Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 9 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 97–108 / 3786 reports
CVE-2026-97229: Attackers Are Actively Exploiting GitLab's Maximum-Severity CI/CD RCE Flaw
CVE-2026-97229: Attackers Are Actively Exploiting GitLab's Maximum-Severity CI/CD RCE Flaw
Computer Software/Engineering1 week ago

CVE-2026-97229: Attackers Are Actively Exploiting GitLab's Maximum-Severity CI/CD RCE Flaw

In October 2026, CISA confirmed active exploitation of CVE-2026-97229, a maximum-severity (CVSS 10.0) remote code execution vulnerability in GitLab's CI/CD Regular Expression Compiler. Discovered by security researcher joaxcar and stemming from an integer overflow weakness, the flaw allows unauthenticated remote attackers to execute arbitrary code on GitLab servers via a specially crafted regular expression in pipeline configuration files. GitLab patched the issue in CE and EE versions 19.4.2, 19.3.5, and 19.2.8, while CISA added the CVE to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by Sunday under BOD 26-04. Nearly 2,800 internet-exposed GitLab instances remain potentially vulnerable. This incident is part of a broader pattern of GitLab vulnerabilities being weaponized in 2026, including a 2FA bypass and two additional critical RCE flaws patched earlier this year. The exploitation of DevSecOps platforms signals an escalating attacker focus on CI/CD supply chain infrastructure, where a single compromise can cascade into mass software supply chain breaches affecting downstream enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Trojanized Claude Code Extension Backdoored 5,000 Developer Machines via Cursor's Marketplace
Trojanized Claude Code Extension Backdoored 5,000 Developer Machines via Cursor's Marketplace
Computer Software/Engineering1 week ago

Trojanized Claude Code Extension Backdoored 5,000 Developer Machines via Cursor's Marketplace

On October 29, 2026, a trojanized version of Anthropic's Claude Code VS Code extension (v2.1.313) was distributed through Cursor's AI-powered code editor marketplace for approximately 11 hours, exposing up to 5,000 developers to malware. The malicious extension injected a JavaScript loader that silently collected system reconnaissance data—including Git email, hostname, and public IP—and attempted to install persistent SSH backdoors via macOS LaunchAgents or Windows scheduled tasks. Coding errors in the malware's SSH setup routines limited attacker access, but reconnaissance data was still transmitted to a remote server at 134.209.82[.]225. Cursor removed the extension, shut down its marketplace for auditing, and worked with the hosting provider to take the attacker's server offline. This incident underscores the growing threat of supply-chain attacks targeting AI-assisted developer tooling. As agentic AI tools become deeply embedded in software development workflows, adversaries are increasingly weaponizing trusted extension marketplaces to compromise developer endpoints at scale—making extension integrity verification and runtime behavioral monitoring critical priorities for security teams in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes
CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes
Information Technology/IT1 week ago

CVE-2026-98432: AI-Developed Exploit Achieves Remote Root on Unpatched Linux Servers in 53 Minutes

In October 2026, security researchers at Anthropic disclosed CVE-2026-98432, a critical use-after-free race condition in the Linux kernel's IPv4 TCP networking stack (CVSS 9.8) affecting kernel versions dating back to 4.4. The flaw is exploitable without authentication and, under conditions where a Multipath TCP (MPTCP) listener is active, enables full remote root code execution. Anthropic demonstrated that an unreleased Claude AI model developed a working exploit in approximately 53 minutes, bypassing KASLR to achieve arbitrary command execution as root. Widely deployed distributions including Ubuntu, RHEL, and Rocky Linux remain unpatched as of disclosure. This incident marks a watershed moment where AI-assisted offensive research accelerated exploit development against a critical infrastructure primitive—the Linux kernel itself. With Go 1.24 silently enabling MPTCP by default, the exposed attack surface is far larger than administrators realize, amplifying urgency across cloud-native, containerized, and hybrid environments running Linux workloads.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-111585: When the Machine You're Helping Attacks You Back
CVE-2026-111585: When the Machine You're Helping Attacks You Back
Information Technology/IT1 week ago

CVE-2026-111585: When the Machine You're Helping Attacks You Back

In October 2026, TeamViewer disclosed CVE-2026-111585, a high-severity vulnerability (CVSS 8.8) affecting the TeamViewer Full Client on Windows, Linux, macOS, the Windows Portable edition, and the Android Remote Control app in all versions prior to 15.83. The flaw inverts the expected attacker-victim relationship: a malicious or compromised host machine can exploit a heap overflow in screen-size negotiation to crash—and on Windows, execute arbitrary code on—the connecting viewer's system. No authentication or additional user interaction beyond accepting the session is required, making exploitation trivially accessible in default configurations. The patch was released on October 29, 2026, with no known in-the-wild exploitation reported at disclosure. This vulnerability is significant because it weaponizes the trusted remote-access workflow itself, turning the helper into the target. As enterprises rely heavily on remote-support tooling for hybrid and distributed workforces, adversaries increasingly abuse or compromise managed endpoints to pivot upstream—making network-layer controls and anomaly detection around remote-access protocols more critical than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How
Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How
Information Technology/IT1 week ago

Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How

Beginning in September 2026, an unidentified threat actor launched a credential-phishing campaign impersonating Anthropic, the AI company behind Claude, to steal Google and Microsoft account credentials. Attackers sent emails from a legitimate GoTo Webinar shared address, used Zapier URL shortening to obscure malicious links, and layered two CAPTCHAs—one Cloudflare-based to block automated scanners, one custom-built to filter out VPNs and Tor—to funnel victims to fake Zoom or spoofed Anthropic SSO pages. Despite obvious grammatical errors, typos, and absent brand assets, these emails bypassed Proofpoint SEG and Microsoft Defender for Office 365, underscoring persistent blind spots in perimeter email defenses. This campaign illustrates a widening gap between email security tool coverage and real-world phishing delivery. As threat actors increasingly abuse legitimate SaaS infrastructure and URL obfuscation to evade detection, organizations face mounting pressure to adopt identity-centric, layered defenses—including phishing-resistant MFA, least-privilege access, and domain-validation password managers—rather than relying solely on gateway filtering.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop
Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop
Financial Services1 week ago

Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop

On October 30, 2026, Binance—the world's largest cryptocurrency exchange—disclosed a catastrophic security breach resulting in approximately $6.43 billion in stolen digital assets, surpassing the 2025 Bybit hack as the largest cryptocurrency theft in history. Attributed with high confidence to North Korea's TraderTraitor group, the attack began at least 36 hours prior with preparation involving a compromised DevOps engineer's laptop. Attackers gained access to a service container, pre-signed 50 batch authorizations against Binance's hot wallet signing system, and in a single transaction drained 167,464 ETH and 63 tokens including 1.615 billion USDT. Blockchain intelligence firms Chainalysis, TRM Labs, and Elliptic confirmed the DPRK link via fund commingling with the prior Bitget exploit and shared tradecraft signatures. This incident underscores a deepening trend of supply-chain and insider-endpoint attacks targeting cryptocurrency infrastructure, where adversaries compromise the human and DevOps layer rather than cryptographic keys themselves. North Korea's TraderTraitor group has now executed three mega-heists in under two years, demonstrating industrialized, automated laundering capabilities that outpace conventional freezing and tracing responses.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now
CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now
Computer Software/Engineering1 week ago

CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now

In late October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. CVE-2026-97229, a CVSS 10.0 integer overflow in GitLab CE/EE, allowed unauthenticated remote code execution via malicious CI/CD configurations. An unknown threat actor targeted Alpine Linux's GitLab instance on October 20–21, crashing worker processes eight times before being blocked on October 25–26. CVE-2026-76418, a CVSS 8.6 null pointer dereference in Cisco ASA and FTD, enabled unauthenticated attackers to trigger denial-of-service reloads. FCEB agencies were given until November 1, 2026 to apply patches. These incidents highlight the growing attack surface in DevSecOps toolchains and network security appliances. Supply-chain targeting of CI/CD platforms like GitLab is accelerating, and firewall DoS vulnerabilities are being weaponized to disable perimeter defenses before follow-on intrusion. Unpatched infrastructure remains the most reliable initial access vector for nation-state and financially motivated actors alike.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines
Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines
Computer Software/Engineering1 week ago

Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines

On October 29, 2026, a trojanized version of Anthropic's official Claude Code extension (version 2.1.313) was distributed through Cursor's IDE marketplace under the legitimate publisher identity anthropic.claude-code. Between approximately 2:27 a.m. and 1:35 p.m. PT, up to 5,000 developers auto-updated to the malicious build, which injected a 66-line JavaScript loader to plant an attacker-controlled SSH key labeled "svc-telemetry," establish a reverse tunnel to 134.209.82.225, install cross-platform persistence, and beacon host reconnaissance data—including environment variable names referencing cloud credentials—over unencrypted HTTP to port 8099. This incident reflects a sharp escalation in software supply-chain attacks targeting AI developer tooling. As agentic AI extensions gain privileged access to developer workstations and cloud credential stores, attackers are exploiting marketplace trust relationships and auto-update mechanisms to achieve persistent footholds at the earliest stage of the software development lifecycle, compressing the window between initial compromise and credential exposure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now
Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now
Retail Industry1 week ago

Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now

In October 2026, Drupal disclosed active exploitation of CVE-2026-118539, a highly critical authorization bypass flaw in Commerce Core versions 0.0.0–2.41 and 3.0.0–3.3.13. The vulnerability stems from insufficiently protected routes and entity fields, allowing unauthenticated or low-privileged attackers to bypass access controls on shopping cart and checkout APIs. Threat actors are leveraging the flaw to financially impact vendors operating e-commerce storefronts built on Drupal, potentially manipulating orders, pricing, or payment flows without authorization. Drupal has issued patched releases and urges immediate upgrades to Commerce Core 8.x-2.41 or 3.3.13. This incident coincides with simultaneous active exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), underscoring a broadening wave of web application attacks targeting open-source CMS and runtime ecosystems. The convergence of multiple critical CVEs in widely deployed platforms signals escalating attacker investment in opportunistic web exploitation chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud
AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud
Financial Services1 week ago

AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud

Throughout 2026, Microsoft Threat Intelligence documented North Korean state-sponsored threat actors—including Jade Sleet, Coral Sleet, Onyx Sleet, Diamond Sleet, Sapphire Sleet, Pearl Sleet, Jasper Sleet, and Emerald Sleet—systematically embedding generative and agentic AI into every phase of their attack chains. AI accelerated reconnaissance, mass-produced spear-phishing lures (Onyx Sleet generated dozens of tailored PDF decoys within minutes), enabled supply-chain trojans built with AI-assisted development platforms, and supported large-scale fraudulent IT worker schemes. Jade Sleet launched campaigns across three fabricated front companies in a single week, while Sapphire Sleet likely used AI during an August 2026 Rust software supply-chain compromise. The operations advance regime goals: cryptocurrency theft, strategic intelligence collection, and sanctions evasion. This report signals a structural inflection point: AI is no longer an experimental add-on for nation-state actors—it is an operationalized force multiplier. Defenders face AI-generated lures, AI-accelerated retooling, and agentic penetration-testing frameworks (ARTEX) deployed in live operations, demanding equally automated, cloud-native defensive architectures to keep pace.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Amatera: The Professionalized Infostealer Dominating Latin America in 2026
Amatera: The Professionalized Infostealer Dominating Latin America in 2026
Financial Services1 week ago

Amatera: The Professionalized Infostealer Dominating Latin America in 2026

Amatera is a sophisticated infostealer malware that emerged as the top infostealer detection in Latin America during the first half of 2026, according to ESET telemetry. The malware is distributed through malvertising campaigns, trojanized software installers, and phishing lures, targeting stored credentials, browser session tokens, cryptocurrency wallets, and sensitive files. Once executed, Amatera exfiltrates harvested data over encrypted channels to attacker-controlled command-and-control infrastructure, demonstrating a highly professionalized cybercrime supply chain model. Its modular architecture and stealth evasion techniques make it difficult to detect with signature-based tools alone, amplifying the risk to enterprise environments across financial services, retail, and healthcare sectors. Amatera exemplifies the growing commoditization of infostealer-as-a-service operations, where low-barrier access to advanced credential-theft tooling enables a broad range of threat actors to conduct high-impact campaigns. The rise of such professionalized malware families mirrors broader trends including the increased targeting of cloud-hosted identities, MFA bypass via stolen session tokens, and downstream ransomware deployment using harvested credentials.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security
Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security
Government Administration1 week ago

Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security

In October 2026, Cisco disclosed an actively exploited zero-day vulnerability (CVE-2026-76418) in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Unauthenticated remote attackers were found sending crafted requests to SSL VPN tunnel groups with secondary authentication configured, triggering logic errors that caused affected firewall devices to reload unexpectedly and enter a denial-of-service (DoS) condition. Cisco's PSIRT confirmed in-the-wild exploitation with no available workaround except disabling secondary authentication or patching immediately. Over 51,000 internet-exposed Cisco ASA SSL VPN devices were identified as potentially vulnerable via Shadowserver telemetry, representing significant operational risk for enterprises dependent on VPN availability. This incident is the latest in a sustained pattern of Cisco network appliance zero-days being weaponized in the wild—following CVE-2025-20362, CVE-2025-20333, and the ArcaneDoor campaign exploiting CVE-2024-20353 and CVE-2024-20359. Perimeter firewall and VPN devices remain high-value targets for nation-state and criminal actors, demanding faster patch cycles, compensating network controls, and reduced reliance on single-layer perimeter defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports