurations. The patch was released on October 29, 2026, with no known in-the-wild exploitation reported at disclosure. This vulnerability is significant because it weaponizes the trusted remote-access workflow itself, turning the helper into the target. As enterprises rely heavily on remote-support tooling for hybrid and distributed workforces, adversaries increasingly abuse or compromise managed endpoints to pivot upstream—making network-layer controls and anomaly detection around remote-access protocols more critical than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Race to Exploit: How Attackers Launched 63,000 WordPress RCE Attempts in Under 24 Hours
Race to Exploit: How Attackers Launched 63,000 WordPress RCE Attempts in Under 24 Hours
Internet1 week ago

Race to Exploit: How Attackers Launched 63,000 WordPress RCE Attempts in Under 24 Hours

On October 28, 2026, WordPress released version 7.1.4 to patch a high-severity unauthenticated remote code execution vulnerability affecting WordPress Core versions 4.7 through 7.1.3 (CVSS 8.1). The flaw stems from predictable, web-accessible staging paths used during full-package core upgrades, allowing attackers to interact with a staged WordPress installer during the brief update window. Within 24 hours of patch release, Wordfence blocked 62,969 exploitation attempts, with multiple threat actors polling vulnerable paths such as setup-config.php for up to 14.5 hours in an effort to win the race condition and achieve server-side PHP code execution. This incident underscores the growing trend of near-instant weaponization of disclosed vulnerabilities, where threat actors reverse-engineer patches within hours and launch coordinated, automated scanning campaigns at scale. The race-condition exploitation pattern and sustained polling behavior reflect increasingly sophisticated attacker automation targeting CMS platforms that underpin millions of business websites globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How
Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How
Information Technology/IT1 week ago

Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How

Beginning in September 2026, an unidentified threat actor launched a credential-phishing campaign impersonating Anthropic, the AI company behind Claude, to steal Google and Microsoft account credentials. Attackers sent emails from a legitimate GoTo Webinar shared address, used Zapier URL shortening to obscure malicious links, and layered two CAPTCHAs—one Cloudflare-based to block automated scanners, one custom-built to filter out VPNs and Tor—to funnel victims to fake Zoom or spoofed Anthropic SSO pages. Despite obvious grammatical errors, typos, and absent brand assets, these emails bypassed Proofpoint SEG and Microsoft Defender for Office 365, underscoring persistent blind spots in perimeter email defenses. This campaign illustrates a widening gap between email security tool coverage and real-world phishing delivery. As threat actors increasingly abuse legitimate SaaS infrastructure and URL obfuscation to evade detection, organizations face mounting pressure to adopt identity-centric, layered defenses—including phishing-resistant MFA, least-privilege access, and domain-validation password managers—rather than relying solely on gateway filtering.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Amatera: The Professionalized Infostealer Dominating Latin America in 2026
Amatera: The Professionalized Infostealer Dominating Latin America in 2026
Financial Services1 week ago

Amatera: The Professionalized Infostealer Dominating Latin America in 2026

Amatera is a sophisticated infostealer malware that emerged as the top infostealer detection in Latin America during the first half of 2026, according to ESET telemetry. The malware is distributed through malvertising campaigns, trojanized software installers, and phishing lures, targeting stored credentials, browser session tokens, cryptocurrency wallets, and sensitive files. Once executed, Amatera exfiltrates harvested data over encrypted channels to attacker-controlled command-and-control infrastructure, demonstrating a highly professionalized cybercrime supply chain model. Its modular architecture and stealth evasion techniques make it difficult to detect with signature-based tools alone, amplifying the risk to enterprise environments across financial services, retail, and healthcare sectors. Amatera exemplifies the growing commoditization of infostealer-as-a-service operations, where low-barrier access to advanced credential-theft tooling enables a broad range of threat actors to conduct high-impact campaigns. The rise of such professionalized malware families mirrors broader trends including the increased targeting of cloud-hosted identities, MFA bypass via stolen session tokens, and downstream ransomware deployment using harvested credentials.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security
Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security
Government Administration1 week ago

Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security

In October 2026, Cisco disclosed an actively exploited zero-day vulnerability (CVE-2026-76418) in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Unauthenticated remote attackers were found sending crafted requests to SSL VPN tunnel groups with secondary authentication configured, triggering logic errors that caused affected firewall devices to reload unexpectedly and enter a denial-of-service (DoS) condition. Cisco's PSIRT confirmed in-the-wild exploitation with no available workaround except disabling secondary authentication or patching immediately. Over 51,000 internet-exposed Cisco ASA SSL VPN devices were identified as potentially vulnerable via Shadowserver telemetry, representing significant operational risk for enterprises dependent on VPN availability. This incident is the latest in a sustained pattern of Cisco network appliance zero-days being weaponized in the wild—following CVE-2025-20362, CVE-2025-20333, and the ArcaneDoor campaign exploiting CVE-2024-20353 and CVE-2024-20359. Perimeter firewall and VPN devices remain high-value targets for nation-state and criminal actors, demanding faster patch cycles, compensating network controls, and reduced reliance on single-layer perimeter defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports