Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 18 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 205–216 / 3786 reports
When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities
When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities
Financial Services2 weeks ago

When AI Agents Pay the Attacker: Inside the Critical x402 SDK Vulnerabilities

In October 2026, security firm V12 disclosed 25 vulnerabilities in the x402 open-source SDK — a Coinbase-created, Linux Foundation-governed protocol enabling AI agents to autonomously make cryptocurrency micropayments during API calls. Three flaws were rated critical and all were silently patched in August 18 releases without public security advisories. The most severe allowed a malicious API to request an AI agent's entire token wallet balance, exploiting the default client's lack of spending limits. Additional critical flaws enabled a complete Solana payment bypass via token approval spoofing and cross-site login signature relay attacks. No package manager warnings were issued, leaving developers unaware of the risk. This incident signals a maturing threat surface around agentic AI and autonomous payment systems. As AI agents increasingly operate with financial autonomy — signing transactions without human approval — supply-chain vulnerabilities in foundational SDKs become high-stakes attack vectors. The combination of silent patching, absent CVE assignments, and no package manager advisories reflects a systemic disclosure gap the industry must urgently address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk
CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk
Computer Software/Engineering2 weeks ago

CVE-2026-112900: How a Crafted Filename Turns Python's Most Popular Image Library Into a Remote Code Execution Risk

In October 2026, security researchers at OX Security disclosed three critical vulnerabilities in Pillow, Python's most widely used image processing library, downloaded approximately 436 million times per month. The most severe flaw, CVE-2026-112900 (CVSS 9.2), allows remote code execution via crafted EPS filenames passed unsanitized to Ghostscript, enabling an attacker who controls a filename to execute arbitrary OS commands on the server. Two additional critical flaws affect JPEG (FPX format) and TIFF in-memory processing pipelines. All three were patched in Pillow 13.0.0 released October 16, 2026. No active exploitation has been confirmed, though a proof-of-concept exists for the TIFF flaw. These vulnerabilities are emblematic of a broader supply-chain risk pattern: a single transitive dependency embedded across web upload forms, ML pipelines, document processors, and container images can silently expose thousands of applications. As AI-assisted vulnerability research (demonstrated here by Anthropic's Claude) accelerates flaw discovery, organizations must treat open-source image libraries as high-priority attack surface in their software supply chain programs.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
Information Technology/IT2 weeks ago

70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026

Between February and June 2026, a threat actor tracked as k0t (aliases: CryptoFeel, Member19, QazWsxShop) executed a large-scale credential harvesting campaign against internet-exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices worldwide. Leveraging public scanning tools such as FOFA and ZoomEye, k0t enumerated vulnerable edge appliances and exploited CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS authentication bypass) via bespoke Python scripts. Post-exploitation actions included Active Directory enumeration, persistence via MeshCentral, Atera, and AnyDesk, and data exfiltration through Rclone to Wasabi S3 and MEGA. Over 70,000 credentials were harvested, with victims spanning Asia Pacific, Latin America, Europe, and MENA. This campaign underscores the accelerating role of initial access brokers (IABs) feeding ransomware groups such as Qilin and The Gentlemen. With edge device exploitation now industrialized through automated scanning and off-the-shelf exploit scripts, organizations relying solely on perimeter firewalls face systemic credential exposure risk—making zero trust segmentation and encrypted east-west traffic controls critically urgent.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure
PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure
Internet2 weeks ago

PHP's Double Vulnerability Crisis: What CVE-2026-115560 and PHP2Shell Mean for Your Cloud Infrastructure

In October 2026, PHP disclosed a second unpatched remote code execution vulnerability, CVE-2026-115560, just two days after emergency patches addressed the critical PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619. The PHP2Shell vulnerabilities, patched on October 21 in versions 8.2.35 through 8.5.12, allowed unauthenticated attackers to execute code on web servers. Exploitation attempts surged from tens of thousands within 45 minutes of disclosure to millions by October 22, with threat actors attempting to deploy a Mirai botnet variant. CVE-2026-115560 affects a narrow configuration involving session serialization handler switching and requires disabling session upload progress as a temporary mitigation. This incident illustrates the compounding risk of staggered vulnerability disclosures in widely deployed open-source runtimes. The rapid weaponization of PHP2Shell flaws—with honeypot detections four days before official disclosure—signals increasingly shortened exploit development windows, forcing organizations to treat patch cadence and network-layer egress controls as non-negotiable security baselines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins
Information Technology/IT2 weeks ago

PHP RCE Vulnerability 2024: What Executives Need to Know Before Mass Exploitation Begins

In October 2024, SANS Internet Storm Center elevated its Infocon alert level in response to a critical PHP vulnerability affecting a broad range of web-facing applications, embedded devices, and appliances. The flaw—tied to PHP's session.upload_progress mechanism—enabled remote code execution, prompting coordinated disclosure across vendors including Cloudflare and Amazon, both of which reported large volumes of exploit attempts in the wild. Although no fully weaponized public exploit was confirmed at time of publication, security researchers warned that working exploit code was imminent. Patches were issued by php.net and major vendors, but incomplete coverage of embedded and legacy devices left significant attack surface exposed. This incident highlights a growing pattern of critical web-runtime vulnerabilities being exploited before organizations can fully patch their environments. The coordinated disclosure process succeeded, yet unpatched embedded devices and delayed enterprise patch cycles continue to represent systemic risk—underscoring why network segmentation and east-west traffic controls are essential backstops when software updates cannot be applied immediately.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
Transportation2 weeks ago

MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm

On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization. This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments
OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments
Financial Services2 weeks ago

OAuth Under Siege: How Attackers Hijack Tokens, Bypass MFA, and Persist Inside Enterprise Environments

As enterprises broadly adopted multi-factor authentication, adversaries pivoted from stealing passwords to harvesting OAuth tokens—the short-lived but often misconfigured credentials that govern application-level access. Unit 42 researchers documented in October 2026 how three attack classes—account hijacking via device authorization flow abuse, permission hijacking through consent-screen impersonation, and malicious OAuth redirect weaponization—now enable attackers to bypass MFA entirely, survive password resets, and maintain durable access to enterprise environments. PhaaS toolkits, LLM-generated brand impersonations, and dynamic runtime evasion have industrialized these campaigns, lowering attacker skill requirements while dramatically raising organizational risk. OAuth token hijacking represents a structural shift in the identity threat landscape: attackers no longer need to defeat authentication controls because they operate entirely in the authorization layer. With OAuth adoption expanding into critical infrastructure platforms such as Cloudflare DNS and CDN routing, the blast radius of a single compromised consent event has grown substantially, making token governance and admin-only consent workflows urgent enterprise priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
Financial Services2 weeks ago

eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust

In October 2026, Palo Alto Networks Unit 42 disclosed that eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect introduced during certificate generation. Insufficient entropy during key generation allowed attackers to mathematically derive private keys directly from the corresponding public certificates. With access to these keys, adversaries could sign unauthorized TLS certificates, enabling meddler-in-the-middle (MitM) traffic interception, domain impersonation, and session hijacking across any domain protected by eMudhra-issued certificates. Major browser and OS vendors moved swiftly to revoke trust in the affected intermediates, and eMudhra revoked all eight certificates. This incident underscores the fragility of global PKI trust hierarchies and the cascading risk posed by a single CA's cryptographic failure. As certificate lifespans compress to 47 days and supply-chain attacks targeting cryptographic infrastructure grow more frequent, organizations must adopt automated certificate lifecycle management and continuous CT log monitoring to detect and respond to unauthorized certificate issuance before adversaries exploit it.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GitLab's Max Severity RCE Flaw CVE-2026-110264: Why Your CI/CD Pipeline Is Now a Primary Attack Surface
GitLab's Max Severity RCE Flaw CVE-2026-110264: Why Your CI/CD Pipeline Is Now a Primary Attack Surface
Computer Software/Engineering2 weeks ago

GitLab's Max Severity RCE Flaw CVE-2026-110264: Why Your CI/CD Pipeline Is Now a Primary Attack Surface

In October 2026, GitLab disclosed CVE-2026-110264, a maximum-severity (CVSS 10.0) Remote Code Execution vulnerability rooted in an integer overflow flaw within GitLab's Regular Expression Compiler engine. An unauthenticated remote attacker could exploit this flaw by submitting a specially crafted regular expression, triggering arbitrary code execution on affected GitLab Community Edition and Enterprise Edition servers. GitLab patched the vulnerability across seven release versions and confirmed GitLab.com was already remediated. With over 2,700 internet-exposed CE instances tracked by Shadowserver and no authentication required, the attack surface is broad and the potential for supply chain compromise across GitLab's 30 million users is significant. This disclosure follows a pattern of cascading critical RCE and path traversal vulnerabilities in GitLab across 2026, one of which (CVE-2026-85706) was added to CISA's Known Exploited Vulnerabilities catalog within 24 hours of disclosure. The trend signals that DevSecOps platforms are increasingly targeted by threat actors seeking high-value footholds into software supply chains, CI/CD pipelines, and Fortune 100 development infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PHP2Shell: How Attackers Exploited Critical RCE Flaws Four Days Before Emergency Patches Arrived
PHP2Shell: How Attackers Exploited Critical RCE Flaws Four Days Before Emergency Patches Arrived
Internet2 weeks ago

PHP2Shell: How Attackers Exploited Critical RCE Flaws Four Days Before Emergency Patches Arrived

In October 2026, Amazon Threat Intelligence confirmed that active exploitation of two critical PHP remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—began four days before emergency patches were released on October 21. Attackers, operating from commercial VPN anonymization infrastructure, targeted honeypots as early as October 17, with multiple threat actors deploying proof-of-concept exploits hours after public disclosure. The PHP security team was forced to accelerate its coordinated release after CVE details and mitigation guidance leaked online two days prior. With PHP powering up to 80% of the internet, including WordPress, Drupal, and Joomla, over 3.8 million internet-exposed PHP hosts faced active risk during the zero-day window. This incident reinforces the growing reality of pre-patch exploitation windows, where threat actors acquire vulnerability intelligence through leaks or independent discovery before defenders can act. As zero-day and near-zero-day exploitation becomes standard attacker tradecraft, organizations must shift from patch-centric defense models toward runtime controls, network segmentation, and egress enforcement that limit blast radius independent of patch status.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
When 15 Seconds Is All It Takes: Machine Speed Attacks Demand Autonomous Response
When 15 Seconds Is All It Takes: Machine Speed Attacks Demand Autonomous Response
Computer Software/Engineering2 weeks ago

When 15 Seconds Is All It Takes: Machine Speed Attacks Demand Autonomous Response

In 2026, Exaforce documented a surge of sub-15-minute identity-driven attacks across enterprise environments. Three distinct patterns emerged: dormant OAuth tokens stolen from developer laptops via poisoned npm packages or infostealers were later weaponized to exfiltrate GitHub repositories at machine speed; ClickFix lures impersonating AI tool installers (Claude Code) deployed macOS stealers that harvested browser cookies and cloud credentials; and vishing campaigns mimicking IT help desks manipulated employees into approving real MFA prompts, granting attackers full session access within minutes. In one GitHub token case, 472 of 638 repositories were exfiltrated in under 15 seconds before containment actions could be authorized. These incidents expose a structural gap in enterprise security: detection platforms and identity providers flag anomalies but rely on human approval for response actions, leaving a critical window attackers now routinely exploit. The convergence of AI-lure social engineering, long-lived OAuth tokens, and incomplete session revocation across SaaS ecosystems signals a new normal where autonomous, low-friction response automation is no longer optional.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
Information Technology/IT2 weeks ago

CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN

In October 2026, Arista Networks disclosed and patched CVE-2026-114625, a critical zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was already being actively exploited in the wild. The flaw allows any authenticated user with basic privileges and access to the VCO web interface to escalate to operator-level privileges via low-complexity SQL injection, effectively masquerading as a local superuser. Attackers leveraging IP addresses 74.82.197.86 and 38.54.50.151 were observed exploiting the flaw, threatening the confidentiality, integrity, and availability of SD-WAN infrastructure and all data managed by the orchestrator. This is the fourth actively exploited zero-day patched by Arista in 2026 alone. This incident underscores a persistent and accelerating pattern: management-plane and orchestration-layer vulnerabilities in SD-WAN and network infrastructure are prime targets for threat actors. As enterprises consolidate network control into centralized orchestrators, a single privilege escalation flaw can hand attackers keys to the entire wide-area network, making rapid patch cadence and layered runtime controls non-negotiable.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports