Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical DHCPv6 Vulnerability in OpenWrt's odhcpd Service
In June 2026, OpenWrt released version 25.12.5 to address multiple vulnerabilities in its odhcpd service, notably CVE-2026-53921—a critical stack buffer overflow in the DHCPv6 IA reply serialization. This flaw allows unauthenticated attackers on the local network to send crafted DHCPv6 REQUEST packets, potentially leading to remote code execution with root privileges. The vulnerability is particularly concerning due to the default-enabled status of odhcpd and the common lack of security mitigations like stack canaries and ASLR in embedded devices. ([openwrt.org](https://openwrt.org/releases/25.12/notes-25.12.5?utm_source=openai)) The release also addressed other vulnerabilities, including CVE-2026-53918 (use-after-free in the DHCPv6 IA handler) and CVE-2026-53920 (stack memory disclosure via truncated DHCPv6 options). These fixes underscore the importance of timely updates to mitigate risks associated with network services enabled by default. ([openwrt.org](https://openwrt.org/releases/25.12/notes-25.12.5?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerability in Siemens Mendix Runtime: CVE-2026-7891
In July 2026, a critical vulnerability (CVE-2026-7891) was identified in Siemens Mendix Runtime, affecting all versions. The issue stems from inadequate documentation regarding the special behavior of the System.User entity, leading developers to potentially configure overly permissive access rules. This misconfiguration can result in unauthorized access to sensitive user data and privilege escalation within Mendix applications. Siemens has advised developers to review and update their access rules based on the revised documentation to mitigate this risk. This incident underscores the importance of comprehensive documentation and secure configuration practices in application development. As similar vulnerabilities continue to emerge, organizations must prioritize regular security assessments and adhere to best practices to prevent unauthorized data exposure and maintain compliance with regulatory standards.
1 month ago
Kill Chain
Over 24,000 BMC Interfaces Expose IPMI Password Hashes: A Critical Security Alert
In July 2026, cybersecurity researchers identified over 36,000 Baseboard Management Controller (BMC) interfaces exposing the Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of these, 24,650 interfaces disclosed password-derived authentication hashes before login due to a vulnerability inherent in the IPMI v2.0 specification (CVE-2013-4786). This flaw allows remote attackers to obtain password hashes and conduct offline password guessing attacks, potentially compromising server management systems. The widespread exposure of BMCs with default or weak passwords, especially in modern AI data centers hosting multiple tenants, underscores a significant security risk. Attackers exploiting this vulnerability can gain persistent access, bypass traditional security controls, and threaten the integrity of shared infrastructure, highlighting the urgent need for enhanced security measures in server management protocols.
1 month ago
Kill Chain
Critical Vulnerability in MikroTik RouterOS: CVE-2026-16347
In July 2026, a critical vulnerability (CVE-2026-16347) was identified in MikroTik RouterOS and Cloud Hosted Router, affecting all versions. This flaw allows attackers to perform rapid password guessing due to inadequate safeguards against excessive authentication attempts, potentially leading to unauthorized system access. The vulnerability stems from the system's failure to enforce effective rate-limiting, account lockout, or source-based restrictions, enabling repeated authentication failures without defensive response. This deficiency increases the risk of attackers obtaining valid credentials and gaining unauthorized access to administrative services. The discovery of CVE-2026-16347 underscores the ongoing challenges in securing network infrastructure devices. As attackers continually exploit authentication weaknesses, organizations must prioritize implementing robust access controls and monitoring mechanisms to mitigate such risks.
1 month ago
Kill Chain
Unveiling the AutoIt Payload Injector Phishing Campaign of July 2026
In July 2026, a phishing campaign was identified that utilized AutoIt scripts to deliver malware payloads. The attack began with emails containing RAR archives, which, when opened, executed VBS scripts. These scripts decoded and decompressed additional files, ultimately launching an AutoIt interpreter that injected shellcode into legitimate processes like charmap.exe. The final payload was a keylogger communicating with remote command-and-control servers. ([isc.sans.edu](https://isc.sans.edu/diary/TA551%2B?utm_source=openai)) This incident underscores the persistent use of AutoIt by threat actors due to its scripting capabilities and ease of use. The technique of process injection into legitimate applications highlights the evolving sophistication of malware delivery methods, emphasizing the need for robust detection and response strategies.
1 month ago
Kill Chain
Enhancing Open-Source Security: The 'Patch the Planet' Initiative by Trail of Bits and OpenAI
In July 2026, Trail of Bits, in collaboration with OpenAI, launched 'Patch the Planet,' an initiative aimed at identifying and fixing vulnerabilities in critical open-source software. Utilizing OpenAI's GPT-5.5-Cyber model, the team employed the '/goal' feature to autonomously detect and address security flaws in widely used codebases such as Rust, curl, and zlib. This approach led to the discovery of numerous vulnerabilities, including a soundness issue and a miscompilation in Rust, both of which were promptly patched in version 1.98. Additionally, the initiative transformed past CVEs into Semgrep rules, uncovering 11 variant hits across multiple projects, and identified two potential high-severity privilege-escalation bugs in Keycloak's SAML component. The success of 'Patch the Planet' underscores the growing role of AI in cybersecurity, demonstrating how AI-driven tools can significantly enhance the efficiency and effectiveness of vulnerability detection and remediation processes. This initiative highlights the potential for AI to assist in securing open-source software, which forms the backbone of much of today's digital infrastructure.
1 month ago
Kill Chain
Exploiting Azure VMs via Salt Minion Extension: A Security Analysis
In July 2026, security researchers identified a method by which attackers could exploit Azure Virtual Machines (VMs) by deploying the Salt Minion extension to execute arbitrary code. By leveraging the 'Microsoft.Compute/virtualMachines/extensions/write' permission, an attacker can install the Salt Minion extension on a target VM, connecting it to a rogue Salt Master under their control. This setup allows the attacker to push malicious states to the VM, achieving code execution with root privileges. The attack is particularly stealthy as it utilizes legitimate administrative tools, making detection challenging. This incident underscores the critical need for organizations to monitor and restrict the use of VM extensions, especially those that can establish outbound connections. As cloud environments become increasingly complex, ensuring that only authorized extensions are deployed and that their configurations are regularly audited is essential to prevent such exploitation.
1 month ago
Kill Chain
TELESHIM: Exploiting Telegram for Covert C2 in Middle East Government Attacks
In July 2026, cybersecurity researchers identified a sophisticated cyber-espionage campaign targeting government entities in the Middle East. The campaign, attributed to a threat actor with ties to East Asia, deployed previously undocumented malware families named TELESHIM, MIXEDKEY, and BINDCLOAK. The attack chain began with the use of ISO image files containing a legitimate ASUSTek executable, which sideloaded a malicious DLL to deploy the TELESHIM backdoor. TELESHIM notably abused the Telegram API for command-and-control (C2) communications, allowing the attackers to blend malicious traffic with legitimate network activity. The operation demonstrated advanced techniques, including DLL sideloading, environmental keying, and heavy code obfuscation, indicating a high level of operational security and a focus on long-term espionage and data exfiltration. ([zscaler.com](https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1?utm_source=openai)) This incident underscores a growing trend of threat actors leveraging popular communication platforms like Telegram for covert C2 channels, complicating detection and mitigation efforts. The use of such legitimate services for malicious purposes highlights the need for organizations to enhance their monitoring capabilities and adopt more sophisticated threat detection mechanisms to identify and respond to these evolving tactics.
1 month ago
Kill Chain
Operation BlueDash: Unveiling the Microsoft Teams Phishing Campaign Deploying RMM Tools
In July 2026, cybersecurity researchers identified 'Operation BlueDash,' a phishing campaign exploiting Microsoft Teams-themed lures to deploy remote monitoring and management (RMM) tools. Victims were directed to counterfeit Microsoft Store pages prompting a Teams update, leading to the installation of legitimate RMM software like Level RMM and ScreenConnect. This facilitated unauthorized remote access, enabling attackers to execute commands, assess system configurations, and identify privileged users. The campaign, active since at least February 2026, is attributed to a threat actor group operating from Nigeria, as evidenced by infrastructure analysis and GitHub repositories hosting the phishing content. The deployment of multiple RMM tools aimed to establish persistent access and enhance resilience against detection and removal. This incident underscores the evolving tactics of cybercriminals leveraging legitimate tools for malicious purposes, highlighting the need for organizations to implement robust security measures, including user education on phishing threats and stringent monitoring of remote access tools.
1 month ago
Kill Chain
Critical n8n Sandbox Escape Vulnerability (GHSA-gv7g-jm28-cr3m) Exposes Servers to Remote Code Execution
In July 2026, a high-severity vulnerability (GHSA-gv7g-jm28-cr3m) was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users with workflow editing permissions to execute arbitrary operating system commands on the server hosting n8n. The vulnerability affected versions prior to 2.31.5 and between 2.32.0 and 2.32.1. Exploitation could lead to unauthorized access to sensitive data, including decryption keys and connected services. n8n released patches in versions 2.31.5 and 2.32.1 to address this issue. This incident underscores the critical importance of securing automation platforms, as they often serve as central hubs connecting various services and storing sensitive credentials. The recurrence of sandbox escape vulnerabilities in n8n highlights the need for continuous security assessments and prompt patch management to mitigate potential risks.
1 month ago
Kill Chain
Critical vBulletin Pre-Auth RCE Vulnerability (CVE-2026-61511) Exploited
In July 2026, a critical vulnerability (CVE-2026-61511) was discovered in vBulletin versions 5.x through 5.7.5 and 6.x through 6.2.1, allowing unauthenticated remote code execution. The flaw resides in the vB5_Template_Runtime::runMaths() method, where an attacker can exploit insufficient input validation to execute arbitrary PHP code via the pagenav[pagenumber] parameter. This vulnerability enables attackers to gain full control over affected servers without requiring authentication or user interaction. The public release of exploit details has heightened the risk of widespread attacks, emphasizing the urgency for administrators to apply the available patches immediately. This incident underscores the critical importance of timely software updates and robust input validation to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
GitHub and PyPI Strengthen Security with Time-Based Defenses Against Supply Chain Attacks
In July 2026, GitHub and the Python Package Index (PyPI) implemented time-based security measures to mitigate supply chain attacks. GitHub's Dependabot introduced a default three-day cooldown period before updating dependencies, aiming to prevent the automatic adoption of newly published malicious packages. Concurrently, PyPI restricted maintainers from adding new files to a package release more than 14 days after its initial publication, thereby reducing the risk of attackers compromising older, trusted releases. These proactive steps were taken in response to a series of high-profile supply chain attacks over the past year, including incidents involving the 'chalk' and 'debug' npm packages, the 's1ngularity' operation, the Shai-Hulud campaign, and the GhostAction attack. The implementation of these time-based defenses underscores the growing recognition of the need for enhanced security measures in software development ecosystems. As supply chain attacks become more sophisticated and prevalent, such proactive strategies are essential to protect developers and end-users from potential threats.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports