Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 134 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1597–1608 / 3786 reports
GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks
Computer Software/Engineering5 months ago

GitHub's npm v12: Strengthening Security Against Supply-Chain Attacks

In June 2026, GitHub announced significant security enhancements for npm version 12, aimed at mitigating supply-chain attacks. Key changes include requiring explicit approval for running preinstall, install, or postinstall scripts from dependencies, and restricting automatic fetching of dependencies from Git repositories and remote URLs unless explicitly permitted. These measures are designed to prevent unauthorized code execution during package installations, thereby enhancing the security of the npm ecosystem. This initiative addresses vulnerabilities exploited in recent supply-chain attacks, such as the Shai-Hulud campaign, which compromised numerous npm packages to steal developer credentials. By implementing these changes, GitHub aims to fortify the software supply chain against emerging threats and protect developers from potential security breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild
Computer Software/Engineering5 months ago

Critical Langflow Vulnerability CVE-2026-5027 Exploited in the Wild

In early 2026, a critical path traversal vulnerability, CVE-2026-5027, was discovered in Langflow, an open-source AI development platform. This flaw allowed unauthenticated attackers to write arbitrary files to exposed servers by exploiting the 'POST /api/v2/files' endpoint, which failed to properly sanitize user-supplied filenames. The vulnerability was publicly disclosed on March 27, 2026, after initial reports to the Langflow team went unanswered. Exploitation of this flaw has been observed in the wild, with attackers dropping test files on vulnerable instances. Langflow users are urged to upgrade to version 1.10.0 to mitigate this risk. This incident underscores the critical importance of timely vulnerability management and the risks associated with default configurations that allow unauthenticated access. Organizations must prioritize patching known vulnerabilities and reassess default settings to prevent unauthorized exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Miasma Worm Source Code Leaked on GitHub: Implications for Open-Source Security
Computer Software/Engineering5 months ago

Miasma Worm Source Code Leaked on GitHub: Implications for Open-Source Security

In June 2026, the Miasma worm, an evolution of the Shai-Hulud malware, was deliberately leaked on GitHub by threat actors. This credential-stealing framework targets developers by infecting their machines, harvesting build environment and cloud credentials, and propagating itself by compromising legitimate repositories and packages. Notably, Miasma has been linked to significant supply chain attacks, including the compromise of 73 Microsoft GitHub repositories and Red Hat npm packages. The worm's autonomous propagation mechanism poses a substantial risk to the open-source ecosystem, enabling rapid and widespread distribution of malicious code. The deliberate release of Miasma's source code is expected to facilitate further adaptations by malicious actors, potentially leading to an increase in sophisticated supply chain attacks. This incident underscores the critical need for enhanced security measures within the open-source community to mitigate the risks associated with such self-propagating malware.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
The Gentlemen Ransomware Group: A Rising Threat in 2026
Financial Services5 months ago

The Gentlemen Ransomware Group: A Rising Threat in 2026

The Gentlemen ransomware group, emerging in mid-2025, has rapidly become the second most active ransomware-as-a-service (RaaS) operation, claiming over 330 victims by mid-2026. Offering affiliates a 90% revenue share, the group attracts experienced operators who exploit internet-facing devices like VPNs and firewalls to gain initial access, swiftly encrypting entire networks within hours. Their cross-platform ransomware, written in Go, targets Windows, Linux, and ESXi environments, employing advanced techniques such as lateral movement, defense evasion, and data exfiltration to maximize impact. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/?utm_source=openai))The rapid ascent of The Gentlemen underscores the evolving sophistication of ransomware operations, highlighting the urgent need for organizations to bolster their cybersecurity defenses. The group's aggressive recruitment and advanced tactics exemplify the growing threat posed by RaaS platforms, emphasizing the importance of proactive threat intelligence and robust security measures to mitigate such risks. ([computerweekly.com](https://www.computerweekly.com/news/366643511/The-Gentlemen-emerging-as-key-ransomware-player?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Proto6 Vulnerabilities in protobuf.js: A Threat to Node.js Applications
Computer Software/Engineering5 months ago

Proto6 Vulnerabilities in protobuf.js: A Threat to Node.js Applications

In June 2026, cybersecurity researchers identified six critical vulnerabilities, collectively termed 'Proto6,' in protobuf.js—a widely used JavaScript and TypeScript implementation of Google's Protocol Buffers. These flaws, including CVE-2026-44291 and CVE-2026-44295, could lead to remote code execution (RCE) and denial-of-service (DoS) attacks if exploited. The vulnerabilities affect Node.js applications utilizing protobuf.js, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. Attackers can exploit these issues by introducing malicious protobuf schemas, potentially compromising sensitive data and system integrity. The discovery underscores the growing risks in software supply chains, especially within data and AI ecosystems that frequently exchange schemas and configurations. Organizations are urged to update to protobuf.js versions 7.5.6 or 8.0.2 to mitigate these threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Miasma Worm's 2026 Attack on Microsoft: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering5 months ago

Miasma Worm's 2026 Attack on Microsoft: A Wake-Up Call for Supply Chain Security

In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm compromised 73 of its GitHub repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously stolen credentials to inject malicious code into these repositories, leading to widespread disruptions in continuous integration and deployment (CI/CD) workflows globally. This incident underscores the escalating threat of self-replicating malware targeting trusted software supply chains. The Miasma worm's ability to exploit AI coding tools and integrated development environments (IDEs) highlights a concerning evolution in attack vectors, emphasizing the need for enhanced security measures in development environments to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Exchange 'Ghost-Sender' Vulnerability Exposes Organizations to Email Spoofing Attacks
Financial Services5 months ago

Microsoft Exchange 'Ghost-Sender' Vulnerability Exposes Organizations to Email Spoofing Attacks

In June 2026, researchers identified a vulnerability in Microsoft Exchange, termed 'Ghost-Sender,' allowing attackers to spoof emails from any sender to organizations using Exchange Online or on-premises in hybrid mode with third-party mail servers. This flaw enables malicious actors to bypass SPF, DKIM, and DMARC policies, delivering emails directly to users' inboxes without warnings. The misconfiguration is widespread, with evidence of active exploitation in the wild. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/exchange-flaw-attackers-spoof-email-address?utm_source=openai)) The 'Ghost-Sender' vulnerability underscores the critical need for organizations to review and secure their email configurations. With attackers actively exploiting this flaw, immediate action is required to implement recommended mitigations and prevent potential phishing attacks, fraud, and unauthorized access facilitated through email spoofing.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's June 2026 Patch Tuesday: A Record 206 Vulnerabilities Addressed
Information Technology/IT5 months ago

Microsoft's June 2026 Patch Tuesday: A Record 206 Vulnerabilities Addressed

In June 2026, Microsoft released a record-breaking Patch Tuesday update addressing 206 vulnerabilities across its product suite. This unprecedented volume underscores the accelerating pace of vulnerability discovery, largely driven by advancements in artificial intelligence. Notably, the update includes critical remote code execution flaws in core Windows components, such as HTTP.sys and the DHCP Client service, which could allow unauthenticated attackers to achieve full system compromise without user interaction. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-june-2026/?utm_source=openai)) The surge in identified vulnerabilities highlights the dual-edged nature of AI in cybersecurity. While AI enhances defensive capabilities, it also enables faster and more efficient discovery of software flaws, potentially outpacing traditional remediation efforts. Organizations must adapt by integrating AI-driven tools into their security workflows and enhancing their patch management processes to keep pace with this evolving threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
RoguePlanet Zero-Day Exploit Targets Microsoft Defender
Computer Software/Engineering5 months ago

RoguePlanet Zero-Day Exploit Targets Microsoft Defender

On June 10, 2026, the security researcher known as Nightmare-Eclipse publicly disclosed a zero-day vulnerability in Microsoft Defender, termed 'RoguePlanet.' This exploit leverages a race condition to grant SYSTEM-level privileges on fully patched Windows 10 and Windows 11 systems. The proof-of-concept code was released shortly after Microsoft's Patch Tuesday updates, which addressed previous vulnerabilities disclosed by the same researcher. The RoguePlanet disclosure underscores ongoing tensions between independent security researchers and major software vendors regarding vulnerability disclosure practices. The incident highlights the critical need for organizations to implement robust security measures and maintain vigilance against emerging threats, even on systems considered up-to-date.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ServiceNow Security Incident: Unauthenticated API Access Exposes Customer Data
Information Technology/IT5 months ago

ServiceNow Security Incident: Unauthenticated API Access Exposes Customer Data

In early June 2026, ServiceNow identified a security vulnerability within its platform, where an unauthenticated API endpoint allowed unauthorized access to customer data. The flaw, present since at least April 2026, was actively exploited by attackers between June 2 and June 3, 2026. ServiceNow applied a security update on June 5, 2026, to remediate the issue. The vulnerability primarily affected customers on the Australia platform release and earlier versions with specific configurations. The exact scope of data accessed remains undisclosed, but potential exposure includes sensitive information such as IT service tickets, internal documentation, and employee records. ([techcrunch.com](https://techcrunch.com/2026/06/10/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet/?utm_source=openai)) This incident underscores the critical importance of timely vulnerability management and the potential risks associated with delayed patching. Organizations relying on third-party platforms must ensure robust security measures and maintain vigilance over their data security practices to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Escalation of TeamPCP Supply Chain Attacks: A Wake-Up Call for Cybersecurity
Computer Software/Engineering5 months ago

Escalation of TeamPCP Supply Chain Attacks: A Wake-Up Call for Cybersecurity

In early June 2026, the TeamPCP supply chain campaign escalated with two significant developments. First, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added key vulnerabilities associated with the campaign to its Known Exploited Vulnerabilities catalog on May 27, 2026, and issued a standalone advisory the following day, highlighting compromises in Nx Console and GitHub repositories. Second, the open-sourced Mini Shai-Hulud framework led to widespread exploitation, notably the 'Miasma' attack on June 1, 2026, which compromised numerous @redhat-cloud-services npm packages, and the 'Phantom Gyp' variant on June 3, 2026, affecting additional packages. These incidents underscore the campaign's transition into a phase where its techniques are being adopted by a broader range of threat actors, extending beyond the original operators. This escalation highlights the critical need for organizations to enhance their supply chain security measures. The rapid adoption of the Mini Shai-Hulud framework by various attackers indicates a growing trend of sophisticated supply chain attacks, emphasizing the urgency for proactive defense strategies and continuous monitoring to mitigate potential risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's June 2026 Patch Tuesday: A Record-Breaking Security Update
Financial Services5 months ago

Microsoft's June 2026 Patch Tuesday: A Record-Breaking Security Update

On June 9, 2026, Microsoft released its largest Patch Tuesday update to date, addressing 206 vulnerabilities across its product suite, including Windows, Office, Azure, and more. Among these, 33 were classified as critical, with three zero-day vulnerabilities publicly disclosed prior to the release. Notably, CVE-2026-49160, a denial-of-service vulnerability related to the HTTP/2 protocol, was patched to prevent potential server disruptions. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-june-2026/?utm_source=openai)) This unprecedented volume of patches underscores the increasing complexity and interconnectivity of modern software ecosystems, highlighting the necessity for organizations to maintain rigorous patch management practices to mitigate emerging threats effectively.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports