Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 92 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1093–1104 / 3490 reports
Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials
Computer Software/Engineering3 months ago

Urgent Alert: Widespread Scanning Targets MCP Servers and AI Assistant Credentials

In July 2026, security researchers identified a widespread scanning campaign targeting Model Context Protocol (MCP) servers and AI assistant credential files. Attackers systematically probed internet-facing systems for exposed MCP endpoints and configuration files associated with AI development tools, aiming to exploit misconfigurations and gain unauthorized access. This reconnaissance activity underscores the critical need for organizations to secure their AI infrastructure against emerging threats. The incident highlights a growing trend of attackers focusing on AI-related assets, exploiting the rapid adoption of AI technologies and potential security oversights. Organizations must proactively implement robust security measures to protect sensitive AI systems and data from evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
jscrambler npm Package Compromise: A Wake-Up Call for Developer Security
Computer Software/Engineering4 months ago

jscrambler npm Package Compromise: A Wake-Up Call for Developer Security

On July 11, 2026, the jscrambler npm package version 8.14.0 was compromised, introducing a preinstall hook that deployed a Rust-based infostealer upon installation. This malicious code targeted developer environments across Windows, macOS, and Linux platforms, exfiltrating sensitive data such as cloud credentials, cryptocurrency wallets, password manager vaults, and session tokens for various applications. The attack was identified within minutes of the release, but the exact number of affected systems remains undetermined. This incident underscores the escalating threat of supply chain attacks within the software development ecosystem. The rapid detection highlights the importance of vigilant monitoring and swift response mechanisms. Organizations must prioritize securing their development pipelines and implement robust verification processes to mitigate the risks associated with third-party dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Government Administration4 months ago

CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog

On July 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-48939 and CVE-2026-56291. CVE-2026-48939 is a critical remote code execution vulnerability in the iCagenda extension for Joomla, allowing unauthenticated attackers to upload and execute arbitrary PHP files on the server. CVE-2026-56291 pertains to the Balbooa Forms extension, enabling similar unauthorized file uploads leading to potential server compromise. Both vulnerabilities have been actively exploited in the wild, posing significant risks to organizations using these Joomla extensions. The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software components in widely used content management systems. Organizations are urged to prioritize the remediation of these vulnerabilities to prevent potential data breaches and system compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Zimbra Stored XSS Vulnerability Discovered
Financial Services4 months ago

Critical Zimbra Stored XSS Vulnerability Discovered

In July 2026, Zimbra disclosed a critical stored cross-site scripting (XSS) vulnerability in its Classic Web Client, allowing attackers to execute arbitrary JavaScript by sending specially crafted emails. This flaw could lead to unauthorized access to mailbox information, session data, or account settings. Zimbra has released updates to address this issue and urges users to upgrade to version 10.1.19 for optimal protection. This incident underscores the persistent threat of XSS vulnerabilities in web applications, emphasizing the need for continuous security assessments and prompt patch management to mitigate potential exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Critical Bluetooth Low Energy Vulnerabilities in 2026
Health Care / Life Sciences4 months ago

Unveiling Critical Bluetooth Low Energy Vulnerabilities in 2026

In recent years, multiple critical vulnerabilities have been identified in Bluetooth Low Energy (BLE) implementations across various devices, including medical equipment, consumer electronics, and IoT devices. Notable among these are the SweynTooth vulnerabilities, which allow unauthorized users to crash devices, stop their functionality, or access device features without proper authentication. Additionally, the BLURtooth vulnerability exploits weaknesses in Cross-Transport Key Derivation, enabling attackers to escalate access between Bluetooth Classic and BLE transports. These vulnerabilities have been documented in devices from manufacturers such as Texas Instruments, NXP Semiconductors, and Microchip Technology. ([fda.gov](https://www.fda.gov/news-events/press-announcements/fda-informs-patients-providers-and-manufacturers-about-potential-cybersecurity-vulnerabilities-0?utm_source=openai)) The prevalence of these vulnerabilities underscores the urgent need for robust security measures in BLE implementations. As BLE technology becomes increasingly integral to critical applications, including medical devices and smart home systems, ensuring the security of these devices is paramount to prevent potential exploitation by malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Wireshark 4.6.7: Critical Security Updates Released
Computer/Network Security4 months ago

Wireshark 4.6.7: Critical Security Updates Released

On July 8, 2026, Wireshark released version 4.6.7, addressing twelve security vulnerabilities across various protocol dissectors and file parsers. These flaws, present in versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16, could allow attackers to crash the application or consume excessive CPU resources by injecting malformed packets or convincing users to open crafted packet trace files. Affected components include Catapult DCT2000, SSH, IEEE 802.11, Z39.50, UMTS FP, pcapng file reader, and DBS Etherwatch file parser. ([wireshark.org](https://www.wireshark.org/news/20260708.html?utm_source=openai)) This release underscores the importance of promptly updating network analysis tools to mitigate potential security risks. The vulnerabilities highlight the need for continuous vigilance in monitoring and updating software to protect against emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Squidbleed Vulnerability: A 29-Year-Old Flaw Exposing Sensitive Data in Squid Proxy
Information Technology/IT4 months ago

Squidbleed Vulnerability: A 29-Year-Old Flaw Exposing Sensitive Data in Squid Proxy

In June 2026, security researchers disclosed 'Squidbleed' (CVE-2026-47729), a critical vulnerability in the Squid web proxy that had existed since 1997. This flaw, stemming from an out-of-bounds read in Squid's FTP gateway parser, allows attackers controlling an FTP server to leak sensitive data, including HTTP requests and authentication headers, from users sharing the same proxy. The vulnerability affects all versions of Squid in their default configurations and is particularly concerning in shared environments like corporate networks and public Wi-Fi hotspots. ([hivepro.com](https://www.hivepro.com/threat-advisory/squidbleed-decades-old-parser-flaw-exposes-sensitive-proxy-data?utm_source=openai)) The discovery of Squidbleed underscores the persistent risks posed by legacy code in widely used software. It highlights the necessity for organizations to regularly audit and update their systems to mitigate potential security threats that may have been lurking undetected for decades. ([securityweek.com](https://www.securityweek.com/decades-old-squid-proxy-flaw-squidbleed-can-expose-user-data/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Armenian National Pleads Guilty to Ryuk Ransomware Attacks
Health Care / Life Sciences4 months ago

Armenian National Pleads Guilty to Ryuk Ransomware Attacks

In July 2026, Armenian national Karen Serobovich Vardanyan pleaded guilty to charges of conspiracy and computer fraud for his involvement in deploying Ryuk ransomware against multiple U.S. organizations between November 2019 and April 2020. Operating from Ukraine and Russia, Vardanyan and his co-conspirators infiltrated the networks of a Michigan-based company, an Oregon technology firm, and a Texas school, encrypting critical data and demanding ransom payments in Bitcoin. The Michigan company paid nearly $1.2 million to regain access to its systems. Vardanyan faces up to 15 years in prison and has agreed to pay restitution of approximately $1.2 million. ([justice.gov](https://www.justice.gov/usao-or/pr/armenian-national-extradited-united-states-pleads-guilty-ransomware-extortion-conspiracy?utm_source=openai)) This case underscores the persistent threat posed by sophisticated ransomware operations like Ryuk, which have targeted various sectors, including healthcare, education, and critical infrastructure. The successful extradition and prosecution of Vardanyan highlight the importance of international cooperation in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against evolving ransomware tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Stored XSS Vulnerability in Zimbra's Briefcase Feature: CVE-2026-33370
Government Administration4 months ago

Critical Stored XSS Vulnerability in Zimbra's Briefcase Feature: CVE-2026-33370

In March 2026, a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-33370, was discovered in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. This flaw resided in the Briefcase feature, where insufficient sanitization of specific uploaded file types allowed attackers to embed malicious JavaScript. When users accessed these compromised files, the scripts executed within their session context, potentially leading to data exfiltration or unauthorized actions. Zimbra promptly addressed this issue by releasing version 10.1.19, urging all users to update their systems to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2026-33370?utm_source=openai)) The discovery of CVE-2026-33370 underscores the persistent threat posed by XSS vulnerabilities in widely used collaboration platforms. Given Zimbra's extensive user base, including numerous businesses and government agencies, timely patching is crucial to prevent potential exploitation. This incident highlights the importance of regular security assessments and prompt software updates to safeguard sensitive information.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Insider Threats: Cybersecurity Experts Turned Cybercriminals
Computer/Network Security4 months ago

Insider Threats: Cybersecurity Experts Turned Cybercriminals

In 2023, three U.S. cybersecurity professionals—Ryan Goldberg, Kevin Martin, and Angelo Martino—exploited their insider knowledge to conduct ransomware attacks using the ALPHV/BlackCat variant. Operating between April and December, they targeted multiple organizations, including a medical device company, a pharmaceutical firm, and a drone manufacturer. The trio encrypted victims' data and demanded substantial cryptocurrency ransoms, successfully extorting approximately $1.2 million from one victim. Their actions culminated in guilty pleas and subsequent prison sentences of four years each. ([justice.gov](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores a disturbing trend where trusted insiders leverage their positions for malicious gain, highlighting the critical need for robust internal security measures and continuous monitoring to detect and prevent such insider threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Progress ShareFile SZC Vulnerabilities: A 2026 Security Wake-Up Call
Financial Services4 months ago

Progress ShareFile SZC Vulnerabilities: A 2026 Security Wake-Up Call

In April 2026, critical vulnerabilities were discovered in Progress Software's ShareFile Storage Zones Controller (SZC), specifically CVE-2026-2699 and CVE-2026-2701. These flaws allowed unauthenticated attackers to access restricted configuration pages and execute arbitrary code on affected systems. Despite the release of patches in March 2026, by July 2026, credible external threats targeting unpatched SZC instances prompted Progress to advise customers to immediately shut down their servers to prevent potential data breaches. This incident underscores the persistent risks associated with unpatched software vulnerabilities, especially in widely used enterprise solutions. Organizations are reminded of the importance of timely patch management and proactive security measures to mitigate evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical Authentication Bypass in Gitea Docker Image (CVE-2026-20896)
Computer Software/Engineering4 months ago

Critical Authentication Bypass in Gitea Docker Image (CVE-2026-20896)

In July 2026, a critical authentication bypass vulnerability, CVE-2026-20896, was discovered in Gitea's official Docker image versions up to and including 1.26.2. This flaw allowed unauthenticated attackers to impersonate any user, including administrators, by exploiting a default configuration that trusted reverse-proxy authentication headers from any source IP address. Exploitation began less than two weeks before public disclosure, with approximately 6,200 Gitea instances exposed on the public web. Successful exploitation granted attackers full access to repositories, CI/CD secrets, and administrative functions, posing significant risks to organizations relying on Gitea for source code management. The rapid exploitation of CVE-2026-20896 underscores the critical importance of promptly addressing default configuration vulnerabilities in widely used open-source tools. Organizations must remain vigilant, ensuring that default settings are reviewed and adjusted to align with security best practices to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports