Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 13 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 145–156 / 3786 reports
GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services
GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services
Financial Services1 week ago

GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services

In October 2026, GMO Internet Group's Onamae.com Desktop Cloud service — a Windows virtual desktop platform used by retail FX traders — suffered a significant breach. Attackers exploited a cloud misconfiguration, reportedly leveraging a shared administrator account across all customer servers, to install malicious software, exfiltrate customer data, and harvest login credentials stored in trading platforms such as MetaTrader 4 and 5. Up to 26,739 servers were potentially affected. Stolen credentials were subsequently used to execute unauthorized trades on customer accounts at brokers including OANDA Japan. Attackers then issued a $50 million extortion demand and threatened ransomware deployment, data publication, and account manipulation across more than 70 financial firms. This incident underscores how cloud misconfigurations — particularly flat administrative access models and inadequate east-west segmentation — directly translate into credential theft, financial fraud, and large-scale extortion. As regulated financial services increasingly migrate workloads to cloud-hosted virtual desktops, the risk profile of shared infrastructure vulnerabilities has grown substantially, drawing renewed regulatory and law-enforcement scrutiny globally.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security
AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security
Information Technology/IT1 week ago

AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security

In October 2026, Anthropic disclosed that an internal, unreleased AI research model autonomously identified and chained multiple zero-day vulnerabilities across Chrome, Safari, Android, Windows, and Linux into working proof-of-concept exploits. The model required only minimal human prompting to construct five complete exploit chains, including a Chrome sandbox escape, a Safari same-origin policy bypass, and a Linux root-shell exploit rated CVSS 9.8 (CVE-2026-98432). All flaws were responsibly disclosed and patched by respective vendors prior to publication. Apple and Google independently credited Anthropic and its Claude model in their security advisories, providing third-party validation. This disclosure signals a fundamental shift in the offensive security landscape: AI models can now autonomously perform vulnerability research and exploit development at a level previously reserved for elite red teams. The convergence of AI capability with exploit engineering raises urgent questions about the defensive readiness of enterprise cloud, browser, and kernel-layer infrastructure against AI-accelerated adversaries.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries
Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries
Health Care / Life Sciences1 week ago

Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries

In October 2026, the Skyw4lker device code phishing campaign was identified targeting U.S. organizations across manufacturing, technology, and healthcare sectors. Attackers distributed password-protected business documents posing as contracts or service proposals, redirecting victims through Google Sites infrastructure into a legitimate Microsoft authentication flow. Rather than harvesting credentials via fake login pages, the campaign abused OAuth 2.0 device authorization grants to capture valid Microsoft 365 tokens. A PHP/JavaScript backend tracked victim sessions, collected geolocation data, and polled authentication status in real time, yielding persistent account access while generating only legitimate-looking authentication telemetry. Device code phishing represents a maturing evasion technique that bypasses MFA and traditional credential-theft defenses by exploiting legitimate cloud authentication protocols. As FBI IC3 data records over $20.9 billion in internet crime losses in 2025 and phishing volumes continue to rise, identity-based attacks that produce no fake login pages are increasingly difficult to detect with conventional email and endpoint security tools alone.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk
Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk
Marketing/Advertising/Sales1 week ago

Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk

In October 2026, Adobe disclosed eight critical vulnerabilities in Campaign Classic (versions 7.4.4 build 9402 and earlier) spanning code injection, OS command injection, incorrect authorization, SQL injection, and reflected cross-site scripting. CVSS scores range from 9.1 to 9.9, indicating near-maximum severity. Successful exploitation could allow unauthenticated or low-privileged attackers to execute arbitrary code, bypass security controls, and escalate privileges on both Windows and Linux deployments. Adobe patched all eight flaws in build 9403. A separate critical code injection flaw (CVE-2026-48360, CVSS 9.6) in Adobe Connect Desktop and Mobile was also remediated simultaneously. High-severity vulnerability clusters in widely deployed enterprise marketing platforms like Adobe Campaign Classic are increasingly attractive to ransomware operators and espionage actors. The combination of SQL injection, code injection, and privilege escalation chains provides a near-complete attack path from initial access to full host compromise, making rapid patch adoption a board-level priority.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads
16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads
Information Technology/IT1 week ago

16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads

A critical buffer-overflow vulnerability (CVE-2026-97631, CVSS 9.5) discovered in EDK II's PXE network-boot driver has existed undetected for 16 years since a November 2010 commit. Disclosed on October 22, 2026 by TianoCore after an accidental early exposure via a public GitHub pull request, the flaw allows an adjacent-network attacker to crash or hijack firmware execution before Secure Boot activates—requiring no credentials and no prior access. Every server relying on PXE boot and built on EDK II—spanning AMI, Insyde, Phoenix, and Microsoft Project Mu firmware—is potentially affected. Red Hat, SUSE, and Debian have confirmed vulnerable packages with no patched release yet available. With no stable patched EDK II release yet shipped and patch-derived exploit research already possible, data-center operators face an unmitigated firmware-layer attack surface. The incident echoes PixieFail (2024) and underscores a systemic pattern: supply-chain firmware components accumulate critical flaws that propagate silently across entire server ecosystems, making network-layer controls and boot-time traffic monitoring essential compensating measures while vendors work through patch delivery cycles.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release
CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release
Financial Services1 week ago

CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release

Within 24 hours of Oracle releasing its October 2026 Critical Patch Update, threat actors began actively probing CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Thin Client Framework servlet. Discovered by Horizon3.ai researchers and disclosed to Oracle on July 24, 2026, the flaw allows any attacker with network access to chain SQL execution as the APPS database user into full operating-system command execution on the EBS application host—potentially exposing financial, payroll, HR, and procurement records. Threat intelligence firm Defused Cyber confirmed live exploit probes against honeypot decoys on October 27, 2026, just one day after the patch dropped. This incident continues a pattern of rapid weaponization of Oracle EBS vulnerabilities. Two prior critical flaws in the same product—CVE-2025-61882, exploited by the Cl0p ransomware group, and CVE-2026-46817—both carried CVSS 9.8 scores and were actively exploited in the wild, underscoring that EBS environments are high-value, repeat targets requiring accelerated patch cycles and compensating network controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign
ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign
Information Technology/IT1 week ago

ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign

In late October 2026, a newly identified ClickFix social engineering campaign was observed targeting both macOS and Windows users via a fake Cloudflare verification page hosted on the domain js-static[.]cfd. The attack chain lures victims into manually executing a malicious command copied from the spoofed page, a hallmark of ClickFix-style delivery. The campaign fingerprints the victim's OS and serves platform-specific payloads. Although the final-stage malware was not retrieved due to infrastructure errors (403 Forbidden on Windows and DNS non-resolution on macOS), the staging infrastructure and URL chain were fully documented, revealing a multi-step victim-profiling and geo-tracking mechanism prior to payload delivery. ClickFix campaigns are accelerating in 2026, with threat actors increasingly abusing trusted brand impersonation—particularly Cloudflare—to bypass user skepticism. The manual-execution lure circumvents many automated endpoint defenses, making user-targeted social engineering one of the fastest-growing initial access vectors across enterprise and SMB environments alike.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE
php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE
Information Technology/IT1 week ago

php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE

In October 2025, two pre-authentication remote code execution vulnerabilities in PHP core—CVE-2026-109618 and CVE-2026-109619, collectively dubbed php2shell—were disclosed ahead of coordinated release. Discovered by researcher Calif, the flaws exploit dangling session pointer conditions and serializer issues to achieve unauthenticated RCE against Apache mod_php and PHP-FPM deployments respectively. Exploitation is technically feasible but highly conditional, requiring precise heap layout control, ASLR bypass via information leak, and version-specific offsets. High-value targets include edge appliances with PHP management interfaces such as Palo Alto PAN-OS and Citrix NetScaler, where even DMZ-resident RCE yields meaningful attacker leverage. Php2shell highlights a persistent and underappreciated risk pattern: low-severity findings such as exposed phpinfo pages aggregate into critical exploitation preconditions. As AI-assisted exploit development accelerates N-day weaponization timelines, organizations must reassess how informational disclosures compound with memory corruption vulnerabilities to enable targeted, high-impact intrusions against network perimeter appliances.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE
PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE
Internet1 week ago

PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively tracked as PHP2Shell, enabling unauthenticated remote code execution (RCE) against any server running a vulnerable PHP version. CVE-2026-109618 exploits an out-of-memory condition during request parsing to corrupt heap memory before application code executes, while CVE-2026-109619 leverages stale serializer state via a use-after-free to forge malicious objects in session data. Both flaws affect all server APIs including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Bishop Fox researchers confirmed full unauthenticated RCE against stock Apache mod_php Docker images with ASLR enabled. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP2Shell represents a systemic risk because the vulnerability resides in PHP's core runtime engine rather than any application layer, meaning no specific feature, plugin, or misconfiguration is required for exposure. With public proof-of-concept exploits already circulating and Bishop Fox confirming reproducible RCE in lab conditions, organizations running unpatched PHP face immediate, low-barrier compromise risk across their entire web-serving infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure
PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure
Information Technology/IT1 week ago

PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure

In late October 2026, CISA added two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell—to its Known Exploited Vulnerabilities Catalog after confirmed in-the-wild remote code execution (RCE) was recorded against unpatched Apache mod_php installations. Exploitation began four days before patches were released on October 21, 2026, with attackers targeting over 5.1 million internet-exposed PHP hosts. Honeypot evidence confirmed successful RCE against PHP 8.4.26 by October 24, prompting CISA to mandate Federal Civilian Executive Branch agencies to patch by October 30, 2026. PHP powers roughly 70% of all websites, making the attack surface extraordinarily broad. The PHP2Shell disclosures underscore a dangerous trend: vulnerability details and partial proof-of-concept code leaked before patches were available, compressing the remediation window for defenders. As attackers increasingly exploit web application RCE flaws at scale within days of disclosure, organizations running PHP-dependent workloads in cloud and hybrid environments face elevated risk of initial compromise and downstream lateral movement if network segmentation and egress controls are absent.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Tailworm 2026: How Eleven Tailscale SSH Flaws Put Root Access One Hop Away
Tailworm 2026: How Eleven Tailscale SSH Flaws Put Root Access One Hop Away
Information Technology/IT1 week ago

Tailworm 2026: How Eleven Tailscale SSH Flaws Put Root Access One Hop Away

In October 2026, Cyberdione Labs disclosed eleven vulnerabilities—collectively named Tailworm—affecting Tailscale 1.104.2 and the self-hosted headscale v0.29.5 control server. The most critical flaw resides in Tailscale's embedded SSH server, which runs as root, and allows an authorized device with a single SSH policy rule to exploit Unix-socket forwarding race conditions to gain full root code execution on target servers, capture enrollment keys, and delete arbitrary files. Additional flaws enable credential theft via cloud metadata through misconfigured app connectors, unauthenticated denial-of-service against the headscale control plane, and client memory exhaustion via malicious DERP relay responses. Tailscale confirmed the findings are serious and committed to shipping patches by end of day October 27, 2026. The Tailworm disclosure arrives as enterprises increasingly rely on software-defined mesh VPNs to connect hybrid and multi-cloud workloads, expanding the blast radius of privilege-escalation flaws. The attack chain—authorized user to root in a single hop—mirrors a broader industry trend where identity-permissioned access replaces perimeter controls without compensating runtime segmentation, making zero-trust policy enforcement and east-west traffic controls more urgent than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
When Trust Breaks at the Root: The eMudhra CA Compromise and What It Means for Your Encrypted Infrastructure
When Trust Breaks at the Root: The eMudhra CA Compromise and What It Means for Your Encrypted Infrastructure
Financial Services1 week ago

When Trust Breaks at the Root: The eMudhra CA Compromise and What It Means for Your Encrypted Infrastructure

In October 2026, Microsoft released out-of-band Windows updates (KB5134133 and KB5134125) to remove trust in certificates tied to a critical compromise of eMudhra certificate authority infrastructure. Researchers discovered that eight eMudhra intermediate CA private keys, all generated in April 2025, were so cryptographically weak—with values smaller than 256—that they could be recovered almost instantly by any attacker testing only 256 possible numbers. The compromised keys spanned six TLS and two code-signing intermediate CAs, enabling potential forgery of trusted certificates for any website or signed software in the eMudhra chain. Microsoft removed seven root and cross-sign certificates from the Windows trust list, with Mozilla, Google, and Apple taking parallel action across their ecosystems. This incident underscores the cascading risk when foundational PKI trust anchors are weakened by poor key generation practices. As enterprises increasingly rely on certificate-based authentication, TLS inspection, and code integrity verification, a single compromised CA hierarchy can silently invalidate trust across millions of endpoints, cloud workloads, and encrypted network paths—making proactive CTL hygiene and real-time certificate monitoring non-negotiable components of modern zero trust architecture.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports