Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 105 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1249–1260 / 3786 reports
Reducing Exposure Windows in the Era of AI-Driven Vulnerability Discovery
Computer Software/Engineering3 months ago

Reducing Exposure Windows in the Era of AI-Driven Vulnerability Discovery

In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, which identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This revelation underscored the critical importance of the 'exposure window'—the time between a vulnerability's discovery and its remediation. Despite the rapid identification of these vulnerabilities, many organizations faced challenges in promptly addressing them, leaving systems susceptible to exploitation. The disparity between the speed of AI-driven vulnerability discovery and the slower pace of organizational remediation processes highlighted significant gaps in existing security protocols. The emergence of AI models like Mythos has accelerated the rate at which vulnerabilities are uncovered, necessitating a reevaluation of traditional vulnerability management strategies. Organizations must now prioritize reducing their exposure windows by streamlining remediation processes and enhancing coordination between security and IT teams. This shift is essential to mitigate the risks posed by rapidly evolving cyber threats and to maintain robust security postures in an era of AI-driven vulnerability discovery.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical 7-Zip Vulnerability CVE-2026-14266: Update Now
Computer Software/Engineering3 months ago

Critical 7-Zip Vulnerability CVE-2026-14266: Update Now

In July 2026, a critical vulnerability identified as CVE-2026-14266 was discovered in 7-Zip's handling of XZ-compressed data. This heap-based buffer overflow flaw allows attackers to execute arbitrary code when a user opens a specially crafted XZ archive, potentially leading to full system compromise. The vulnerability was reported by Landon Peng of Lunbun LLC and publicly disclosed by the Zero Day Initiative on July 15, 2026. A patch was released in 7-Zip version 26.02 on June 25, 2026. This incident underscores the importance of timely software updates and vigilance against malicious archives. With 7-Zip's widespread use, the potential attack surface is significant, highlighting the need for organizations to implement robust security measures and user education to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical 'wp2shell' Vulnerability in WordPress: Immediate Action Required
Computer Software/Engineering3 months ago

Critical 'wp2shell' Vulnerability in WordPress: Immediate Action Required

In July 2026, a critical pre-authentication remote code execution (RCE) vulnerability, dubbed 'wp2shell' and tracked as CVE-2026-63030, was discovered in WordPress versions 6.9.x and 7.0.x. This flaw allows unauthenticated attackers to execute arbitrary code on default WordPress installations without any plugins, leading to potential full site compromise. WordPress released security updates 7.0.2 and 6.9.5 on July 17, 2026, to address this issue. ([nebula.design](https://nebula.design/security/wp2shell-wordpress-rce/?utm_source=openai)) The 'wp2shell' vulnerability underscores the critical importance of timely software updates and proactive security measures. Given WordPress's extensive use, this flaw poses a significant risk to a vast number of websites, highlighting the need for continuous vigilance against emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert Operations
Financial Services3 months ago

HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert Operations

In July 2026, cybersecurity researchers identified a sophisticated malware named HollowGraph, which exploits Microsoft 365 calendars to establish covert command and control (C2) channels. By leveraging the Microsoft Graph API, the malware creates calendar events dated to May 13, 2050, embedding operator instructions and exfiltrating stolen data as attachments. This method allows malicious communications to blend seamlessly with legitimate Microsoft 365 traffic, evading traditional detection mechanisms. The malware has been linked to the Cavern backdoor framework, previously associated with Iranian-nexus threat actors, and has primarily targeted Israeli organizations. ([thehackernews.com](https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html?utm_source=openai)) The discovery of HollowGraph underscores the evolving tactics of threat actors who are increasingly abusing trusted cloud services to conduct espionage activities. Organizations must enhance their monitoring of Microsoft Graph API activities and implement stringent access controls to detect and prevent such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
NGINX CVE-2026-42533: Critical Heap Buffer Overflow Vulnerability
Information Technology/IT3 months ago

NGINX CVE-2026-42533: Critical Heap Buffer Overflow Vulnerability

In July 2026, a critical vulnerability identified as CVE-2026-42533 was discovered in NGINX Plus and NGINX Open Source. This heap buffer overflow flaw arises when the `map` directive utilizes regex matching, and a string expression references the map's regex capture variables before the map output variable. An unauthenticated attacker can exploit this by sending specially crafted HTTP requests, leading to a denial-of-service (DoS) condition through worker process crashes. In environments where Address Space Layout Randomization (ASLR) is disabled or bypassed, remote code execution (RCE) becomes possible. ([ionix.io](https://www.ionix.io/threat-center/cve-2026-42533/?utm_source=openai)) The widespread use of NGINX in web servers and reverse proxies amplifies the potential impact of this vulnerability. Organizations relying on NGINX are urged to update to the patched versions—NGINX 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus 37.0.3.1—to mitigate the risk of exploitation. ([ionix.io](https://www.ionix.io/threat-center/cve-2026-42533/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UAC-0145's Use of ClickFix CAPTCHAs: A New Cyber Threat in Ukraine
Government Administration3 months ago

UAC-0145's Use of ClickFix CAPTCHAs: A New Cyber Threat in Ukraine

In July 2026, the Russian state-sponsored hacking group UAC-0145, also known as Sandworm or APT44, launched a campaign targeting Ukrainian organizations. The attackers employed a technique called ClickFix, which involves fake CAPTCHA prompts on compromised websites. These prompts instructed users to execute PowerShell commands, leading to the installation of data-stealing malware such as GHETTOVIBE and SCOUTCURL. The campaign compromised at least ten websites and utilized tools like SMARTAXE to dynamically alter web content, displaying deceptive CAPTCHA checks. Additionally, the attackers distributed malicious Android APK files via messaging apps, deploying the COWARDDUCK backdoor to exfiltrate sensitive information from infected devices. This incident underscores the evolving tactics of state-sponsored threat actors, who are increasingly adopting social engineering techniques traditionally associated with financially motivated cybercriminals. The use of ClickFix by UAC-0145 highlights the need for heightened vigilance and user education to recognize and avoid such deceptive tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Surge in ACR Stealer Attacks: Protecting Your Enterprise
Financial Services3 months ago

Surge in ACR Stealer Attacks: Protecting Your Enterprise

Between late April and mid-June 2026, Microsoft observed a significant increase in attacks utilizing the ACR Stealer malware, targeting enterprise customers to exfiltrate browser-stored passwords, authentication tokens, and sensitive documents. The attackers employed social engineering tactics, notably the 'ClickFix' method, to deceive users into executing malicious commands. These campaigns leveraged WebDAV servers and the MSHTA utility to deliver the info-stealing payloads, with some variants utilizing blockchain services for command-and-control communication. The impact includes unauthorized access to confidential information and potential compromise of enterprise systems. This surge underscores the evolving sophistication of cyber threats, particularly the use of social engineering combined with advanced delivery mechanisms. Organizations must enhance their security posture by implementing robust user education programs, restricting the execution of untrusted scripts, and monitoring for unusual network activities to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical 7-Zip Vulnerability CVE-2026-14266: Immediate Update Required
Computer Software/Engineering3 months ago

Critical 7-Zip Vulnerability CVE-2026-14266: Immediate Update Required

In July 2026, a critical vulnerability identified as CVE-2026-14266 was discovered in 7-Zip's handling of XZ-compressed data. This flaw allows attackers to execute arbitrary code by convincing users to open specially crafted compressed files, leading to potential system compromise. The vulnerability was disclosed by researcher Landon Peng and addressed in 7-Zip version 26.02. The incident underscores the persistent risks associated with widely used software utilities and the importance of timely updates. Similar vulnerabilities have been exploited in the past, highlighting the need for vigilance against social engineering attacks that leverage such flaws.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
Financial Services3 months ago

Understanding the 'LegacyHive' Windows Zero-Day Vulnerability

In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk. The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the HollowByte OpenSSL DoS Vulnerability
Information Technology/IT3 months ago

Understanding the HollowByte OpenSSL DoS Vulnerability

In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
NadMesh Botnet Exploits Exposed AI Services to Steal Cloud Credentials
Computer Software/Engineering3 months ago

NadMesh Botnet Exploits Exposed AI Services to Steal Cloud Credentials

In early July 2026, the NadMesh botnet emerged, targeting exposed AI services such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The botnet exploits these unsecured services to harvest sensitive cloud credentials, including AWS keys and Kubernetes tokens. QiAnXin's XLab reported that the botnet operator's dashboard claimed possession of 3,811 unique AWS keys, indicating a significant breach of cloud security. The malware employs a Shodan harvester to continuously scan for vulnerable AI services, emphasizing the critical need for securing such deployments. This incident underscores the growing trend of cyber attackers exploiting misconfigured AI and automation tools to gain unauthorized access to cloud infrastructures. Organizations must prioritize the security of AI services, ensuring proper authentication and network configurations to prevent such breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ViteVenom: Unveiling the Blockchain-Powered Supply Chain Attack on Vite npm Packages
Computer Software/Engineering3 months ago

ViteVenom: Unveiling the Blockchain-Powered Supply Chain Attack on Vite npm Packages

In July 2026, cybersecurity researchers identified a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. This campaign, dubbed ViteVenom, expanded upon the earlier ChainVeil attack by utilizing a sophisticated four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron, Aptos, and Binance Smart Chain. The attackers, attributed to the group SuccessKey, employed this infrastructure to deliver a remote access trojan (RAT) capable of reverse shell operations, credential harvesting, file exfiltration, and persistent backdoor injection. The malicious packages, published between June 29 and July 3, 2026, impersonated legitimate Vite packages, thereby deceiving developers into incorporating them into their projects. This incident underscores the escalating complexity and persistence of supply chain attacks, particularly those leveraging decentralized technologies to evade detection and takedown efforts. The use of blockchain for C2 infrastructure presents significant challenges for traditional security measures, highlighting the need for enhanced vigilance and advanced threat detection capabilities within the software development community.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports