Health Care / Life Sciences
Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.
Explore Other Sectors
Health Care / Life Sciences Threat Reports
Proxmox VE Under Attack: Port 8006 Scanning Campaign Targets Virtualization Infrastructure
Following Proxmox's advisory about a vulnerability in older Proxmox VE version 7 systems, security researchers observed a significant increase in scanning activity targeting port 8006 and brute force attacks against the virtualization platform's authentication endpoints. Attackers are exploiting the /api2/json/access/ticket endpoint with credential stuffing attempts and conducting reconnaissance through fingerprinting requests to identify vulnerable Proxmox installations. The vulnerability affects unsupported version 7 installations, creating exposure for organizations running outdated virtualization infrastructure. This activity represents a coordinated effort to identify and compromise virtualization platforms that manage critical infrastructure workloads. The scanning campaign demonstrates how quickly threat actors capitalize on disclosed vulnerabilities, even in end-of-life software versions that organizations may still be running in production environments.
1 week ago
Kill Chain
Critical Security Flaws Expose Healthcare Data Through NextGen Mirth Connect Integration Platform
NextGen Healthcare's Mirth Connect integration platform versions 4.7.1 and earlier contain three critical vulnerabilities disclosed by CISA in September 2026. These include a SQL injection flaw (CVE-2026-82583) allowing authenticated users to execute arbitrary SQL commands through the Database Connector API, and two XML External Entity (XXE) injection vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the XSLT Transformer and XML batch processing components. Successful exploitation could lead to credential disclosure, arbitrary file writes, data exfiltration, and denial-of-service conditions affecting healthcare data integration workflows. These vulnerabilities highlight the growing security risks in healthcare integration platforms as attackers increasingly target healthcare infrastructure. The disclosure comes amid heightened scrutiny of healthcare cybersecurity following recent high-profile attacks on medical systems and the critical role of data integration platforms in healthcare operations.
1 week ago
Kill Chain
Critical Orthanc DICOM Server Vulnerability Threatens Healthcare Imaging Systems
A critical vulnerability (CVE-2026-87020) has been discovered in Orthanc DICOM Server versions prior to 1.13.0, affecting healthcare systems worldwide. The vulnerability stems from an integer overflow in pitch and buffer-size computation that leads to a heap out-of-bounds write when the server processes maliciously crafted PNG or JPEG images. Authenticated remote attackers can exploit this flaw to crash the Orthanc process, causing denial-of-service conditions that disrupt medical imaging operations. The vulnerability has been assigned a CVSS score of 8.1 (High), indicating significant risk to healthcare infrastructure. With medical imaging systems being critical components of healthcare delivery, this vulnerability poses substantial operational risks including disrupted patient care, delayed diagnoses, and potential compliance violations under HIPAA and other healthcare regulations. This vulnerability highlights the growing threat landscape targeting healthcare infrastructure, particularly as medical devices become increasingly connected and digitized. The timing coincides with heightened scrutiny of healthcare cybersecurity following recent high-profile attacks on medical facilities and increased regulatory focus on protecting patient data and ensuring continuity of care.
1 week ago
Kill Chain
Check Point Patches Critical VPN Certificate Vulnerabilities Enabling Unauthenticated RCE
Check Point disclosed two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103) in September 2026, both rated 9.8 CVSS, affecting its Security Gateways and Management Server products. The flaws involve improper VPN certificate validation and a heap-based buffer overflow during ASN.1 certificate decoding, enabling unauthenticated remote code execution under specific conditions. Check Point discovered both vulnerabilities internally with no evidence of active exploitation, and began distributing fixes via Live Patch and Jumbo Hotfix updates on September 9, 2026. These vulnerabilities highlight the ongoing challenge of VPN infrastructure security as organizations continue expanding remote access capabilities. The discovery follows a pattern of critical VPN flaws throughout 2026, emphasizing the need for robust certificate validation mechanisms and proactive patch management in network security appliances.
1 week ago
Kill Chain
Microsoft's 2026 Cloud Web Applications Threat Matrix: Your Complete Defense Guide
Microsoft released a comprehensive Cloud Web Applications Threat Matrix in September 2026, providing security teams with a MITRE ATT&CK-aligned framework to understand and mitigate threats targeting cloud-hosted web applications and serverless platforms. The matrix organizes attack techniques across eleven tactics, from resource development to impact, covering vulnerabilities in application code, managed runtimes, workload identities, deployment pipelines, and connected cloud resources. Key techniques include subdomain takeovers, serverless trigger injection, workload identity credential theft, and denial-of-wallet attacks that exploit cloud scaling mechanisms. This framework addresses the critical visibility gaps that emerge when application-layer and cloud platform security are investigated separately, providing defenders with structured guidance for threat hunting, incident response, and security hardening across Azure, AWS, and GCP environments.
1 week ago
Kill Chain
Storm-3121 Exploits Passkey Trust to Breach Microsoft 365 Environments
In September 2026, Microsoft Security Research documented a sophisticated cloud-based intrusion campaign targeting Microsoft 365 environments through passkey-themed social engineering attacks. Threat actors, including Storm-3121 and Storm-3032, initiated contact via phone calls and SMS messages, directing victims to convincing phishing sites that captured credentials and session tokens through adversary-in-the-middle (AiTM) techniques. Following initial compromise, attackers established persistence by registering unauthorized MFA methods, conducted extensive reconnaissance using Microsoft Graph APIs, and performed high-volume data exfiltration from SharePoint, OneDrive, and Exchange Online repositories over sustained periods spanning hours to days. This campaign represents a significant evolution in identity-focused attacks, demonstrating how threat actors exploit trust in emerging authentication technologies like passkeys to bypass traditional security controls and establish persistent cloud access.
1 week ago
Kill Chain
The Machine With Many Faces: How Attackers Exploit SPIFFE/SPIRE Identity Systems
In September 2026, Palo Alto Networks Unit 42 researchers disclosed a post-exploitation technique targeting SPIFFE/SPIRE identity frameworks in Kubernetes environments. The attack allows threat actors with root access on compromised nodes to manipulate Linux control group (cgroup) metadata, tricking SPIRE agents into issuing legitimate workload identities to attacker-controlled processes. This enables lateral movement through identity impersonation rather than traditional credential theft, bypassing cryptographic protections that secure workload-to-workload communications in cloud-native infrastructures. This research highlights the growing sophistication of identity-focused attacks as organizations adopt zero-trust architectures and workload identity systems. With machine identity becoming the foundation of cloud security, attackers are evolving techniques to exploit the trust assumptions underlying these frameworks, making identity protection a critical battleground in modern cybersecurity.
1 week ago
Kill Chain
Chrome Zero-Day CVE-2026-87491: The Seventh Browser Exploit of 2026
Google patched CVE-2026-87491, a high-severity zero-day vulnerability in Chrome's V8 JavaScript engine that attackers are actively exploiting in the wild. The out-of-bounds write flaw allows remote code execution through crafted HTML pages, enabling attackers to execute arbitrary code within Chrome's sandbox and potentially access sensitive data through heap corruption. This marks the seventh Chrome zero-day patched by Google in 2026, with the vulnerability discovered by a Seoul National University researcher and patches now rolling out globally across Windows, Mac, and Linux systems. The surge in Chrome zero-day exploits reflects the browser's critical role as an attack surface in modern threat landscapes, with nation-state actors and cybercriminals increasingly targeting browser engines to establish initial access for broader campaigns including espionage and ransomware deployment.
1 week ago
Kill Chain
ShieldCrash Zero-Day Exposes Critical Microsoft Defender Bypass
In September 2026, security researcher Nightmare Eclipse disclosed ShieldCrash, a new Microsoft Defender zero-day vulnerability that bypasses the recently patched ShieldBreak flaw (CVE-2026-69414). The exploit grants SYSTEM-level privileges on fully patched Windows 10, Windows 11, and Windows Server systems through arbitrary file read capabilities. This disclosure is part of an ongoing series of zero-day releases by the anonymous researcher, who has published over ten critical Windows and Defender vulnerabilities since April 2026, creating significant security risks for organizations worldwide. This incident highlights the escalating trend of weaponized vulnerability research and the increasing sophistication of privilege escalation attacks targeting endpoint security solutions. As organizations rely heavily on Microsoft Defender for endpoint protection, these recurring bypass techniques demonstrate the critical need for defense-in-depth strategies and zero-trust architectures.
1 week ago
Kill Chain
Account Recovery Becomes the New Attack Path as MFA Strengthens Defenses
Multi-factor authentication has significantly raised the cost of account takeover attacks, forcing threat actors to pivot toward alternative attack vectors. Cybercriminal groups like Scattered Spider are increasingly targeting account recovery processes, using social engineering to manipulate help desk staff into resetting passwords and transferring MFA tokens to attacker-controlled devices. High-profile incidents include the 2025 Marks & Spencer breach, where attackers impersonated an employee to trick a third-party contractor into resetting credentials, ultimately deploying ransomware and causing an estimated £300 million in damages. This trend represents a fundamental shift in attack methodology, where the security of accounts depends less on MFA technology and more on the processes used to reset authentication factors. The emergence of account recovery as a primary attack vector reflects the evolving threat landscape where traditional credential theft methods are becoming less effective. As organizations strengthen their authentication mechanisms with phishing-resistant factors and conditional access controls, attackers are adapting by targeting the human elements of identity management processes.
1 week ago
Kill Chain
Veradigm Breach Exposes Critical Gaps in Healthcare API Security
In September 2026, healthcare technology company Veradigm disclosed a significant data breach affecting 3.5 million patient records after The Gentlemen ransomware group compromised a third-party vendor's credentials. The attackers gained access to a limited Veradigm API interface, exfiltrating personal information including names, addresses, Social Security numbers, and contact details. While clinical data remained secure, the incident exposed critical vulnerabilities in third-party vendor access controls and API security frameworks. This incident highlights the growing threat of supply chain attacks targeting healthcare organizations, coinciding with increased ransomware activity against medical providers and stricter regulatory scrutiny under evolving HIPAA enforcement priorities.
1 week ago
Kill Chain
Critical Bluetooth Flaw Exposes Millions of Skullcandy Dime 3 Users to Device Hijacking
Skullcandy Dime 3 wireless earbuds contain a critical Bluetooth vulnerability (CVE-2025-20701) that allows attackers to hijack devices without user interaction. The flaw exists in the Airoha Bluetooth Audio SDK used by these popular earbuds, enabling nearby attackers to connect without pairing PINs or approval requests. Once connected, attackers can intercept audio, access microphone feeds, and maintain persistent access through automatic reconnection. While Skullcandy released firmware version 1.0.0.30 to address the issue, existing users with vulnerable firmware version 1.0.0.28 have no available update mechanism through the mobile app or other consumer-accessible methods. This incident highlights the growing threat landscape targeting IoT devices and consumer electronics, particularly as Bluetooth-based attacks become more sophisticated and accessible to threat actors seeking to exploit trusted device relationships for surveillance and data collection purposes.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports