The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Understanding CVE-2022-0492: A Critical Linux cgroups Vulnerability
In February 2022, a high-severity vulnerability identified as CVE-2022-0492 was discovered in the Linux kernel's control groups (cgroups) feature. This flaw allowed unprivileged local users to escalate their privileges, potentially leading to container escapes and unauthorized access to the host system. The vulnerability resided in the cgroup_release_agent_write function within the kernel's cgroup-v1.c file, where improper restrictions on the release_agent feature enabled attackers to execute arbitrary commands with elevated privileges. ([sysdig.com](https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/?utm_source=openai)) The discovery of CVE-2022-0492 underscored the critical importance of robust security configurations in containerized environments. While default security measures like SELinux, AppArmor, and Seccomp provided protection against this specific vulnerability, the incident highlighted the necessity for organizations to adhere to best practices in container security to mitigate potential risks. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/?utm_source=openai))
4 months ago
Kill Chain
Microsoft's May 2026 Patch Tuesday: 137 Vulnerabilities Addressed
In May 2026, Microsoft released its Patch Tuesday updates addressing 137 security vulnerabilities across its product suite, including Windows, Office, and SharePoint. Notably, this update cycle did not include any zero-day vulnerabilities, marking a rare occurrence. Among the patches, 30 were classified as critical, with several remote code execution flaws that could allow attackers to gain control over affected systems. Organizations are advised to prioritize these updates to mitigate potential risks. ([securityonline.info](https://securityonline.info/microsoft-patch-tuesday-may-2026-netlogon-rce-sso-bypass/?utm_source=openai)) This incident underscores the ongoing challenges in software security, highlighting the importance of timely patch management. The absence of zero-day vulnerabilities in this cycle is encouraging, yet the high number of critical flaws emphasizes the need for vigilance in cybersecurity practices.
4 months ago
Kill Chain
Google Introduces Intrusion Logging to Bolster Android Security
In May 2026, Google introduced 'Intrusion Logging' as part of Android's Advanced Protection Mode, aiming to enhance forensic analysis of sophisticated spyware attacks. This opt-in feature records encrypted logs of device activities, including app installations, network connections, and screen unlocks, storing them securely in the user's Google account. The logs are designed to assist security researchers and users in investigating potential device compromises, with data automatically deleted after 12 months. ([techcrunch.com](https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/?utm_source=openai)) The launch of Intrusion Logging marks a significant advancement in mobile security, providing users, especially those at high risk like journalists and activists, with tools to detect and analyze unauthorized access. This development reflects a growing industry focus on user-controlled security measures and the need for robust defenses against evolving spyware threats. ([techcrunch.com](https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/?utm_source=openai))
4 months ago
Kill Chain
GemStuffer: Exploiting RubyGems for Data Exfiltration from U.K. Council Portals
In May 2026, cybersecurity researchers identified a campaign named 'GemStuffer' that exploited over 150 RubyGems packages to exfiltrate data scraped from U.K. council portals. Unlike traditional supply chain attacks aimed at compromising developers, GemStuffer utilized the RubyGems repository as a channel to store and retrieve collected public-sector data. The attackers fetched information from local government portals, packaged the data into valid RubyGems archives, and published them back to the repository using hardcoded API keys. This method allowed the exfiltrated data to be retrieved through standard package operations, effectively turning the RubyGems infrastructure into a data staging platform. The incident underscores the evolving nature of supply chain threats, highlighting that package registries can be misused not only for malware distribution but also as persistent, publicly accessible data channels. Organizations are advised to monitor their software supply chains closely and implement robust security measures to detect and prevent such abuses.
4 months ago
Kill Chain
Microsoft's May 2026 Patch Tuesday: Addressing 138 Security Vulnerabilities
In May 2026, Microsoft released patches for 138 security vulnerabilities across its product portfolio, including Windows, Office, and Azure services. Of these, 30 were rated Critical, with notable flaws such as CVE-2026-41096, a heap-based buffer overflow in Windows DNS, and CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon. These vulnerabilities could allow unauthorized remote code execution without authentication. Importantly, none of the vulnerabilities were reported as publicly known or under active attack at the time of release. This comprehensive update underscores the ongoing necessity for organizations to maintain vigilant patch management practices. The inclusion of critical vulnerabilities affecting core services like DNS and Netlogon highlights the potential for significant security breaches if left unaddressed. Organizations are advised to prioritize these updates to mitigate risks associated with remote code execution and privilege escalation.
4 months ago
Kill Chain
Microsoft's May 2026 Patch Tuesday: Addressing Critical Vulnerabilities
In May 2026, Microsoft released a Patch Tuesday update addressing 137 vulnerabilities across its product suite, including 13 rated as critical. Notably, CVE-2026-41103, a critical elevation of privilege vulnerability in the Microsoft SSO Plugin for Jira & Confluence, was identified. This flaw could allow unauthorized attackers to gain elevated privileges over a network, posing significant risks to organizations utilizing these tools. ([tenable.com](https://www.tenable.com/cve/CVE-2026-41103?utm_source=openai)) The absence of zero-day vulnerabilities in this release is a positive development; however, the high number of critical issues underscores the necessity for organizations to promptly apply these patches. The prominence of vulnerabilities in widely used platforms like Jira and Confluence highlights the ongoing targeting of development and CI/CD tools by threat actors, emphasizing the need for vigilant security practices. ([computerweekly.com](https://www.computerweekly.com/news/366642908/Microsoft-releases-rare-zero-day-free-Patch-Tuesday-update?utm_source=openai))
4 months ago
Kill Chain
Microsoft's MDASH AI System Uncovers 16 Critical Windows Vulnerabilities
In May 2026, Microsoft introduced MDASH, a multi-model AI-driven system designed to autonomously discover and validate vulnerabilities within complex codebases like Windows. MDASH employs over 100 specialized AI agents to analyze source code, build threat models, and identify exploitable defects. During its initial deployment, MDASH identified 16 vulnerabilities in the Windows networking and authentication stack, including two critical flaws: CVE-2026-33824, a double-free vulnerability in 'ikeext.dll' allowing remote code execution via specially crafted packets, and CVE-2026-33827, a race condition in 'tcpip.sys' enabling remote code execution through crafted IPv6 packets. These vulnerabilities were addressed in Microsoft's May Patch Tuesday release. The introduction of MDASH signifies a pivotal shift in cybersecurity, highlighting the growing role of AI in proactive vulnerability detection and remediation. This development underscores the importance for organizations to integrate AI-driven security tools to enhance their defense mechanisms against increasingly sophisticated cyber threats.
4 months ago
Kill Chain
FamousSparrow APT's Persistent Attacks on Azerbaijani Energy Infrastructure
Between late December 2025 and late February 2026, a Chinese-affiliated threat actor known as FamousSparrow conducted a multi-wave intrusion targeting an Azerbaijani oil and gas company. The attackers exploited vulnerabilities in Microsoft Exchange servers to gain initial access, deploying sophisticated backdoors such as Deed RAT and Terndoor. Despite multiple remediation efforts, the adversaries persistently re-exploited the same entry points, indicating a high level of determination and technical capability. This campaign underscores the evolving threat landscape where state-sponsored actors are increasingly targeting critical energy infrastructure in geopolitically sensitive regions. The incident highlights the necessity for organizations to implement comprehensive patch management, continuous monitoring, and robust incident response strategies to mitigate such persistent and sophisticated cyber threats.
4 months ago
Kill Chain
Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update
In May 2026, Microsoft released a comprehensive Patch Tuesday update addressing 137 vulnerabilities across its product suite, including 13 rated as critical. Notably, this release did not include any zero-day vulnerabilities, marking a departure from previous months. Critical vulnerabilities such as CVE-2026-33109 and CVE-2026-42823 affecting Azure, and CVE-2026-42898 in Microsoft Dynamics 365, were highlighted due to their high CVSS scores and potential impact on enterprise systems. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-may-2026/?utm_source=openai)) The substantial number of vulnerabilities reflects a growing trend where artificial intelligence models are increasingly utilized to uncover previously undetected defects in code. This shift underscores the importance for organizations to promptly apply patches and enhance their security postures to mitigate emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2026/05/a-note-on-patch-tuesday?utm_source=openai))
4 months ago
Kill Chain
Mini Shai-Hulud: A Wake-Up Call for Open-Source Security
In May 2026, a sophisticated supply chain attack known as 'Mini Shai-Hulud' compromised hundreds of open-source packages across major registries, embedding credential-stealing malware into widely used development tools. Notably, TanStack's React Router package, with over 12 million weekly downloads, was affected. The attackers exploited GitHub Actions workflows to insert malicious code, which, upon execution, targeted cloud infrastructure credentials and propagated itself by masquerading as legitimate commits. This campaign is attributed to TeamPCP, a cybercriminal group specializing in automating supply-chain attacks and exploiting cloud-native environments. The incident underscores the critical need for enhanced security measures in automated software publishing processes to prevent such systemic vulnerabilities. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-supply-chain-malware-attack/?utm_source=openai))
4 months ago
Kill Chain
Shai-Hulud Supply Chain Attack: A Wake-Up Call for CI/CD Security
In May 2026, the 'Shai-Hulud' supply chain attack, attributed to the TeamPCP threat group, compromised hundreds of npm and PyPI packages, including those from TanStack, Mistral AI, UiPath, and OpenSearch. The attackers exploited valid OpenID Connect (OIDC) tokens to publish malicious package versions with verifiable provenance attestation (SLSA Build Level 3), enabling the distribution of credential-stealing malware targeting developers. This sophisticated attack leveraged vulnerabilities in CI/CD pipelines, including risky 'pull_request-target' workflows, GitHub Actions cache poisoning, and OIDC token theft from runner memory, resulting in the unauthorized publication of 84 malicious versions across 42 TanStack packages. The incident underscores the escalating threat of supply chain attacks and the need for robust security measures in software development pipelines. The use of legitimate CI/CD infrastructure to distribute malware highlights the importance of securing development environments against such sophisticated threats.
4 months ago
Kill Chain
Windows 11 May 2026 Patch Tuesday: Critical Security Updates and Exciting New Features
On May 12, 2026, Microsoft released cumulative updates KB5089549 and KB5087420 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These updates addressed 137 security vulnerabilities, including critical flaws in Secure Boot and Remote Desktop Connection. Additionally, the updates introduced new features such as Xbox Mode and expanded archive format support in File Explorer. ([windowsreport.com](https://windowsreport.com/windows-11-may-2026-patch-tuesday-update-kb5089549-out-now/?utm_source=openai)) The release underscores Microsoft's commitment to enhancing system security and user experience. Organizations are advised to promptly apply these updates to mitigate potential threats and benefit from the latest features.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports