The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3586 threat reports
Page 1 of 299
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1–12 / 3586 reports
SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market
SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market
Banking/Mortgage13 minutes ago

SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market

In October 2026, the State Bank of India (SBI) disclosed a customer data breach after a threat actor operating under the alias 'Siriusim' published 3,897 customer records—along with a table of 375,000 rows and 2,722 PDF files—on BreachForums. The exposed PII included names, mobile numbers, email addresses, dates of birth, home addresses, KYC documentation, Central KYC numbers, video KYC verification data, loan application metadata, and employment declarations. SBI confirmed the incident via a formal notice to India's National Stock Exchange, while stressing that core banking operations remained unaffected. The breach is suspected to have originated from a peripheral data-handling or digital-services system rather than SBI's core banking platform. This incident underscores the compounding risk that even small PII leaks create within India's mature underground data economy, where threat actors cross-reference breach dumps with real-time lookup services to build high-fidelity identity profiles for phishing, vishing, loan fraud, and impersonation attacks—amplifying the harm far beyond the raw record count.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise
Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise
Information Technology/IT13 minutes ago

Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise

In October 2026, Microsoft attributed a large-scale supply chain attack against ConnectWise Cloud Backup to Storm-0940, a China-linked threat actor. Exploiting compromised application credentials tied to ConnectWise's authorized Microsoft 365 integrations, Storm-0940 deployed an agentic AI penetration-testing framework called ARTEX to automate reconnaissance, password spraying, and OAuth application abuse at scale—targeting more than 2,250 downstream customer tenants across manufacturing, aerospace, energy, defense, and financial services. In several cases, attackers achieved privileged cloud persistence in under three hours, generating up to 2,900 sign-in attempts per minute. ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services in response. This incident marks a watershed moment in AI-enabled offensive operations. Storm-0940's use of ARTEX demonstrates that nation-state actors are now weaponizing agentic AI to exponentially accelerate attack timelines, compress defender response windows, and scale supply chain compromise across thousands of organizations simultaneously—elevating the urgency of zero trust, segmentation, and multicloud visibility controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
Information Technology/IT48 minutes ago

PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet

In October 2026, threat actors launched millions of exploitation attempts against two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)—targeting unauthenticated remote code execution via crafted HTTP requests. Attackers attempted to deploy the Mirai-derived Potassium botnet, which uses ChaCha20-encrypted configuration, ENS-based C2 resolution, and supports 24 DDoS flood commands across ICMP, TCP, UDP, and OpenVPN protocols. Cloudflare observed hundreds of thousands of exploit attempts within two hours of public disclosure, escalating to millions by October 22. Over 34.4 million PHP services remained vulnerable as of October 23, prompting precautionary shutdowns of government, hospital, and school websites across Asia, Europe, and North America. PHP2Shell is drawing comparisons to Log4Shell due to its deep engine-level origin dating to PHP 5.4 (2012), meaning no application-layer fix suffices. With 56.6 million web properties running PHP and patches unavailable for end-of-life branches, organizations face a prolonged exposure window. The rise of ASLR-bypass techniques and automated exploit toolkits signals escalating attacker sophistication targeting cloud-hosted and shared-hosting PHP environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers
Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers
Internet48 minutes ago

Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers

In October 2026, security researchers at Imperva publicly demonstrated Node2Shell, a proof-of-concept remote code execution exploit targeting CVE-2026-111497, a memory corruption flaw in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x. By feeding crafted malformed Brotli-compressed data through HTTP request bodies or response paths—including via Express 5 middleware such as express.json()—attackers can trigger an out-of-bounds write, ultimately executing arbitrary attacker-supplied code on unpatched servers. Node.js released patched builds on October 21, 2026; no in-the-wild exploitation had been confirmed as of October 22, 2026. This incident highlights the compounding risk of trusted, bundled dependencies in widely deployed runtimes. As Node.js underpins millions of cloud-native APIs and microservices, a single decoder flaw becomes a systemic supply-chain-adjacent threat. The rise of middleware-enabled attack surfaces—where standard Express body parsers silently expand exposure—underscores the urgency of runtime patching and network-layer inspection for modern cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities
When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities
Financial Services48 minutes ago

When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities

In October 2026, security firm V12 disclosed 25 vulnerabilities in the x402 open-source SDK — a Coinbase-created, Linux Foundation-governed protocol enabling AI agents to autonomously make cryptocurrency micropayments during API calls. Three flaws were rated critical and all were silently patched in August 18 releases without public security advisories. The most severe allowed a malicious API to request an AI agent's entire token wallet balance, exploiting the default client's lack of spending limits. Additional critical flaws enabled a complete Solana payment bypass via token approval spoofing and cross-site login signature relay attacks. No package manager warnings were issued, leaving developers unaware of the risk. This incident signals a maturing threat surface around agentic AI and autonomous payment systems. As AI agents increasingly operate with financial autonomy — signing transactions without human approval — supply-chain vulnerabilities in foundational SDKs become high-stakes attack vectors. The combination of silent patching, absent CVE assignments, and no package manager advisories reflects a systemic disclosure gap the industry must urgently address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk
CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk
Computer Software/Engineering1 hour ago

CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk

In October 2026, security researchers at OX Security disclosed three critical vulnerabilities in Pillow, Python's most widely used image processing library, downloaded approximately 436 million times per month. The most severe flaw, CVE-2026-112900 (CVSS 9.2), allows remote code execution via crafted EPS filenames passed unsanitized to Ghostscript, enabling an attacker who controls a filename to execute arbitrary OS commands on the server. Two additional critical flaws affect JPEG (FPX format) and TIFF in-memory processing pipelines. All three were patched in Pillow 13.0.0 released October 16, 2026. No active exploitation has been confirmed, though a proof-of-concept exists for the TIFF flaw. These vulnerabilities are emblematic of a broader supply-chain risk pattern: a single transitive dependency embedded across web upload forms, ML pipelines, document processors, and container images can silently expose thousands of applications. As AI-assisted vulnerability research (demonstrated here by Anthropic's Claude) accelerates flaw discovery, organizations must treat open-source image libraries as high-priority attack surface in their software supply chain programs.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
Information Technology/IT1 hour ago

70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026

Between February and June 2026, a threat actor tracked as k0t (aliases: CryptoFeel, Member19, QazWsxShop) executed a large-scale credential harvesting campaign against internet-exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices worldwide. Leveraging public scanning tools such as FOFA and ZoomEye, k0t enumerated vulnerable edge appliances and exploited CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS authentication bypass) via bespoke Python scripts. Post-exploitation actions included Active Directory enumeration, persistence via MeshCentral, Atera, and AnyDesk, and data exfiltration through Rclone to Wasabi S3 and MEGA. Over 70,000 credentials were harvested, with victims spanning Asia Pacific, Latin America, Europe, and MENA. This campaign underscores the accelerating role of initial access brokers (IABs) feeding ransomware groups such as Qilin and The Gentlemen. With edge device exploitation now industrialized through automated scanning and off-the-shelf exploit scripts, organizations relying solely on perimeter firewalls face systemic credential exposure risk—making zero trust segmentation and encrypted east-west traffic controls critically urgent.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure
PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure
Internet1 hour ago

PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure

In October 2026, PHP disclosed a second unpatched remote code execution vulnerability, CVE-2026-115560, just two days after emergency patches addressed the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. The PHP2Shell vulnerabilities, patched on October 21 in versions 8.2.35 through 8.5.12, allowed unauthenticated attackers to execute code on web servers. Exploitation attempts surged from tens of thousands within 45 minutes of disclosure to millions by October 22, with threat actors attempting to deploy a Mirai botnet variant. CVE-2026-115560 affects a narrow configuration involving session serialization handler switching and requires disabling session upload progress as a temporary mitigation. This incident illustrates the compounding risk of staggered vulnerability disclosures in widely deployed open-source runtimes. The rapid weaponization of PHP2Shell flaws—with honeypot detections four days before official disclosure—signals increasingly shortened exploit development windows, forcing organizations to treat patch cadence and network-layer egress controls as non-negotiable security baselines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
Information Technology/IT1 hour ago

PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins

In October 2024, SANS Internet Storm Center elevated its Infocon alert level in response to a critical PHP vulnerability affecting a broad range of web-facing applications, embedded devices, and appliances. The flaw—tied to PHP's session.upload_progress mechanism—enabled remote code execution, prompting coordinated disclosure across vendors including Cloudflare and Amazon, both of which reported large volumes of exploit attempts in the wild. Although no fully weaponized public exploit was confirmed at time of publication, security researchers warned that working exploit code was imminent. Patches were issued by php.net and major vendors, but incomplete coverage of embedded and legacy devices left significant attack surface exposed. This incident highlights a growing pattern of critical web-runtime vulnerabilities being exploited before organizations can fully patch their environments. The coordinated disclosure process succeeded, yet unpatched embedded devices and delayed enterprise patch cycles continue to represent systemic risk—underscoring why network segmentation and east-west traffic controls are essential backstops when software updates cannot be applied immediately.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
Transportation1 hour ago

MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm

On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization. This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments
OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments
Financial Services1 hour ago

OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments

As enterprises broadly adopted multi-factor authentication, adversaries pivoted from stealing passwords to harvesting OAuth tokens—the short-lived but often misconfigured credentials that govern application-level access. Unit 42 researchers documented in October 2026 how three attack classes—account hijacking via device authorization flow abuse, permission hijacking through consent-screen impersonation, and malicious OAuth redirect weaponization—now enable attackers to bypass MFA entirely, survive password resets, and maintain durable access to enterprise environments. PhaaS toolkits, LLM-generated brand impersonations, and dynamic runtime evasion have industrialized these campaigns, lowering attacker skill requirements while dramatically raising organizational risk. OAuth token hijacking represents a structural shift in the identity threat landscape: attackers no longer need to defeat authentication controls because they operate entirely in the authorization layer. With OAuth adoption expanding into critical infrastructure platforms such as Cloudflare DNS and CDN routing, the blast radius of a single compromised consent event has grown substantially, making token governance and admin-only consent workflows urgent enterprise priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
Financial Services1 hour ago

eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust

In October 2026, Palo Alto Networks Unit 42 disclosed that eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect introduced during certificate generation. Insufficient entropy during key generation allowed attackers to mathematically derive private keys directly from the corresponding public certificates. With access to these keys, adversaries could sign unauthorized TLS certificates, enabling meddler-in-the-middle (MitM) traffic interception, domain impersonation, and session hijacking across any domain protected by eMudhra-issued certificates. Major browser and OS vendors moved swiftly to revoke trust in the affected intermediates, and eMudhra revoked all eight certificates. This incident underscores the fragility of global PKI trust hierarchies and the cascading risk posed by a single CA's cryptographic failure. As certificate lifespans compress to 47 days and supply-chain attacks targeting cryptographic infrastructure grow more frequent, organizations must adopt automated certificate lifecycle management and continuous CT log monitoring to detect and respond to unauthorized certificate issuance before adversaries exploit it.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports