Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports

Page 20 of 316

Explore Other Sectors

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Other Industry Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Showing 229–240 / 3786 reports

Information Technology/IT2 weeks ago

Node.js Brotli Decoder RCE (CVE-2026-111497): What Cloud-Native Teams Must Do Now

On October 21, 2026, the Node.js project released security updates for all three supported release lines (22.x, 24.x, 26.x), patching ten vulnerabilities including a high-severity out-of-bounds write in the bundled Brotli decompression library (CVE-2026-111497). The flaw enables potential remote code execution when an attacker supplies malformed Brotli-compressed input to any application using Node.js's native zlib module or the fetch() API. Three additional high-severity CVEs address TLS hostname-check bypasses and DNS null-byte truncation. End-of-life lines (Node.js 20.x and earlier) will not receive patches, leaving a significant portion of deployed infrastructure unprotected. This incident underscores the systemic risk of bundled third-party libraries in widely deployed runtimes. As supply-chain attacks and dependency exploitation become primary threat vectors, organizations running Node.js in cloud-native, microservices, or serverless environments face elevated exposure—particularly where Brotli-compressed traffic flows between internal services or from untrusted external sources.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT2 weeks ago

How a GitHub Token Trapped in AI Gateway Logs Brought Down LiteLLM's Release Pipeline

On October 21, 2026, LiteLLM's release pipeline was compromised, resulting in the publication of malicious package version 1.107.0 to PyPI, Docker Hub, and GHCR. Attackers exploited GitHub CLI OAuth tokens that had been inadvertently logged by Claude Code in LiteLLM's internally exposed AI gateway deployment. Using these stolen credentials, the attacker disabled branch protections, redirected the signing workflow to a lookalike repository, and published a poisoned artifact embedding a credential stealer and a persistent RAT. Within 4.5 hours of exfiltration, attackers began validating stolen AWS credentials and performing LLMjacking reconnaissance against Bedrock and IAM services. This incident underscores an emerging and underappreciated risk: AI coding assistants and LLM gateway proxies can inadvertently log sensitive authentication tokens, creating a new credential-leak surface. As enterprises accelerate AI adoption, supply-chain attacks targeting AI infrastructure tooling are becoming a primary threat vector, demanding stricter secrets hygiene, pipeline integrity controls, and real-time egress monitoring for developer environments.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

Railway's 2026 LLMjacking Breach: When PaaS Secrets Become the Attack Surface

In October 2026, Platform-as-a-Service provider Railway disclosed that an unauthorized third party accessed systems storing customer environment variables, potentially obtaining decrypted contents including API keys, database credentials, and private keys. The attacker, identified on-chain as 0xd9773325282874d18cb83f1fe50f14c39750b2ee, drained cryptocurrency wallets whose private keys were stored on Railway before the incident was publicly disclosed. Railway rotated all bucket credentials, invalidated API tokens, and urged customers to rotate all stored secrets. The campaign is assessed to be part of a coordinated series of attacks targeting PaaS platforms to compromise AI inference providers—a technique known as LLMjacking. This incident illustrates the accelerating convergence of cloud credential theft and AI resource abuse. Threat actors are systematically targeting PaaS and cloud environments not merely for data theft but to commandeer AI compute capacity, shift billing costs to victims, and build autonomous offensive AI agents—a trend that fundamentally raises the stakes for any organization hosting AI workloads or secrets in cloud-native environments.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619

In October 2026, CISA issued an urgent alert disclosing two critical unauthenticated remote code execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 and collectively dubbed 'php2shell.' These flaws affect all PHP installations serving web requests across versions 8.1 through 8.4, enabling attackers to execute arbitrary code without any authentication. CISA directed organizations to immediately upgrade to patched releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35), take unpatched PHP systems offline, and monitor for PHP worker processes spawning shells or downloading attacker tooling. The breadth of PHP's deployment across web infrastructure makes this a high-severity, wide-blast-radius exposure. The php2shell vulnerabilities underscore an accelerating trend of attackers targeting foundational web runtime components rather than application-layer logic. As exploit weaponization timelines compress from weeks to hours post-disclosure, organizations with large PHP footprints—especially those running legacy or embedded PHP dependencies—face elevated risk of pre-patch compromise through automated scanning campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Computer Software/Engineering2 weeks ago

Silent Patch, Critical Risk: How a Malicious MCP Server Can Own a Developer's Machine Through OpenCode

In late September 2026, a critical remote code execution vulnerability (severity 9.8/10) was discovered in OpenCode, an AI coding agent developed by Anomaly. The flaw allowed a malicious or compromised MCP (Model Context Protocol) server to execute arbitrary code on a developer's Windows or WSL machine during the OAuth sign-in flow. OpenCode passed the server-supplied authorization endpoint URL to a PowerShell-based browser-launch helper without sanitizing it, enabling command injection. Affecting versions 1.0.137 through 1.18.32, the bug was silently patched in version 1.18.33 on September 28, 2026, without a CVE assignment or public advisory, leaving many installations unknowingly exposed. This incident underscores the expanding attack surface introduced by AI agent ecosystems and MCP server integrations. As agentic AI tooling proliferates in developer workflows, supply-chain and third-party plugin compromises represent a growing vector. The absence of a CVE means automated scanners cannot flag affected versions, amplifying organizational risk and highlighting gaps in AI-era software disclosure practices.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT2 weeks ago

PHP2Shell: Critical Unauthenticated RCE Hits Every Major PHP Server API

In October 2026, the PHP project disclosed two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell, affecting all mainstream PHP server APIs including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Both flaws carry a CVSS 4.0 score of 9.2 and require no user interaction or prior authentication. CVE-2026-109618 exploits out-of-memory corruption during partial request initialization, while CVE-2026-109619 leverages stale global state surviving across worker requests. Fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released October 21, 2026, with wild exploitation confirmed on the same day. PHP2Shell represents the most broadly impactful PHP vulnerability class in years, exposing virtually every organization running PHP web infrastructure. With exploitation confirmed in the wild and no viable mitigation short of patching, this incident underscores the accelerating trend of unauthenticated, pre-authentication RCE attacks targeting foundational web runtime components rather than application-layer logic.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT2 weeks ago

How Storm-0940 Used AI to Hack Hundreds of Companies in Hours via ConnectWise

Beginning September 2026, Storm-0940, a China-state aligned threat actor active since 2021, weaponized ARTEX—an open-source agentic AI penetration-testing framework—to automate large-scale attacks against hundreds of organizations across aerospace, defense, financial services, government, and technology sectors globally. The actor exploited a supply chain compromise of ConnectWise's multi-tenant cloud backup application, using ARTEX to conduct password spraying at 2,900 attempts per minute, OAuth token theft, and Microsoft Graph reconnaissance. In several confirmed intrusions, privileged cloud access was achieved in under three hours, with follow-on activity including application credential modification, privileged role self-assignment, and persistent backdoor establishment across victim Microsoft 365 tenants. This incident marks a watershed moment in nation-state offensive operations: AI-driven automation has collapsed the attacker dwell-time advantage that defenders historically relied upon. As agentic AI frameworks become commoditized and open-source, the barrier to executing sophisticated, multi-stage supply chain compromises at machine speed is dramatically lowered, forcing organizations to rethink detection and response timelines and elevate cloud identity governance to a board-level priority.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT2 weeks ago

Two Critical PHP RCE Vulnerabilities Patched in 2026: What Security Teams Must Do Now

In October 2026, PHP maintainers disclosed and patched two critical unauthenticated remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. The first flaw exploits out-of-memory handling that interrupts PHP during partial request initialization, causing request cleanup to treat invalid data as valid and enabling arbitrary code execution. The second flaw allows request-owned internal state to persist after its backing memory is freed, letting a subsequent request handled by the same worker consume stale state before initialization resets it. All major PHP server configurations—including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed—are affected, with mod_php carrying the highest demonstrated risk. No authentication is required to trigger either vulnerability, meaning exploitation can occur before any application-layer code executes. These vulnerabilities represent a systemic risk to the global web stack, as PHP powers an estimated 77% of server-side websites. The disclosure arrives amid a broader surge in exploitation of web-tier vulnerabilities by both opportunistic actors and nation-state groups, reinforcing the urgency of rapid patching cycles and layered network controls to contain blast radius when patch deployment is delayed.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT2 weeks ago

Storm-0940 and ARTEX: How China's AI-Powered Agents Hijacked ConnectWise and 2,250 Microsoft 365 Tenants

In October 2026, Microsoft attributed a sophisticated supply-chain attack against ConnectWise's Cloud Backup service to Storm-0940, a China-state aligned threat actor active since 2021. The group leveraged ARTEX, an open-source agentic AI penetration testing framework, to automate password-spraying at 2,900 sign-in attempts per minute, ultimately targeting more than 2,250 Microsoft 365 tenants across eight organizations. AI agents autonomously progressed from initial authentication through reconnaissance, OAuth abuse, credential modification, and privilege escalation with minimal human interaction. ConnectWise temporarily shut down services following the attack, and Microsoft confirmed evidence of follow-on persistence activity in multiple customer environments. This incident marks a critical inflection point in nation-state tradecraft: the weaponization of agentic AI frameworks enables adversaries to compress attack timelines from days to minutes, outpacing human defenders. The combination of supply-chain entry, AI-driven automation, and OAuth abuse signals a new era of high-velocity, low-visibility intrusions that demand equally automated defensive countermeasures.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer/Network Security2 weeks ago

When the Number 4 Kills a Certificate Authority: The eMudhra PKI Collapse

In April 2025, Indian certificate authority eMudhra conducted a key generation ceremony that produced critically weak private keys for eight intermediate SSL/TLS certificates. The keys were so poorly generated — some as small as the integer 4 — that security researcher Scott Helme reconstructed all eight on a laptop in under one second. Major browser vendors including Chrome, Firefox, Apple, and Microsoft revoked trust within days. Mozilla removed eMudhra's root certificate entirely, and Google announced imminent Chrome root removal. Facing regulatory scrutiny from CERT-In, a 40% share price collapse, and reputational damage, eMudhra's board voted to exit the certificate authority business altogether. This incident highlights how a single procedural failure in a cryptographic ceremony can instantaneously nullify an entire trust hierarchy. As PKI underpins HTTPS, code signing, and enterprise identity, the fragility exposed here is resonating across the industry at a moment when regulators and browser consortiums are tightening CA accountability standards and scrutinizing key generation practices globally.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Use AWS WAF as a Bridge While You Patch

On October 21, 2026, the PHP project issued emergency patches for two critical unauthenticated remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively named PHP2Shell, both rated 9.2 (Critical) under CVSS v4.0. The flaws reside in PHP's multipart/form-data request processing layer, meaning attackers can trigger arbitrary code execution before any application logic runs. CVE-2026-109618 exploits an out-of-memory memory corruption condition, while CVE-2026-109619 abuses stale global state persisting across PHP worker processes. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Amazon Threat Intelligence detected active exploitation via MadPot prior to public disclosure, confirming real-world weaponization. PHP2Shell underscores how pre-application-layer vulnerabilities in widely deployed runtimes can bypass traditional application-level defenses entirely. With PHP powering an estimated 77% of server-side web infrastructure, the blast radius is enormous. Organizations relying solely on application-layer WAF rules without addressing runtime configuration and patch cadence remain exposed, highlighting the necessity of layered, defense-in-depth network security architectures that extend from the edge to workload internals.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Banking/Mortgage2 weeks ago

When the Lock Itself Is Broken: The eMudhra PKI Compromise and What It Means for Encrypted Infrastructure

In October 2026, certificate authority eMudhra disclosed that eight intermediate CA certificates issued in April 2025 contained critically weak P-384 private keys with values as low as 4—making them trivially recoverable by any attacker. Security researcher Wayne discovered the flaw on October 17, 2026, while scanning public certificate transparency logs. Because major browsers and operating systems trusted these certificates, a malicious actor possessing the recovered private keys could have forged trusted TLS certificates for any website, enabling man-in-the-middle interception of encrypted communications at scale. Mozilla, Google Chrome, and Apple responded within days by revoking and blocking the affected intermediates, and eMudhra halted issuance under its G3 root. This incident underscores a growing pattern of PKI supply-chain failures where procedural errors in certificate generation—rather than external exploits—introduce systemic trust vulnerabilities. As organizations increasingly depend on TLS for zero-trust enforcement and encrypted data-in-transit assurance, a single compromised CA intermediate can silently undermine those controls across entire ecosystems for months before detection.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...18 19 20 21 22...316

[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports

Information Technology/IT

Node.js Brotli Decoder RCE (CVE-2026-111497): What Cloud-Native Teams Must Do Now

How a GitHub Token Trapped in AI Gateway Logs Brought Down LiteLLM's Release Pipeline

Railway's 2026 LLMjacking Breach: When PaaS Secrets Become the Attack Surface

php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Silent Patch, Critical Risk: How a Malicious MCP Server Can Own a Developer's Machine Through OpenCode

PHP2Shell: Critical Unauthenticated RCE Hits Every Major PHP Server API

How Storm-0940 Used AI to Hack Hundreds of Companies in Hours via ConnectWise

Two Critical PHP RCE Vulnerabilities Patched in 2026: What Security Teams Must Do Now

Storm-0940 and ARTEX: How China's AI-Powered Agents Hijacked ConnectWise and 2,250 Microsoft 365 Tenants

When the Number 4 Kills a Certificate Authority: The eMudhra PKI Collapse

PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Use AWS WAF as a Bridge While You Patch

When the Lock Itself Is Broken: The eMudhra PKI Compromise and What It Means for Encrypted Infrastructure

Stop Active Cloud Data Exfiltration

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Information Technology/IT