Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Health Care / Life Sciences

Breach intelligence, attack campaigns, and threat reports targeting the Health Care / Life Sciences sector.

3490 threat reports
Page 95 of 291
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Health Care / Life Sciences Threat Reports

Showing 1129–1140 / 3490 reports
Ubiquiti UniFi OS Vulnerabilities: Immediate Action Required
Higher Education/Acadamia4 months ago

Ubiquiti UniFi OS Vulnerabilities: Immediate Action Required

In July 2026, Ubiquiti disclosed seven critical vulnerabilities in its UniFi OS ecosystem, notably CVE-2026-50746, which allows network-based attackers to execute command injection attacks on devices managing smart building operations. These flaws affect multiple UniFi applications, including Connect, Talk, Access, and Protect, as well as various hardware devices. Exploitation could lead to unauthorized control over critical infrastructure components. The widespread exposure of over 100,000 UniFi OS instances online, particularly in the United States, underscores the urgency for immediate patching. Given the history of Ubiquiti devices being targeted to build botnets, these vulnerabilities present a significant risk to both individual organizations and broader network security.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Mandates Immediate Patching of Critical Adobe ColdFusion Vulnerability CVE-2026-48282
Government Administration4 months ago

CISA Mandates Immediate Patching of Critical Adobe ColdFusion Vulnerability CVE-2026-48282

In early July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability in Adobe ColdFusion, identified as CVE-2026-48282. This path traversal flaw affects versions 2025.9, 2023.20, and earlier, allowing unauthenticated remote attackers to execute arbitrary code on unpatched systems. Adobe released security updates on June 30, 2026, urging immediate deployment due to the high risk of exploitation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-coldfusion-flaw-by-friday/?utm_source=openai)) The urgency of this directive underscores the rapid exploitation of such vulnerabilities by threat actors. Organizations must prioritize timely patching and robust vulnerability management to mitigate risks associated with critical software flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Entra Passkey Enrollment Vishing Targets Microsoft 365 Users
Health Care / Life Sciences4 months ago

Entra Passkey Enrollment Vishing Targets Microsoft 365 Users

In April 2026, a threat actor identified as O-UNC-066, operating under the extortion brand 'Pink,' initiated a vishing campaign targeting Microsoft 365 users across multiple sectors, including food and beverage, technology, healthcare, automotive, construction, and aviation. The attackers impersonated IT personnel, contacting employees by phone and instructing them to enroll a new Microsoft Entra passkey for security purposes. Victims were directed to phishing websites mimicking legitimate Microsoft enrollment portals, where attackers captured credentials and multi-factor authentication (MFA) responses. Subsequently, the attackers registered passkeys under their control, gaining unauthorized access to victims' Microsoft accounts and exfiltrating data from services like SharePoint and OneDrive. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/amp/?utm_source=openai)) This incident underscores a growing trend of sophisticated social engineering attacks exploiting emerging authentication technologies. The use of real-time phishing kits capable of adapting to various MFA methods highlights the evolving tactics of cybercriminals. Organizations must remain vigilant, as such attacks can lead to significant data breaches and financial extortion. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/amp/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Understanding and Mitigating System Prompt Leakage in AI Applications
Financial Services4 months ago

Understanding and Mitigating System Prompt Leakage in AI Applications

In July 2026, AWS Security highlighted the persistent issue of system prompt leakage in generative AI applications. System prompts, which guide the behavior of large language models (LLMs), often contain sensitive information such as role definitions, behavioral guidelines, and API responses. Threat actors can exploit vulnerabilities to extract these prompts, potentially exposing proprietary data and compromising application integrity. Despite various mitigation strategies, complete remediation remains elusive due to inherent limitations in current AI systems. This underscores the need for continuous vigilance and adaptive security measures in AI deployments. The increasing prevalence of system prompt leakage incidents, as noted in the 2025 OWASP LLM Top 10, reflects a broader trend of sophisticated attacks targeting AI systems. Organizations must prioritize robust security frameworks to safeguard against evolving threats in the AI landscape.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Dialogflow CX 'Rogue Agent' Flaw: A Wake-Up Call for AI Security
Financial Services4 months ago

Dialogflow CX 'Rogue Agent' Flaw: A Wake-Up Call for AI Security

In November 2025, Varonis researchers identified a critical vulnerability, termed 'Rogue Agent,' in Google Cloud Platform's Dialogflow CX AI platform. This flaw allowed attackers to exploit the Code Blocks feature by modifying a single permission—dialogflow.playbooks.update—on a Dialogflow agent. Such exploitation enabled the injection of persistent malicious code into the agents' pipeline, facilitating the silent exfiltration of conversations and the execution of large-scale phishing campaigns. Google addressed the issue with an initial patch in April 2026 and fully resolved it by June 2026, ensuring that all affected components were remediated. ([darkreading.com](https://www.darkreading.com/application-security/dialogflow-cx-rogue-agent-flaw-enabled-ai-chatbot-data-theft?utm_source=openai)) The 'Rogue Agent' vulnerability underscores the expanding attack surface introduced by integrating AI services into cloud platforms. It highlights the necessity for organizations to rigorously evaluate and secure their AI infrastructures, as attackers increasingly target these systems to access sensitive data and conduct sophisticated cyber operations. ([varonis.com](https://www.varonis.com/blog/rogue-agent-dialogflow-attack?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Highlights Active Exploitation of Critical Adobe, Joomla, and Langflow Vulnerabilities
Government Administration4 months ago

CISA Highlights Active Exploitation of Critical Adobe, Joomla, and Langflow Vulnerabilities

In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. These include CVE-2026-48282, a path traversal flaw in Adobe ColdFusion; CVE-2026-56290, an improper access control issue in Joomlack Page Builder; CVE-2026-55255, an authorization bypass in Langflow; and CVE-2026-48908, an unrestricted file upload vulnerability in JoomShaper SP Page Builder. Exploitation of these vulnerabilities could lead to arbitrary code execution and unauthorized access, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV catalog underscores the urgency for organizations to apply available patches promptly. The active exploitation of these flaws highlights a trend of attackers rapidly leveraging newly disclosed vulnerabilities, emphasizing the need for vigilant vulnerability management and timely remediation strategies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GhostLock Vulnerability: A 15-Year-Old Flaw Exposing Linux Systems to Root Exploits
Banking/Mortgage4 months ago

GhostLock Vulnerability: A 15-Year-Old Flaw Exposing Linux Systems to Root Exploits

In July 2026, Nebula Security disclosed a critical vulnerability in the Linux kernel, known as GhostLock (CVE-2026-43499). This 15-year-old flaw allows any local user to escalate privileges to root without special permissions or network access. The vulnerability resides in the kernel's real-time mutex (rtmutex) component, where improper handling of task pointers during proxy-lock rollback leads to a use-after-free condition. Exploiting this flaw enables attackers to gain full control over affected systems and escape containerized environments. The issue affects nearly all mainstream Linux distributions since 2011, with a reported 97% exploit reliability. The disclosure of GhostLock underscores the persistent risk posed by longstanding vulnerabilities in widely used open-source software. The availability of public exploit code increases the urgency for organizations to apply patches promptly. This incident highlights the need for continuous monitoring and timely updating of systems to mitigate potential security threats.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Adobe ColdFusion Vulnerability (CVE-2026-48282) Requires Immediate Attention
Computer Software/Engineering4 months ago

Critical Adobe ColdFusion Vulnerability (CVE-2026-48282) Requires Immediate Attention

In June 2026, a critical path traversal vulnerability, identified as CVE-2026-48282, was discovered in Adobe ColdFusion versions 2025.9, 2023.20, and earlier. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected servers without user interaction, potentially leading to full system compromise. The vulnerability arises from improper limitation of a pathname to a restricted directory, enabling attackers to access and manipulate files outside the intended directory structure. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-48282?utm_source=openai)) The inclusion of CVE-2026-48282 in CISA's Known Exploited Vulnerabilities Catalog underscores the urgency for organizations to address this issue promptly. Given the active exploitation in the wild, entities using vulnerable ColdFusion versions must prioritize patching to mitigate the risk of unauthorized access and potential data breaches. ([resecurity.com](https://www.resecurity.com/ar/blog/article/cve-2026-48282-adobe-coldfusion-rds-path-traversal-leading-to-rce?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GitHub's 'Verified' Commits Vulnerable to Hash Malleability
Computer Software/Engineering4 months ago

GitHub's 'Verified' Commits Vulnerable to Hash Malleability

In July 2026, researcher Jacob Ginesin identified a vulnerability in GitHub's commit verification process, revealing that signed Git commits can be altered to produce new hashes without invalidating their signatures. This flaw allows attackers to replicate commits with identical content, authorship, and timestamps, yet different hashes, while still displaying a 'Verified' status on GitHub. Consequently, systems relying on commit hashes for security measures, such as blocklists and provenance logs, are susceptible to evasion tactics. ([thehackernews.com](https://thehackernews.com/2026/07/github-verified-commits-can-be.html?utm_source=openai)) This discovery underscores the critical need for robust verification mechanisms in software development platforms. As supply chain attacks become more sophisticated, ensuring the integrity and authenticity of code commits is paramount to maintaining trust and security in open-source ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
EvilTokens Phishing Campaign: A 2026 Cybersecurity Wake-Up Call
Financial Services4 months ago

EvilTokens Phishing Campaign: A 2026 Cybersecurity Wake-Up Call

In early 2026, the EvilTokens phishing-as-a-service (PhaaS) platform emerged, exploiting the OAuth 2.0 Device Authorization Grant to compromise Microsoft 365 accounts. This sophisticated campaign utilized AI to generate personalized phishing lures, leading to a 1,380% increase in device code phishing attacks between July–December 2025 and January–April 2026. Attackers bypassed multi-factor authentication (MFA) by redirecting legitimate authentication flows, granting them persistent access to corporate email, SharePoint, and OneDrive services. The campaign targeted hundreds of organizations daily, affecting sectors globally. ([huntress.com](https://www.huntress.com/resources/eviltokens-ai-powered-phishing-report?utm_source=openai)) The EvilTokens operation underscores a significant evolution in phishing tactics, leveraging AI to automate and personalize attacks at scale. This trend highlights the urgent need for organizations to reassess and strengthen their security postures, particularly concerning identity and access management, to mitigate the risks posed by increasingly sophisticated phishing campaigns. ([securityboulevard.com](https://securityboulevard.com/2026/07/eviltokens-campaign-reveals-device-code-phishing-ticks-up-1380-powered-by-ai/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
HalluSquatting: Exploiting AI Coding Assistants to Deploy Botnet Malware
Computer Software/Engineering4 months ago

HalluSquatting: Exploiting AI Coding Assistants to Deploy Botnet Malware

In July 2026, researchers identified a novel cyberattack technique termed 'HalluSquatting,' which exploits AI coding assistants' tendency to generate plausible but non-existent resource names. Attackers predict these hallucinated names, register them, and embed malicious code. When users prompt their AI assistants to fetch these resources, the assistants inadvertently execute the malicious code, potentially installing botnet malware on the user's machine. This method leverages AI hallucinations and prompt injections to compromise systems without direct user interaction. The emergence of HalluSquatting underscores the evolving threat landscape in AI-integrated development environments. As AI tools become more prevalent, attackers are increasingly targeting their inherent vulnerabilities. This incident highlights the urgent need for enhanced security measures in AI-driven tools to prevent exploitation through such sophisticated techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Januscape Vulnerability: Critical Linux Kernel Flaw Enables VM Escape
Information Technology/IT4 months ago

Januscape Vulnerability: Critical Linux Kernel Flaw Enables VM Escape

In July 2026, a critical vulnerability known as 'Januscape' (CVE-2026-53359) was disclosed in the Linux kernel's KVM/x86 virtualization component. This 16-year-old flaw allows attackers with root access inside a guest virtual machine to execute arbitrary code on the host, potentially compromising all other guests and the host system itself. The vulnerability arises from a use-after-free issue in the shadow MMU emulation, affecting both Intel and AMD processor architectures. The disclosure of Januscape underscores the persistent risks associated with long-standing vulnerabilities in widely used open-source software. It highlights the necessity for organizations to maintain rigorous patch management practices and to monitor for emerging threats that could exploit such vulnerabilities, especially in multi-tenant cloud environments where the impact can be widespread.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports