The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical n8n RCE Vulnerability (CVE-2025-68613) Exposes Systems to Full Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users to execute arbitrary code on the server by exploiting insufficient isolation in the workflow expression evaluation system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive data and modification of workflows. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-68613?utm_source=openai)) The vulnerability was addressed in n8n versions 1.120.4, 1.121.1, and 1.122.0. However, as of March 2026, over 40,000 unpatched instances remain exposed online, with significant concentrations in North America and Europe. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/?utm_source=openai))
6 months ago
Kill Chain
Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
In early March 2026, cybersecurity researchers identified a coordinated supply chain attack involving five malicious Rust crates—'chrono_anchor', 'dnp3times', 'time_calibrator', 'time_calibrators', and 'time-sync'—that masqueraded as time-related utilities. These crates exfiltrated sensitive '.env' files containing developer secrets to attacker-controlled infrastructure. Concurrently, an AI-powered bot named 'hackerbot-claw' exploited misconfigured GitHub Actions workflows in major open-source repositories, achieving remote code execution and stealing access tokens. This bot targeted repositories from organizations such as Microsoft, Datadog, and Aqua Security, leading to unauthorized code execution and potential repository takeovers. These incidents underscore the escalating threats to software supply chains, particularly through the exploitation of CI/CD pipeline vulnerabilities and the use of AI-driven automation in cyber attacks. Organizations must prioritize securing their development environments by auditing dependencies, implementing strict access controls, and continuously monitoring for anomalous activities to mitigate such risks.
6 months ago
Kill Chain
UNC6426's Rapid Exploitation of nx npm Supply Chain: A 72-Hour Breach to AWS Admin Access
In August 2025, the threat actor UNC6426 exploited a supply chain vulnerability in the nx npm package to infiltrate a victim's cloud environment. The attackers published malicious versions of the nx package, which, when installed, exfiltrated developer credentials, including GitHub tokens. Utilizing these stolen tokens, UNC6426 gained unauthorized access to the victim's GitHub account, abused the GitHub-to-AWS OpenID Connect (OIDC) trust relationship to create a new AWS administrator role, and within 72 hours, exfiltrated data from Amazon S3 buckets and destroyed production environments. This incident underscores the escalating sophistication of supply chain attacks, where attackers leverage trusted relationships between development tools and cloud services to escalate privileges rapidly. The breach highlights the critical need for organizations to implement stringent security measures, such as enforcing the principle of least privilege, regularly rotating credentials, and monitoring for anomalous activities within their CI/CD pipelines and cloud environments.
6 months ago
Kill Chain
Critical SQL Injection Vulnerability in Elementor Ally Plugin Puts Over 250,000 WordPress Sites at Risk
In March 2026, a critical SQL injection vulnerability (CVE-2026-2313) was discovered in the Ally – Web Accessibility & Usability plugin for WordPress, affecting versions up to 4.0.3. This flaw allows unauthenticated attackers to inject malicious SQL queries via the URL path, potentially leading to unauthorized access to sensitive database information. The vulnerability arises from insufficient escaping of user-supplied URL parameters in the `get_global_remediations()` method, which are directly concatenated into SQL JOIN clauses without proper sanitization. Exploitation is possible when the plugin is connected to an Elementor account with the Remediation module active. Despite the release of a patched version (4.1.0) on February 23, 2026, data indicates that only about 36% of the affected websites have updated, leaving over 250,000 sites vulnerable. This incident underscores the persistent threat posed by SQL injection vulnerabilities in web applications, emphasizing the need for developers to implement robust input validation and sanitization practices. Website administrators are urged to promptly update plugins and maintain regular security audits to mitigate such risks.
6 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing Critical Zero-Day Vulnerabilities
In March 2026, Microsoft released patches addressing 84 security vulnerabilities across its software portfolio, including two publicly disclosed zero-day flaws: CVE-2026-26127, a denial-of-service vulnerability in .NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. Notably, over half of the patched vulnerabilities were related to privilege escalation, underscoring the critical need for organizations to apply these updates promptly to mitigate potential exploitation risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This incident highlights the ongoing challenges in securing complex software ecosystems and the importance of timely patch management. The disclosure of zero-day vulnerabilities before patches are available increases the window of opportunity for threat actors, emphasizing the need for organizations to maintain robust vulnerability management practices.
6 months ago
Kill Chain
Critical n8n Vulnerabilities Expose Systems to Remote Code Execution
In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. Notably, CVE-2026-27577 and CVE-2026-27493 allowed for remote code execution (RCE) through expression sandbox escapes and unauthenticated expression evaluations via Form nodes, respectively. These flaws enabled attackers to execute arbitrary commands on the n8n host, potentially leading to full system compromise. ([thehackernews.com](https://thehackernews.com/2026/03/critical-n8n-flaws-allow-remote-code.html?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of timely software updates and vigilant security practices. Organizations utilizing n8n are urged to upgrade to patched versions immediately to mitigate potential exploitation risks.
6 months ago
Kill Chain
Perplexity Comet AI Browser Phishing Attack 2026
In March 2026, security researchers demonstrated a critical vulnerability in Perplexity's Comet AI browser, where attackers could manipulate the browser's AI assistant into executing phishing scams autonomously. By intercepting the browser's communication with AI services and feeding it into a Generative Adversarial Network (GAN), the researchers trained the AI to bypass its security measures and enter user credentials into malicious websites within minutes. This exploit highlights a significant shift in attack vectors, targeting AI models directly rather than end-users. The incident underscores the evolving threat landscape where AI-driven systems can be manipulated to perform unauthorized actions, emphasizing the need for robust security measures in AI integrations. As AI technologies become more prevalent, ensuring their resilience against such sophisticated attacks is paramount to maintaining user trust and data security.
6 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Notably, none of these vulnerabilities were reported as actively exploited in the wild at the time of release. The update also included eight critical vulnerabilities, such as CVE-2026-21536, a remote code execution flaw in the Microsoft Devices Pricing Program, which Microsoft mitigated server-side without requiring user action. This Patch Tuesday marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's proactive security measures. However, the presence of publicly disclosed vulnerabilities underscores the importance of timely patch application to mitigate potential risks.
6 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading U.S. medical technology company, experienced a significant cyberattack attributed to the pro-Palestinian hacktivist group Handala. The attackers reportedly utilized wiper malware to erase data from over 200,000 systems, including servers and mobile devices, leading to widespread operational disruptions across Stryker's global network. Employees in multiple countries, notably Ireland, were sent home as the company worked to contain the incident. Handala claimed the attack was retaliation for a missile strike that resulted in civilian casualties in Iran. This incident underscores the escalating trend of state-sponsored hacktivism targeting critical infrastructure and healthcare sectors. Organizations must enhance their cybersecurity measures to defend against sophisticated threats that aim not only to steal data but also to cause operational paralysis. The use of wiper malware highlights the need for robust data backup and recovery strategies to mitigate the impact of such destructive attacks.
6 months ago
Kill Chain
APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware
In early 2026, the Russian state-sponsored threat actor APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukrainian military personnel. The attackers utilized spear-phishing emails containing malicious Microsoft Office documents to exploit the CVE-2026-21509 vulnerability, allowing them to execute code via OLE objects without macros or warnings. This method facilitated the deployment of two advanced malware implants: BeardShell, a custom C++ backdoor leveraging the Icedrive cloud service for command-and-control communications, and Covenant, a heavily modified open-source .NET post-exploitation framework. These tools enabled APT28 to conduct long-term surveillance, data exfiltration, and maintain persistent access to compromised systems. ([cyberpress.org](https://cyberpress.org/apt28-exploits-office-vulnerability/?utm_source=openai)) This incident underscores a significant evolution in APT28's tactics, techniques, and procedures (TTPs), highlighting their ability to rapidly weaponize newly disclosed vulnerabilities and integrate legitimate cloud services into their command-and-control infrastructure. The campaign's success emphasizes the urgent need for organizations to promptly apply security patches, enhance phishing defenses, and monitor for abuse of legitimate services in cyber operations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/10/sednit-espionage-toolkit-stealing-data/?utm_source=openai))
6 months ago
Kill Chain
Critical Vulnerabilities in Lantronix EDS3000PS and EDS5000 Devices Threaten Infrastructure Security
In March 2026, multiple critical vulnerabilities were identified in Lantronix EDS3000PS and EDS5000 devices, including OS command injection and authentication bypass issues. Exploitation of these vulnerabilities could allow attackers to execute code with root-level privileges, potentially compromising critical infrastructure sectors such as Communications, Information Technology, and Critical Manufacturing. ([cisa.gov](https://www.cisa.gov/news-events/bulletins/sb22-108?utm_source=openai)) This incident underscores the ongoing risks associated with unpatched vulnerabilities in network devices, highlighting the necessity for organizations to implement robust vulnerability management and regular system updates to mitigate potential threats.
6 months ago
Kill Chain
Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025
In 2025, critical vulnerabilities were identified in reverse proxy applications, notably Fabio and OAuth2-Proxy, exposing significant security risks. CVE-2025-48865 in Fabio allowed attackers to manipulate or remove security-critical headers like X-Forwarded-Host and X-Real-IP by exploiting the HTTP Connection header, potentially leading to access control bypasses. Similarly, CVE-2025-64484 in OAuth2-Proxy enabled authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. These vulnerabilities underscore the importance of stringent header validation and normalization practices in reverse proxy configurations. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48865?utm_source=openai)) The discovery of these vulnerabilities highlights a systemic issue in how reverse proxies handle HTTP headers, emphasizing the need for organizations to reassess and fortify their security measures to prevent similar exploits.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports