Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 108 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1285–1296 / 3786 reports
TuxBot v3 Evolution: Unveiling the AI-Assisted IoT Botnet Threat
Computer/Network Security3 months ago

TuxBot v3 Evolution: Unveiling the AI-Assisted IoT Botnet Threat

In early 2026, cybersecurity researchers uncovered TuxBot v3 Evolution, a sophisticated modular IoT botnet framework. This malware targets a wide range of IoT devices by exploiting known vulnerabilities and employing extensive Telnet brute-force attacks. Notably, the development of TuxBot v3 Evolution involved assistance from a large language model (LLM), resulting in both functional components and critical errors due to unreviewed AI-generated code. The botnet's capabilities include multi-architecture support, encrypted command-and-control communications, and a variety of fallback mechanisms, posing a significant threat to IoT security. The discovery of TuxBot v3 Evolution underscores the evolving landscape of cyber threats, where adversaries leverage AI technologies to enhance malware development. This trend highlights the urgent need for robust security measures and continuous monitoring to protect IoT ecosystems from increasingly sophisticated attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Microsoft's July 2026 Patch Tuesday: A Record 570 Security Flaws Fixed
Information Technology/IT3 months ago

Microsoft's July 2026 Patch Tuesday: A Record 570 Security Flaws Fixed

In July 2026, Microsoft released a record-breaking Patch Tuesday update, addressing 570 security vulnerabilities across its software products. This unprecedented volume, nearly triple the previous month's count, includes 59 critical flaws and three zero-day vulnerabilities actively exploited in the wild. Notably, CVE-2026-56155 affects Active Directory Federation Services, and CVE-2026-56164 impacts Microsoft SharePoint, both allowing privilege escalation. Additionally, CVE-2026-50661 is a BitLocker bypass that could grant attackers access to encrypted data if they have physical device access. Microsoft attributes this surge in identified vulnerabilities to advancements in artificial intelligence, which have accelerated the discovery and analysis of security flaws. This significant increase underscores the evolving cybersecurity landscape, where AI not only aids defenders in identifying vulnerabilities but also empowers attackers to develop exploits more rapidly. Organizations must prioritize timely patch management and adopt proactive security measures to mitigate the risks associated with these newly disclosed vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution
Computer Software/Engineering3 months ago

Critical Vulnerabilities in Cursor AI IDE Expose Developers to Remote Code Execution

In early 2026, multiple critical vulnerabilities were discovered in the Cursor AI-integrated development environment (IDE), notably CVE-2026-50548 and CVE-2026-50549. These flaws allowed attackers to escape the IDE's sandbox environment, enabling remote code execution (RCE) on developers' machines. Exploits involved manipulating the working directory parameter and leveraging symbolic link (symlink) manipulation to bypass security controls. The vulnerabilities posed significant risks, including unauthorized access to source code, sensitive data exposure, and potential compromise of development environments. ([csoonline.com](https://www.csoonline.com/article/4191923/sandbox-bypass-flaws-in-cursor-ide-highlight-prompt-injection-as-an-rce-vector.html?utm_source=openai)) The discovery of these vulnerabilities underscores the growing security challenges associated with AI-assisted development tools. As organizations increasingly adopt such tools to enhance productivity, it is imperative to implement robust security measures to mitigate risks associated with prompt injection attacks and sandbox escapes. This incident highlights the need for continuous monitoring and updating of AI development environments to safeguard against emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Urgent: SonicWall SMA1000 Zero-Day Vulnerabilities Under Active Exploitation
Financial Services3 months ago

Urgent: SonicWall SMA1000 Zero-Day Vulnerabilities Under Active Exploitation

In July 2026, SonicWall disclosed two critical zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances: CVE-2026-15409 and CVE-2026-15410. CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability allowing unauthenticated attackers to make the appliance send requests to unintended locations. CVE-2026-15410 is a code injection flaw enabling authenticated administrators to execute arbitrary operating system commands. Both vulnerabilities have been actively exploited in the wild, potentially leading to unauthorized access and control over affected systems. SonicWall has released patches to address these issues and urges immediate updates to mitigate risks. ([sonicwall.com](https://www.sonicwall.com/ja-jp/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ?utm_source=openai)) The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to gain initial footholds into organizational networks. This incident highlights the critical importance of promptly applying security patches and maintaining vigilant monitoring of network appliances to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Security Researcher Releases 'LegacyHive' Windows Zero-Day Exploit Post Patch Tuesday
Government Administration3 months ago

Security Researcher Releases 'LegacyHive' Windows Zero-Day Exploit Post Patch Tuesday

On July 15, 2026, security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released a proof-of-concept (PoC) exploit named 'LegacyHive.' This exploit targets a vulnerability in the Windows User Profile Service (ProfSvc), allowing an authenticated attacker to load registry hives associated with other user accounts, potentially leading to privilege escalation. The PoC requires another standard user credential and a third username, which can be an administrator account. If successful, it mounts the target user hive in the current user's classes root. Notably, this vulnerability affects all supported desktop and server versions of Windows, including those running the latest July 2026 Patch Tuesday update. The release of 'LegacyHive' underscores the ongoing tensions between independent security researchers and major software vendors regarding vulnerability disclosure practices. This incident highlights the critical need for organizations to implement robust privilege escalation defenses and to stay vigilant about applying security updates promptly to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Four Known Exploited Vulnerabilities to Catalog
Government Administration3 months ago

CISA Adds Four Known Exploited Vulnerabilities to Catalog

On July 14, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. The vulnerabilities include CVE-2026-15409 and CVE-2026-15410 affecting SonicWall SMA1000 Appliances, CVE-2026-56155 impacting Microsoft Active Directory Federation Services, and CVE-2026-56164 related to Microsoft SharePoint Server. These vulnerabilities are commonly exploited by malicious actors and pose significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 emphasizes the importance of promptly addressing such high-risk vulnerabilities to protect federal networks. While BOD 26-04 is mandatory for Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of vulnerabilities listed in the KEV Catalog. This proactive approach is crucial in mitigating potential threats and enhancing overall cybersecurity resilience.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ServiceNow's June 2026 Data Exposure: A Wake-Up Call for Cloud Security
Information Technology/IT3 months ago

ServiceNow's June 2026 Data Exposure: A Wake-Up Call for Cloud Security

In early June 2026, ServiceNow identified a security vulnerability within its REST API that permitted unauthenticated users to access customer instance data. The flaw, present in the ‘Australia’ platform release and certain earlier versions with specific configurations, allowed unauthorized queries to sensitive data, including IT support tickets and employee records. ServiceNow applied a security update on June 5, 2026, to rectify the issue and notified affected customers directly. The incident underscores the critical importance of robust access controls and timely vulnerability management in cloud-based platforms. This event highlights the ongoing challenges in securing API endpoints against unauthorized access. As enterprises increasingly rely on cloud services for core operations, ensuring the integrity and confidentiality of data through stringent security measures becomes paramount. Organizations must remain vigilant, regularly audit their systems, and promptly address identified vulnerabilities to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's July 2026 Patch Tuesday: A Record-Breaking 622 Vulnerabilities Addressed
Information Technology/IT3 months ago

Microsoft's July 2026 Patch Tuesday: A Record-Breaking 622 Vulnerabilities Addressed

In July 2026, Microsoft released its largest Patch Tuesday update to date, addressing 622 vulnerabilities across its product suite. This unprecedented volume includes two zero-day vulnerabilities: CVE-2026-56155, a privilege escalation flaw in Active Directory Federation Services, and CVE-2026-56164, a similar flaw in Microsoft SharePoint Server. Both vulnerabilities were actively exploited in the wild, posing significant security risks to organizations. The surge in identified vulnerabilities is attributed to Microsoft's deployment of its multi-model agentic scanning harness (MDASH), an AI-driven tool designed to accelerate the discovery and remediation of software defects. This development underscores the growing role of artificial intelligence in cybersecurity, enabling faster identification and patching of vulnerabilities but also highlighting the increasing complexity and volume of potential security issues that organizations must manage.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SAP's July 2026 Security Updates: Addressing Critical Vulnerabilities in NetWeaver and Commerce Cloud
Computer Software/Engineering3 months ago

SAP's July 2026 Security Updates: Addressing Critical Vulnerabilities in NetWeaver and Commerce Cloud

In July 2026, SAP released security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, Commerce Cloud, and Approuter. The most severe, CVE-2026-44747, is a memory corruption issue in NetWeaver Application Server ABAP, potentially leading to unauthorized data access and system unavailability. CVE-2026-27690, an HTTP request smuggling vulnerability in SAP Approuter, could allow unauthenticated attackers to access user responses and trigger denial-of-service attacks. CVE-2026-44761 in SAP Commerce Cloud involves default credentials that enable attackers to obtain valid access tokens and manipulate data via certain APIs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/sap-warns-of-critical-flaws-in-netweaver-and-commerce-cloud/?utm_source=openai)) These vulnerabilities underscore the critical need for organizations to promptly apply security patches to prevent potential exploitation. The increasing complexity and integration of enterprise software systems make timely updates essential to maintain system integrity and protect sensitive data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing Alert: LastPass and Bitwarden Users Targeted in July 2026
Financial Services3 months ago

Phishing Alert: LastPass and Bitwarden Users Targeted in July 2026

In July 2026, a sophisticated phishing campaign targeted users of LastPass and Bitwarden, two prominent password management services. Attackers sent emails from addresses like 'hello@lastpassnewsletter.com' and 'hello@bitwardennewsletter.com', falsely notifying recipients of updated security policies. These emails directed users to fraudulent websites impersonating DocuSign, prompting them to download malicious files purportedly compatible with both Windows and macOS systems. The domains used, such as 'lastpasscompliance[.]com' and 'bitwardencompliance[.]com', were flagged as malicious by security services. LastPass confirmed that its systems remained uncompromised and that the phishing emails did not originate from its infrastructure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/lastpass-bitwarden-users-targeted-with-fake-security-alerts/?utm_source=openai)) This incident underscores a growing trend of cybercriminals targeting password manager users through sophisticated phishing tactics. The use of legitimate-looking emails and websites to deceive users highlights the need for heightened vigilance and robust security measures. Organizations and individuals must remain alert to such evolving threats to safeguard sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Windows 11 July 2026 Patch Tuesday: Critical Updates and New Features
Information Technology/IT3 months ago

Windows 11 July 2026 Patch Tuesday: Critical Updates and New Features

On July 14, 2026, Microsoft released cumulative updates KB5101650 and KB5099414 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These mandatory updates addressed 571 security vulnerabilities, including three zero-day exploits, and introduced new features such as improved Bluetooth reliability, enhanced Widgets experience, and Point-in-Time restore functionality. The updates also included various performance and reliability improvements across system components, including File Explorer, networking, printing, and accessibility. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5101650-and-kb5099414-cumulative-updates-released/amp/?utm_source=openai)) The release of these updates underscores the ongoing need for organizations to prioritize timely patch management. With the increasing complexity and volume of vulnerabilities, staying current with security updates is essential to protect systems against potential exploits and maintain operational integrity.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
SonicWall SMA1000 Zero-Day Vulnerabilities: Immediate Action Required
Financial Services3 months ago

SonicWall SMA1000 Zero-Day Vulnerabilities: Immediate Action Required

In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a post-authentication code injection vulnerability. These flaws allowed unauthenticated attackers to make unauthorized requests and authenticated administrators to execute arbitrary OS commands, respectively. Both vulnerabilities were actively exploited in zero-day attacks, prompting SonicWall to release urgent security patches. Organizations utilizing affected SMA1000 models were advised to upgrade to the latest firmware versions immediately and to inspect their systems for indicators of compromise. This incident underscores the persistent targeting of remote access solutions by threat actors, highlighting the necessity for continuous monitoring, timely patching, and comprehensive security measures to protect against evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports