Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical WordPress Admin Bypass: miniOrange SAML Vulnerabilities Under Active Attack
In August 2026, security researchers discovered two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, allowing attackers to gain administrator access without credentials. CVE-2026-61979 and CVE-2026-15981 stem from signature validation flaws that enable attackers to craft malformed SAML responses and bypass authentication entirely. Active exploitation attempts have been observed from multiple IP addresses in what appears to be opportunistic scanning campaigns targeting vulnerable WordPress sites. The vulnerabilities affect the plugin's signature verification process, where malformed signatures trigger OpenSSL errors that are incorrectly treated as valid authentication. DigitalOcean's security team first identified the threat when they detected anomalous admin session attempts from outside their trusted network, revealing an attacker had already obtained admin cookies through these exploits. This incident highlights the growing trend of attackers targeting identity and authentication systems, particularly SAML implementations that serve as critical trust boundaries in enterprise environments. With proof-of-concept code now available and active scanning campaigns underway, organizations face immediate risk from these easily exploitable vulnerabilities.
3 weeks ago
Kill Chain
E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels
Cybersecurity researchers have identified a sophisticated new campaign employing FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) named E4del and PINHOLE. The threat actors behind this campaign are exploiting legitimate FTP services to establish command-and-control infrastructure while blending seamlessly with regular network traffic. This novel technique allows attackers to maintain persistent access to compromised systems while evading traditional detection methods that focus on more conventional C2 communication channels. The campaign demonstrates advanced operational security awareness and represents a significant evolution in how threat actors establish and maintain covert communication channels. This incident highlights the growing trend of threat actors exploiting legitimate services and protocols for malicious purposes, making detection increasingly challenging for traditional security tools. As organizations continue to expand their digital infrastructure, the abuse of standard network services like FTP for covert communication channels represents a critical blind spot in many security monitoring strategies.
3 weeks ago
Kill Chain
How Frontier AI Models Are Forcing a Vulnerability Management Revolution
The emergence of Frontier AI models like Anthropic's Mythos has fundamentally disrupted traditional vulnerability management practices by enabling machine-speed identification of zero-day flaws and automated exploit chaining. Organizations previously relying on CVSS scores, EPSS rankings, and CISA's KEV list now face an accelerated threat landscape where vulnerabilities are weaponized faster than legacy patching cycles can address them. This paradigm shift demands immediate transformation of vulnerability management programs toward exposure management frameworks that assess true organizational risk beyond traditional scoring metrics. The revolution requires automated patch deployment strategies, ring-based testing methodologies, and critical stakeholder conversations about uptime requirements versus security imperatives in an era of AI-driven exploit development. This transformation represents a critical inflection point as cybersecurity programs must evolve from reactive, siloed approaches to proactive, integrated vulnerability and patch management ecosystems capable of matching AI-driven threat velocity.
3 weeks ago
Kill Chain
How 24 Malicious npm Packages Turned Trusted Mirrors into Phishing Infrastructure
In August 2026, cybersecurity researchers discovered a sophisticated supply chain attack involving 24 malicious npm packages that exploited unpkg mirrors to host fake Cloudflare CAPTCHA pages. The threat actors embedded HTML files within npm packages that, when accessed through mirrors like unpkg.com, rendered convincing phishing pages designed to trick users into malicious actions. The campaign initially redirected victims to typosquat Microsoft login domains before pivoting to abuse KeyVal, a legitimate key-value store service, as a dead drop resolver to dynamically control redirection targets. This incident highlights the evolving threat landscape where attackers increasingly abuse legitimate infrastructure and trusted domains to bypass security controls. Supply chain attacks continue to surge as organizations struggle with securing third-party dependencies, while threat actors demonstrate growing sophistication in leveraging trusted services for malicious infrastructure, making detection and prevention more challenging for traditional security tools.
3 weeks ago
Kill Chain
Mirage2FA Campaign Exposes Critical Gaps in Traditional MFA Security
The Mirage2FA phishing-as-a-service campaign targeted over 4,500 organizations across the US and EU from 2024 to 2026, exploiting Microsoft 365 login flows to bypass two-factor authentication. Using adversary-in-the-middle (AiTM) techniques, attackers stole passwords and session cookies, achieving a 48% compromise rate among targeted email addresses. The campaign primarily affected US-based companies in technology, manufacturing, and education sectors, with attackers gaining authenticated access to Microsoft 365 sessions and SSO-connected services, enabling account impersonation and data theft. This incident highlights the evolving threat landscape where traditional MFA is insufficient against sophisticated phishing operations that steal active sessions rather than just credentials, demonstrating the urgent need for phishing-resistant authentication methods and enhanced session management controls.
3 weeks ago
Kill Chain
Critical Code Injection Flaw in Marimo Notebooks Exposes AI Development Environments
In August 2026, Marimo addressed a critical code injection vulnerability (CVE-2026-75149) in its notebook software that allowed attackers to execute malicious Model Context Protocol (MCP) commands through specially crafted notebooks. The flaw, scoring 8.7-8.8 on CVSS scales, enabled arbitrary command execution as local subprocesses when victims opened malicious notebooks in edit mode, requiring no authentication but needing user interaction. Marimo patched the vulnerability in version 0.23.15 by implementing configuration allowlisting to treat notebook metadata as attacker-controlled content. This incident highlights the growing security risks in AI development environments as organizations increasingly adopt notebook-based workflows for machine learning and data science projects. With the rise of collaborative AI development and shared notebook repositories, similar supply chain attacks targeting development tools are becoming more prevalent.
3 weeks ago
Kill Chain
CISA Escalates Oracle HTTP Server Vulnerability to KEV Status After Active Exploitation
CISA has added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability poses significant risks to federal enterprises and allows attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and data compromise. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities that grant total control of assets post-exploitation. This incident highlights the ongoing trend of state-sponsored and cybercriminal groups increasingly targeting enterprise web infrastructure vulnerabilities, particularly Oracle systems that are widely deployed across government and critical infrastructure sectors, making immediate patching and risk assessment essential.
3 weeks ago
Kill Chain
Critical NVIDIA NemoClaw Vulnerability Enables AI Model Hijacking Through Web Browsers
In August 2026, Oasis Security disclosed a critical vulnerability in NVIDIA NemoClaw that allows malicious webpages to gain unauthenticated control over local Ollama AI model instances through DNS rebinding attacks. The vulnerability exploits NemoClaw's configuration that binds Ollama to all network interfaces (0.0.0.0:11434) on Windows and WSL systems, bypassing authentication and CORS protections. Attackers can poison AI model chat templates with hidden instructions that persist across conversations, effectively taking control of AI agents and their associated tools and permissions. NVIDIA partially addressed the issue in v0.0.35 for macOS and Linux, but Windows installations remain vulnerable with only warnings implemented. This vulnerability highlights the growing attack surface of AI infrastructure and the critical need for secure-by-default configurations in AI development frameworks, particularly as organizations rapidly deploy AI agents with access to sensitive systems and data.
3 weeks ago
Kill Chain
How Hostname Obfuscation Bypasses Cloud Security in SSRF Attacks
Attackers are increasingly using hostname obfuscation techniques to bypass IP-based blocklists in Server-Side Request Forgery (SSRF) attacks targeting cloud metadata services. Security researchers at SANS identified multiple methods where threat actors convert blocked IP addresses like 169.254.169.254 into resolvable hostnames using services like nip.io, sslip.io, and dynamic DNS tools such as 1u.ms. These techniques allow attackers to circumvent traditional IP filtering defenses and access sensitive cloud instance metadata, potentially leading to credential theft and privilege escalation in cloud environments. This attack vector represents a growing trend in cloud-native security evasion techniques, highlighting the inadequacy of simple blocklist-based defenses against modern SSRF exploitation methods targeting AWS, Azure, and GCP metadata services.
3 weeks ago
Kill Chain
AI-Enabled Malware in 2026: Separating Reality from Research Hype
Unit 42 researchers analyzed 405 AI-enabled malware samples between December 2024 and June 2025, discovering that only 12 samples (3%) reached production environments while 97% existed solely in research repositories and sandboxes. The study revealed that AI-enhanced threats like FunkSec ransomware, trojanized AI applications, and information stealers were successfully detected by existing security mechanisms without requiring novel detection approaches. All samples that attempted to reach customer environments were blocked by Palo Alto Networks products using behavioral analytics, sandbox analysis, and entropy detection. This research demonstrates the current reality of AI-powered cyber threats as threat actors increasingly integrate large language models into malware development cycles, accelerating iteration speeds and lowering barriers to entry while traditional security controls remain effective.
3 weeks ago
Kill Chain
South Korean Government Platform Breach Exposes 5,000 Records Due to Key Management Failures
In July 2026, South Korea's government-backed startup support platform Modu-ui Changup suffered a data breach affecting approximately 5,000 applicants. The incident occurred when encryption keys were improperly exposed through API responses, allowing attackers to decrypt previously encrypted personal information including email addresses, startup ideas, and evaluation comments. Investigators identified 39 South Korean IP addresses involved in accessing the leaked data through AI-based web crawling techniques, with the breach attributed to fundamental failures in encryption key management architecture. This incident highlights the growing threat landscape where traditional encryption approaches fail when key management practices are inadequate, particularly as AI-driven attack methods become more sophisticated and government platforms face increased scrutiny for data protection failures.
3 weeks ago
Kill Chain
ReliaQuest Breach Exposes Critical Identity Security Gaps in Social Engineering Defense
In August 2026, cybersecurity firm ReliaQuest fell victim to a sophisticated social engineering attack orchestrated by the ShinyHunters extortion group. Attackers impersonated ReliaQuest security team members via phone calls, directing employees to a fraudulent SSO page hosted on the lookalike domain reliaquest.claims. One employee was successfully deceived into entering credentials and approving an MFA push notification, granting attackers temporary view-only access to ReliaQuest's Okta identity dashboard. However, device-trust controls successfully prevented access to applications and systems, limiting the breach's scope to credential exposure only. This incident highlights the evolving sophistication of social engineering attacks targeting identity systems, particularly as threat actors increasingly combine vishing techniques with credential harvesting. The attack demonstrates how even cybersecurity companies with robust controls can be vulnerable to human-focused attack vectors, emphasizing the critical need for comprehensive identity protection beyond traditional MFA implementations.
3 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports