Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 47 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 553–564 / 3786 reports
F5 BIG-IP OAuth Servers Under Attack: CVE-2026-94127 Zero-Day Analysis
F5 BIG-IP OAuth Servers Under Attack: CVE-2026-94127 Zero-Day Analysis
Financial Services1 month ago

F5 BIG-IP OAuth Servers Under Attack: CVE-2026-94127 Zero-Day Analysis

In September 2026, F5 disclosed CVE-2026-94127, a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager (APM) that allows unauthenticated remote code execution. The flaw affects systems where APM functions as an OAuth authorization server, with attackers exploiting malicious traffic sent to virtual servers to gain complete system control. F5 released emergency hotfixes after discovering active exploitation, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days. This incident highlights the growing threat to network infrastructure components that serve dual roles in authentication and traffic management. As organizations increasingly rely on OAuth-based authentication for cloud and hybrid environments, vulnerabilities in these critical junction points create significant attack surfaces that bypass traditional perimeter defenses.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Next.js ImageResponse Vulnerability Exposes Servers to Remote Code Execution
Critical Next.js ImageResponse Vulnerability Exposes Servers to Remote Code Execution
Computer Software/Engineering1 month ago

Critical Next.js ImageResponse Vulnerability Exposes Servers to Remote Code Execution

A critical vulnerability (CVE-2026-94545) was discovered in Next.js versions 16.2.0 through 16.3.5 affecting the ImageResponse feature used for generating Open Graph social preview images. The flaw, with a CVSS score of 9.5, allows attackers to execute server-side code by injecting malicious SVG content through user-controlled input when using the Node.js runtime. Vercel released a patch in Next.js 16.3.6 on September 22, 2026, addressing the vulnerability in the underlying Satori library that improperly escaped SVG output, enabling crafted payloads to be interpreted as executable code rather than plain text. This incident highlights the growing threat surface of modern web frameworks and the critical importance of input sanitization in server-side image generation features. As web applications increasingly rely on dynamic content generation and social media integration, vulnerabilities in these specialized components pose significant risks to application security and server infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation
Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation
Information Technology/IT1 month ago

Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation

A critical use-after-free vulnerability (CVE-2026-80521) in Ubuntu Linux's AF_UNIX socket subsystem allows attackers to escape containers and gain root access on host systems. Security firm DepthFirst published exploit code targeting Ubuntu 26.04, 24.04, and 22.04 LTS releases after discovering the flaw through AI-assisted research. The vulnerability affects the kernel's garbage collector for AF_UNIX sockets, creating a race condition that bypasses namespace isolation, cgroup limits, and seccomp filtering. While the upstream Linux kernel was patched in August 2026, Ubuntu has not yet shipped fixes for any affected releases, leaving containerized workloads vulnerable to privilege escalation attacks. This incident represents a growing trend of AI-accelerated vulnerability discovery making container escapes increasingly accessible to attackers. With nearly 5,700 Linux kernel CVEs published in 2026—the highest annual total on record—organizations must reconsider treating containers as security boundaries and adopt stronger isolation mechanisms like microVMs.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical cPanel Vulnerabilities Enable Complete Server Takeover Through Privilege Escalation
Critical cPanel Vulnerabilities Enable Complete Server Takeover Through Privilege Escalation
Internet1 month ago

Critical cPanel Vulnerabilities Enable Complete Server Takeover Through Privilege Escalation

In September 2026, cPanel disclosed three critical vulnerabilities affecting its hosting control panel software used by millions of websites worldwide. CVE-2026-87899, the most severe flaw, allows any hosting account holder to execute code as root through the CalDAV/CardDAV service, enabling complete server takeover. CVE-2026-87900 permits unauthorized database modifications across accounts via the WP Toolkit plugin, while CVE-2026-68490 enables reading other users' calendar and contact data. These vulnerabilities affect cPanel versions 120 and later, with fixes released across multiple version branches. These vulnerabilities highlight the growing threat to shared hosting infrastructure, where a single compromised account can lead to full server compromise affecting hundreds or thousands of websites. The timing coincides with increased scrutiny of web hosting security following recent supply chain attacks and the rise in ransomware targeting hosting providers.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CLOSEDQUORUM Malware Pioneers AI-Driven Autonomous Attacks Using Multiple Models
CLOSEDQUORUM Malware Pioneers AI-Driven Autonomous Attacks Using Multiple Models
Financial Services1 month ago

CLOSEDQUORUM Malware Pioneers AI-Driven Autonomous Attacks Using Multiple Models

Cisco Talos discovered CLOSEDQUORUM, a Windows infostealer malware that represents the first publicly documented implant to use AI models for command and control decisions. Instead of receiving orders from traditional C2 servers, the malware queries up to four commercial AI services (DeepSeek, Qwen, Mistral, and Google Gemini) to vote on its next actions, including credential theft, browser password extraction, and crypto wallet data harvesting. The malware sends basic system information to the AI models and executes the action receiving the most votes, with results communicated via Discord webhooks. While the public version contains placeholder values and is non-functional, Talos linked the developer to criminal carding forum activities dating to 2025. This incident highlights the emerging threat of AI-integrated malware, representing a significant evolution in autonomous attack capabilities that could reshape how cybercriminals conduct operations while creating new dependencies on commercial AI services.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MemTensor Supply Chain Attack Delivers Sckit Credential Stealer via npm and PyPI
MemTensor Supply Chain Attack Delivers Sckit Credential Stealer via npm and PyPI
Computer Software/Engineering1 month ago

MemTensor Supply Chain Attack Delivers Sckit Credential Stealer via npm and PyPI

In September 2026, unknown threat actors compromised legitimate MemTensor packages across npm and PyPI repositories, injecting a cross-platform Go-based credential stealer called 'sckit'. The malware targeted @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 on npm, and MemoryOS version 2.0.34 on PyPI. The implant harvested sensitive credentials from cloud services, source-code platforms, package registries, and developer tools, exfiltrating data to skyleen[.]fr. The attackers obtained publish tokens from MemTensor's GitHub Actions pipelines and designed the malware to self-proliferate like a worm through GitHub and direct package publishing. This incident highlights the growing sophistication of supply chain attacks targeting AI and machine learning ecosystems, where attackers increasingly exploit trusted development pipelines and package repositories to distribute credential-stealing malware at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Macfinger ClickFix Campaign Deploys AMOS Stealer Through Social Engineering
Macfinger ClickFix Campaign Deploys AMOS Stealer Through Social Engineering
Computer Software/Engineering1 month ago

Macfinger ClickFix Campaign Deploys AMOS Stealer Through Social Engineering

The Macfinger ClickFix campaign represents a sophisticated social engineering attack targeting macOS users through compromised legitimate websites. Attackers inject malicious JavaScript that displays fake bot verification pages, tricking users into executing commands that download and install AMOS (Atomic macOS) Stealer malware. The campaign uses fingerprinting techniques to specifically target macOS environments, with victims' systems subsequently exfiltrating credentials and sensitive data to command-and-control servers at 95.163.153.80. Post-infection analysis reveals persistent credential harvesting through API endpoints designed to steal stored passwords, browser data, and system information. This incident highlights the growing sophistication of social engineering attacks targeting macOS users, who have traditionally been less targeted than Windows environments. The campaign's use of legitimate compromised websites and convincing fake verification pages represents an evolution in ClickFix techniques, making detection more challenging for users and security tools alike.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Government Administration1 month ago

Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign

In September 2024, Volexity researchers identified UTA0565, a Chinese state-aligned threat group, exploiting a triple-chain of zero-day vulnerabilities in Chrome and Microsoft Windows. The group leveraged CVE-2026-85046, CVE-2026-87491 (Chrome JavaScript engine RCE flaws), and CVE-2026-85880 (Windows ALPC privilege escalation) between September 3-4, before patches were available. UTA0565 deployed sophisticated phishing campaigns targeting Asian government entities with fake websites impersonating legitimate organizations, ultimately delivering the previously undocumented CLEANGULP malware family for espionage operations. This incident represents a concerning trend of coordinated exploit sharing within China's cyber espionage ecosystem, as multiple threat groups including APT31 have weaponized the same vulnerability chains. The sophisticated nature of these attacks and their targeting of government entities highlights the escalating capabilities and coordination among state-sponsored actors in exploiting zero-day vulnerabilities for strategic intelligence collection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data
Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data
Government Administration1 month ago

Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data

In September 2026, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog after Chinese-speaking threat actors exploited a stack-based buffer overflow in Zyxel GS1900 series switches. The vulnerability allows unauthenticated attackers to execute OS commands via malicious HTTP requests. GreyNoise reported that attackers successfully compromised nearly 1,000 switches across 48 countries, exfiltrating sensitive data. CISA ordered federal agencies to patch by Thursday under BOD 26-04. This incident highlights the ongoing risk to network infrastructure devices that often lack proper security monitoring and timely patching. As threat actors increasingly target edge devices for initial access and data exfiltration, organizations must prioritize vulnerability management for network equipment beyond traditional endpoints and servers.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities
Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities
Computer Networking1 month ago

Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities

CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation by suspected Chinese threat actors. The attackers successfully compromised 996 Zyxel switches across 48 countries since August 2026, using crafted HTTP requests to execute operating system commands and deploy TFTP tools for data exfiltration. Simultaneously, Arctic Wolf reported active exploitation of CVE-2026-32996 in Veeam Agent for Windows, allowing local privilege escalation to SYSTEM-level access through manipulation of gRPC named pipe sessions. These incidents highlight the growing trend of threat actors rapidly weaponizing newly disclosed vulnerabilities to target network infrastructure and backup systems, emphasizing the critical need for immediate patch deployment and enhanced monitoring of privileged access controls in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Meta Muse AI Assistant Vulnerability Exposes Critical Backdoor Risk in 2026
Meta Muse AI Assistant Vulnerability Exposes Critical Backdoor Risk in 2026
Computer Software/Engineering1 month ago

Meta Muse AI Assistant Vulnerability Exposes Critical Backdoor Risk in 2026

In September 2026, security researcher Patrick Wardle discovered a critical vulnerability in Meta's Muse AI assistant for macOS that allows attackers with existing system access to hijack the assistant and turn it into a backdoor. The flaw exploits an undocumented setting called 'endo_voyager_dictation_endpoint' that redirects voice dictation to attacker-controlled servers, enabling theft of authentication tokens, interception of user commands, and unauthorized access across all connected devices and services. Since Muse operates with broad permissions across files, email, calendar, and smart home systems, compromised instances provide attackers extensive access while appearing as legitimate application activity to security tools. This incident highlights the emerging security risks of AI assistants with extensive system permissions and cross-device synchronization capabilities. As organizations increasingly adopt AI agents for productivity and automation, the potential for these tools to become high-value attack vectors represents a significant shift in the threat landscape requiring new security considerations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign
SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign
Higher Education/Acadamia1 month ago

SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign

The Pakistan-linked APT group SideCopy has expanded its targeting beyond Indian government entities to include academic institutions through sophisticated spear-phishing campaigns in 2026. The threat actors utilize weaponized ZIP archives containing malicious LNK files that abuse mshta.exe to execute obfuscated HTML applications, ultimately deploying the ReverseRAT malware for data exfiltration and remote access. The attack chain employs multi-stage obfuscation, anti-forensic self-deletion routines, and encrypted command-and-control communications to evade detection while harvesting system metadata, credentials, and sensitive documents from compromised networks. This incident highlights the evolving threat landscape where state-sponsored groups are diversifying their target profiles to include educational institutions, recognizing their value as repositories of intellectual property and research data. The sophistication of SideCopy's techniques demonstrates the growing challenge organizations face in defending against adaptive APT groups that continuously refine their tradecraft.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports