✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Higher Education/Acadamia
Breach intelligence, attack campaigns, and threat reports targeting the Higher Education/Acadamia sector.
Explore Other Sectors
Higher Education/Acadamia Threat Reports
Critical Vulnerability in KnowledgeDeliver LMS Exploited to Deploy Malicious Payloads
In early 2026, a critical vulnerability (CVE-2026-5426) in Digital Knowledge's KnowledgeDeliver Learning Management System (LMS) was exploited by threat actors to deploy the Godzilla web shell and Cobalt Strike Beacon. The flaw, stemming from hard-coded ASP.NET machine keys, allowed unauthenticated remote code execution via malicious ViewState deserialization. This exploitation led to unauthorized access and potential data breaches in affected systems. The incident underscores the risks associated with default configurations and hard-coded cryptographic keys in software deployments. Organizations are urged to review and update their security practices to mitigate similar vulnerabilities, especially in widely used platforms like LMSs.
2 months ago
Kill Chain
Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659
In May 2026, Microsoft addressed a critical remote code execution vulnerability, CVE-2026-45659, in SharePoint Server versions 2016, 2019, and Subscription Edition. This flaw arises from the deserialization of untrusted data, allowing authenticated attackers with minimal permissions to execute arbitrary code remotely without user interaction. The vulnerability has a CVSS score of 8.8, indicating high severity. ([thehackernews.com](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html?utm_source=openai)) The prompt release of patches underscores the importance of timely updates, especially given SharePoint's role in storing sensitive corporate data. Organizations are urged to apply these updates promptly to mitigate potential exploitation risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/?utm_source=openai))
2 months ago
Kill Chain
Ghost CMS Vulnerability Exploited in Widespread ClickFix Campaign
In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0 was exploited in a large-scale campaign known as ClickFix. Threat actors leveraged this flaw to gain unauthorized access to over 700 domains, including prominent institutions like Harvard University, Oxford University, and DuckDuckGo. By extracting admin API keys, attackers injected malicious JavaScript into website articles, leading to further exploitation and potential data exfiltration. This incident underscores the persistent threat posed by unpatched vulnerabilities in widely used content management systems. The exploitation of CVE-2026-26980 highlights the importance of timely software updates and robust security practices to prevent unauthorized access and maintain the integrity of web platforms.
2 months ago
Kill Chain
Critical Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Actively Exploited
In May 2026, a critical SQL injection vulnerability, identified as CVE-2026-9082, was discovered in Drupal Core's database abstraction API. This flaw specifically affects sites utilizing PostgreSQL databases, allowing unauthenticated attackers to execute arbitrary SQL commands. Successful exploitation can lead to information disclosure, privilege escalation, and potentially remote code execution. Drupal released patches for affected versions, including 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, and 11.3.10. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 22, 2026, indicating active exploitation in the wild. Organizations are urged to apply the necessary patches promptly to mitigate potential risks. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-9082?utm_source=openai))
2 months ago
Kill Chain
CISA Adds CVE-2026-9082 to Known Exploited Vulnerabilities Catalog
On May 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9082 to its Known Exploited Vulnerabilities Catalog. This highly critical SQL injection vulnerability affects Drupal core's database abstraction layer, specifically impacting sites using PostgreSQL databases. Exploitation of this flaw can lead to information disclosure, privilege escalation, and remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) The inclusion of CVE-2026-9082 in CISA's catalog underscores the urgency for organizations to address this vulnerability promptly. Given the widespread use of Drupal for content management, unpatched systems are at significant risk of exploitation, potentially leading to severe security breaches.
2 months ago
Kill Chain
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability Exploited
In May 2026, a critical SQL injection vulnerability, CVE-2026-9082, was identified in Drupal's database abstraction API, specifically affecting sites using PostgreSQL. This flaw allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to information disclosure, privilege escalation, and remote code execution. Exploitation attempts have been observed in the wild, prompting Drupal to assign a risk score of 23 out of 25. Affected versions include Drupal 8.9.x, 10.4.x before 10.4.10, 10.5.x before 10.5.10, 10.6.x before 10.6.9, 11.0.x/11.1.x before 11.1.10, 11.2.x before 11.2.12, and 11.3.x before 11.3.10. Administrators are urged to update to the latest versions immediately. This incident underscores the persistent threat of SQL injection vulnerabilities in web applications, emphasizing the need for robust input validation and regular security updates. The active exploitation of this flaw highlights the importance of timely patching and vigilant monitoring to protect sensitive data and maintain system integrity.
2 months ago
Kill Chain
Ghostwriter's Prometheus Phishing Campaign Targets Ukrainian Government
In May 2026, the Belarus-aligned threat actor known as Ghostwriter (also referred to as UAC-0057 and UNC1151) launched a phishing campaign targeting Ukrainian government entities. The attackers utilized compromised accounts to send emails containing PDF attachments that, when interacted with, led to the deployment of a multi-stage malware chain. This chain involved the execution of JavaScript files (OYSTERFRESH and OYSTERSHUCK) designed to install the OYSTERBLUES payload, which harvested system information and facilitated the deployment of Cobalt Strike, a tool commonly used for post-exploitation activities. The campaign exploited lures related to Prometheus, a Ukrainian online learning platform, to enhance the credibility of the phishing emails. ([thehackernews.com](https://thehackernews.com/2026/05/ghostwriter-targets-ukraine-government.html?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors employing sophisticated phishing techniques to infiltrate government networks. The use of legitimate platforms as lures and the deployment of multi-stage malware highlight the evolving tactics of such groups, emphasizing the need for robust cybersecurity measures and user awareness to mitigate these risks.
2 months ago
Kill Chain
Drupal CVE-2026-9082: Critical SQL Injection Vulnerability in PostgreSQL Deployments
On May 20, 2026, Drupal released security updates addressing a highly critical SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw allows anonymous attackers to send specially crafted requests, leading to arbitrary SQL injection on sites using PostgreSQL databases. Exploitation can result in information disclosure, privilege escalation, and potentially remote code execution. The vulnerability affects Drupal versions from 8.9.0 up to 11.3.9, with patched versions available in 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) This incident underscores the persistent threat of SQL injection vulnerabilities in widely used content management systems. Organizations utilizing Drupal with PostgreSQL should prioritize immediate patching to mitigate potential exploitation. The ease of anonymous exploitation highlights the necessity for robust security practices and timely updates to protect sensitive data and maintain system integrity.
2 months ago
Kill Chain
Drupal Issues Critical Patch for SQL Injection Vulnerability (CVE-2026-9082)
On May 20, 2026, Drupal released a highly critical security update addressing a SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw specifically affects sites utilizing PostgreSQL databases, allowing unauthenticated attackers to execute arbitrary SQL commands, potentially leading to data breaches, privilege escalation, or remote code execution. The vulnerability impacts Drupal versions 8.9.0 through 11.3.9, with patches provided for supported and certain end-of-life versions. Administrators are urged to apply these updates promptly to mitigate the risk of exploitation. The urgency of this update underscores the persistent threat posed by SQL injection vulnerabilities, which remain a favored attack vector due to their potential for severe impact. Organizations must prioritize timely patch management and maintain vigilance against such critical flaws to safeguard their systems and data.
2 months ago
Kill Chain
PinTheft Vulnerability: Critical Root Escalation Flaw in Arch Linux
In May 2026, a critical privilege escalation vulnerability named 'PinTheft' was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol. This flaw allows local attackers to gain root privileges on systems where the RDS module is loaded, notably affecting Arch Linux by default. The vulnerability arises from a double-free error in the RDS zerocopy send path, which can be exploited to overwrite the page cache through io_uring fixed buffers. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation under specific conditions. The emergence of 'PinTheft' underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel, following recent disclosures like 'Copy Fail' (CVE-2026-31431) and 'Pack2TheRoot' (CVE-2026-41651). These incidents highlight the critical need for timely patching and vigilant system monitoring to mitigate the risk of unauthorized access and potential system compromise.
2 months ago
Kill Chain
Critical XSS Vulnerability in Kieback & Peter DDC Controllers: CVE-2026-4293
In May 2026, a cross-site scripting (XSS) vulnerability, identified as CVE-2026-4293, was discovered in Kieback & Peter DDC Building Controllers. This flaw allows attackers to execute malicious JavaScript in a victim's browser via the controller's web interface, potentially leading to unauthorized control over the browser. Affected models include DDC4002, DDC4100, DDC4200, DDC4200-L, DDC4400, DDC4002e, DDC4200e, DDC4400e, DDC4020e, DDC4040e, and DDC520, with firmware versions up to 1.12.14 and 1.23.4, respectively. ([windowsforum.com](https://windowsforum.com/threads/kieback-peter-ddc-xss-advisory-patch-supported-controllers-isolate-legacy-ot.418939/?utm_source=openai)) This incident underscores the critical need for robust security measures in building automation systems, especially as such vulnerabilities can serve as entry points for broader network compromises. Organizations are urged to update firmware where possible and isolate legacy systems to mitigate potential risks.
2 months ago
Kill Chain
Drupal's Upcoming Security Update: What You Need to Know
On May 20, 2026, Drupal plans to release a highly critical security update for all supported core branches between 17:00 and 21:00 UTC. The Drupal Security Team has advised site administrators to allocate time for these updates, as exploits may emerge shortly after the release. Affected versions include 11.3.x, 11.2.x, 10.6.x, and 10.5.x. Administrators are encouraged to update to the latest patch releases in preparation for the security window. ([drupal.org](https://www.drupal.org/psa-2026-05-18?utm_source=openai)) This proactive measure underscores the importance of timely security updates in mitigating potential vulnerabilities. Organizations relying on Drupal should prioritize these updates to maintain the integrity and security of their web platforms.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports