Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 17 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 193–204 / 3786 reports
One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack
One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack
Computer Software/Engineering2 weeks ago

One Unrevoked Key, Total Pipeline Compromise: Inside the 2026 LiteLLM Supply Chain Attack

In May 2026, a LiteLLM Agent Platform master key was accidentally committed to a public GitHub repository and never revoked. On October 10, 2026, an unknown threat actor exploited this unrevoked credential to access the Agent Platform, extract a broadly scoped GitHub CLI OAuth token belonging to an organization owner, and harvest secrets from internal CI/CD workflows via malicious cache.yml files pushed to short-lived throwaway branches. On October 21, the attacker redirected the release pipeline to a lookalike repository and published the backdoored LiteLLM 1.107.0 to PyPI, Docker Hub, and GHCR—delivering a credential-stealing infostealer and persistent Python backdoor to downstream users across the AI developer ecosystem. This incident exemplifies the compounding risk of a single unrevoked secret in an AI-native supply chain: one leaked master key cascaded into organization-wide repository access, CI/CD pipeline hijack, and mass credential exfiltration targeting AI API keys, cloud credentials, and developer tool tokens. As agentic AI frameworks become critical infrastructure, secrets hygiene and pipeline integrity controls are emerging as top-tier enterprise security priorities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
php2shell Exposed: Why This PHP RCE Exploit Is Harder to Pull Off Than the Hype Suggests
php2shell Exposed: Why This PHP RCE Exploit Is Harder to Pull Off Than the Hype Suggests
Internet2 weeks ago

php2shell Exposed: Why This PHP RCE Exploit Is Harder to Pull Off Than the Hype Suggests

In October 2024, the cybersecurity community reacted urgently to the disclosure of a PHP vulnerability nicknamed 'php2shell,' which theoretically enables remote code execution through a complex heap manipulation chain. Analysis by SANS ISC researcher Bojan revealed that reliable, weaponized exploitation is significantly harder than initial reports suggested. A working exploit requires precise memory pressure conditions, a single-worker Apache prefork configuration, knowledge of libphp.so offsets to defeat ASLR, and commands limited to 14 bytes—conditions rarely met in production environments with default 128 MB memory limits and multi-worker setups. Organizations are advised to set session.upload_progress.enabled=0 immediately as a mitigation. This incident highlights the growing challenge of accurately triaging vulnerability severity in real-world cloud and hybrid environments. As AI-generated proof-of-concept code floods public repositories, security teams face increasing noise in distinguishing theoretical exploitability from practical risk—making network-level controls and rapid configuration hardening essential layers of defense.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE
Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE
Information Technology/IT2 weeks ago

Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE

In October 2026, Hewlett Packard Enterprise released emergency security patches addressing 72 vulnerabilities in ArubaOS (AOS), the operating system powering Aruba Networking enterprise wireless infrastructure including mobility conductors, access points, controllers, and gateway devices. Eight of these flaws carry maximum CVSS severity scores and enable unauthenticated remote code execution and authentication bypass across both AOS-8 and AOS-10 software versions. The vulnerabilities—spanning command injection, SQL injection, and buffer overflow vectors—require no privileges and no user interaction, making them trivially exploitable at scale across HPE's installed base of over 55,000 enterprise customers, including 90% of Fortune 500 companies. HPE confirmed no active exploitation or public proof-of-concept code existed at time of disclosure. This disclosure follows a pattern of critical HPE network infrastructure vulnerabilities in 2025–2026, including StoreOnce auth bypass flaws, hardcoded Aruba credentials, and actively exploited HPE OneView weaknesses flagged by CISA. Attackers increasingly target network infrastructure operating systems as a high-leverage initial access vector, making unpatched edge devices a primary risk surface for enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PHP CVE-2026-115560: How to Defend Against an Unpatched RCE Vulnerability Targeting Millions of Web Servers
PHP CVE-2026-115560: How to Defend Against an Unpatched RCE Vulnerability Targeting Millions of Web Servers
Internet2 weeks ago

PHP CVE-2026-115560: How to Defend Against an Unpatched RCE Vulnerability Targeting Millions of Web Servers

In October 2026, the PHP security team disclosed CVE-2026-115560, a remote code execution vulnerability affecting PHP installations with non-default session serialization configurations. Exploitable only when session.serialize_handler is switched at runtime before session_start() with upload progress enabled, the flaw carries high severity despite its conditional nature. No patch was immediately available; mitigation required disabling session.upload_progress.enabled. This disclosure followed emergency patches for two related critical RCE flaws, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), which were already seeing broad exploitation attempts across millions of exposed PHP hosts globally before patches were released. This incident underscores accelerating attacker timelines against unpatched web infrastructure. With over 5.1 million PHP hosts exposed online and exploitation of PHP2Shell beginning four days before patches shipped, organizations running PHP-based applications face shrinking windows between disclosure and active compromise, demanding proactive mitigation and network-layer controls beyond patch cycles alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE
Government Administration2 weeks ago

CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE

A critical remote code execution vulnerability (CVE-2026-30612) was discovered in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, affecting an estimated 3 million Windows and 350,000 macOS devices. The flaw resided in the app's auto-updater, which contacted an expired domain over unencrypted HTTP and accepted unsigned executables—enabling anyone who registered the domain to push arbitrary code with SYSTEM-level or root privileges. Researchers at Eye Security registered the abandoned update domain and 14 related domains, then used the same vulnerable mechanism to deploy remediation payloads that disabled the updater across approximately 2 million devices between November 2025 and March 2026. Connections originated not only from residential ISPs but also from corporate, government, and military networks, amplifying the potential blast radius significantly. This incident exemplifies the growing threat of abandoned-software supply-chain attacks, where unpatched updaters tied to expired domains become persistent, low-cost entry points. As organizations accumulate shadow IT and forgotten consumer applications on managed endpoints, adversaries increasingly scout lapsed domains as cheap vectors for mass exploitation—making software lifecycle governance and egress traffic enforcement critical defensive priorities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
Government Administration2 weeks ago

BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks

In early 2026, APT41-affiliated threat actors deployed a sophisticated UEFI bootkit dubbed BlackX against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Derived from the notorious BlackLotus bootkit, BlackX exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched Windows systems where administrators failed to apply mandatory manual revocation steps—specifically blocklisting the 'Windows Production PCA 2011' certificate in the UEFI DBX. After gaining administrator privileges through an undisclosed initial access vector, attackers installed a kernel-level driver, a RAT using Google Drive and OneDrive for C2, and the OxiDLLRunner DLL sideloader, achieving persistent, covert espionage access across high-value government networks. This incident underscores a growing APT trend of repurposing commercial crimeware tooling—bridging cybercrime and state-sponsored espionage—to maintain firmware-level persistence that survives OS reinstalls and endpoint detection. As UEFI-based implants proliferate among nation-state actors, organizations face pressure to close patch-management gaps that go beyond standard Windows Update cycles and require manual firmware-layer hardening.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Computer Software/Engineering2 weeks ago

Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.

In October 2026, Ruby disclosed three critical bugs in Onigmo, its built-in regular expression engine, that collectively enabled four remote code execution vulnerabilities in GitLab—two rated CVSS 9.9 and two rated a perfect 10.0. GitLab compiles user-supplied regex patterns in features such as CI/CD configuration, and a specially crafted pattern could corrupt memory during compilation, granting an unauthenticated attacker full code execution on GitLab's servers. The unauthenticated flaws, CVE-2026-97229 and CVE-2026-110264, affect every GitLab version from 7.0 onward. Patched Ruby builds (4.0.9, 3.4.12, 3.3.13) and corresponding GitLab releases (19.5.1 down to 18.11.13) were shipped between September 23 and October 21, 2026. This incident highlights a systemic supply-chain risk: a single language-level regex engine flaw propagated into multiple critical application CVEs. As DevSecOps pipelines rely heavily on Ruby-based tooling and GitLab-hosted workflows, organizations must treat upstream language runtime patches with the same urgency as direct application patches, and implement inline traffic inspection to detect exploitation attempts before patches can be applied.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week
When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week
Retail Industry2 weeks ago

When AI Becomes the Attacker: How a $25 Campaign Breached 27 Companies in a Week

In September 2026, a Chinese-speaking threat actor deployed three agentic AI frameworks — Hermes, Strix, and Cairn — against 105 e-commerce targets over five days, compromising at least 27 organizations, including a Fortune 500 company. The autonomous system stole more than 600,000 payment card records, planted credit-card skimmers on five sites, and gained unauthorized access across the remainder, all at an average cost of $25.46 per completed target. Parallel research by Silverfort demonstrated that a publicly available Claude Opus agent could escalate initial access to full domain control in eight minutes for roughly $12, confirming that agentic AI has industrialized the entire attack chain. This campaign signals a structural shift in the threat landscape: autonomous AI eliminates the skilled-attacker bottleneck, collapsing marginal attack costs to near zero. With initial-access prices on dark markets already falling from $1,400 to $429, and ransomware activity up 45% in 2026 despite fewer ransom payments, the economics now decisively favor attackers — demanding that defenders rethink architecture, not just tooling.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market
SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market
Banking/Mortgage2 weeks ago

SBI's 2026 PII Leak: How a Small Breach Feeds India's Multi-Million-Record Underground Data Market

In October 2026, the State Bank of India (SBI) disclosed a customer data breach after a threat actor operating under the alias 'Siriusim' published 3,897 customer records—along with a table of 375,000 rows and 2,722 PDF files—on BreachForums. The exposed PII included names, mobile numbers, email addresses, dates of birth, home addresses, KYC documentation, Central KYC numbers, video KYC verification data, loan application metadata, and employment declarations. SBI confirmed the incident via a formal notice to India's National Stock Exchange, while stressing that core banking operations remained unaffected. The breach is suspected to have originated from a peripheral data-handling or digital-services system rather than SBI's core banking platform. This incident underscores the compounding risk that even small PII leaks create within India's mature underground data economy, where threat actors cross-reference breach dumps with real-time lookup services to build high-fidelity identity profiles for phishing, vishing, loan fraud, and impersonation attacks—amplifying the harm far beyond the raw record count.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise
Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise
Information Technology/IT2 weeks ago

Storm-0940's AI-Powered Supply Chain Attack: How Agentic AI Breached 2,250 Microsoft 365 Tenants Through ConnectWise

In October 2026, Microsoft attributed a large-scale supply chain attack against ConnectWise Cloud Backup to Storm-0940, a China-linked threat actor. Exploiting compromised application credentials tied to ConnectWise's authorized Microsoft 365 integrations, Storm-0940 deployed an agentic AI penetration-testing framework called ARTEX to automate reconnaissance, password spraying, and OAuth application abuse at scale—targeting more than 2,250 downstream customer tenants across manufacturing, aerospace, energy, defense, and financial services. In several cases, attackers achieved privileged cloud persistence in under three hours, generating up to 2,900 sign-in attempts per minute. ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services in response. This incident marks a watershed moment in AI-enabled offensive operations. Storm-0940's use of ARTEX demonstrates that nation-state actors are now weaponizing agentic AI to exponentially accelerate attack timelines, compress defender response windows, and scale supply chain compromise across thousands of organizations simultaneously—elevating the urgency of zero trust, segmentation, and multicloud visibility controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
Information Technology/IT2 weeks ago

PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet

In October 2026, threat actors launched millions of exploitation attempts against two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)—targeting unauthenticated remote code execution via crafted HTTP requests. Attackers attempted to deploy the Mirai-derived Potassium botnet, which uses ChaCha20-encrypted configuration, ENS-based C2 resolution, and supports 24 DDoS flood commands across ICMP, TCP, UDP, and OpenVPN protocols. Cloudflare observed hundreds of thousands of exploit attempts within two hours of public disclosure, escalating to millions by October 22. Over 34.4 million PHP services remained vulnerable as of October 23, prompting precautionary shutdowns of government, hospital, and school websites across Asia, Europe, and North America. PHP2Shell is drawing comparisons to Log4Shell due to its deep engine-level origin dating to PHP 5.4 (2012), meaning no application-layer fix suffices. With 56.6 million web properties running PHP and patches unavailable for end-of-life branches, organizations face a prolonged exposure window. The rise of ASLR-bypass techniques and automated exploit toolkits signals escalating attacker sophistication targeting cloud-hosted and shared-hosting PHP environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers
Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers
Internet2 weeks ago

Node2Shell: How a Crafted Brotli Payload Delivers Remote Code Execution on Unpatched Node.js Servers

In October 2026, security researchers at Imperva publicly demonstrated Node2Shell, a proof-of-concept remote code execution exploit targeting CVE-2026-111497, a memory corruption flaw in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x. By feeding crafted malformed Brotli-compressed data through HTTP request bodies or response paths—including via Express 5 middleware such as express.json()—attackers can trigger an out-of-bounds write, ultimately executing arbitrary attacker-supplied code on unpatched servers. Node.js released patched builds on October 21, 2026; no in-the-wild exploitation had been confirmed as of October 22, 2026. This incident highlights the compounding risk of trusted, bundled dependencies in widely deployed runtimes. As Node.js underpins millions of cloud-native APIs and microservices, a single decoder flaw becomes a systemic supply-chain-adjacent threat. The rise of middleware-enabled attack surfaces—where standard Express body parsers silently expand exposure—underscores the urgency of runtime patching and network-layer inspection for modern cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports