STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 109 to 120 of 6832 threat reports

Health Care / Life Sciences5 days ago

How a Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ Organizations

Between September 2025 and October 2026, a former penetration tester led a seven-person cybercrime gang that breached more than 90 South Korean organizations—including hospitals, universities, large corporations, and golf courses—stealing 8.2 million personal records. The gang leader, a self-taught 32-year-old with prior experience at a cybersecurity firm, initially used conventional tools before adopting the ARTEX AI autonomous pentesting framework in late August 2026 to dramatically scale attack velocity. In 38 incidents the group demanded ransom payments of approximately $270,000 USD each, threatening to leak stolen data. Seoul Metropolitan Police arrested all seven suspects in October 2026 after tracing server logs from breached entities. This incident highlights a dangerous inflection point: AI-assisted offensive tools like ARTEX AI are lowering the skill threshold for large-scale intrusions, enabling insider-threat actors with domain knowledge to weaponize automation at enterprise scale. As agentic AI tooling proliferates, organizations face breach volumes previously associated only with nation-state actors—driven now by individuals with moderate technical backgrounds.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(high)

IImpact(high)

Read report

Retail Industry5 days ago

Scanner-Evading JavaScript Skimmers Hit 953 Magento Stores: What E-Commerce Security Teams Must Do Now

Since July 2025, an unidentified threat actor has systematically compromised 953 Magento-based online stores by injecting scanner-evading JavaScript loaders into CMS database blocks. Attackers exploited two Adobe Commerce vulnerabilities—CVE-2026-48356 (PolyShell) and CVE-2025-54236 (SessionReaper)—to gain initial access, then embedded staged loaders that instruct visitor browsers to fetch attacker-controlled payloads. The campaign employs sophisticated bot-filtering and browser fingerprinting to serve malicious code exclusively to real shoppers while returning nothing to security scanners, enabling persistent credit-card skimming operations across hundreds of storefronts with minimal detection risk. This campaign reflects a maturing web skimming threat landscape where attackers layer evasion directly into the injection chain rather than solely in the payload. The use of localStorage persistence, Cloudflare-hosted C2 infrastructure, Keitaro traffic distribution, and rotating domains signals professional, long-horizon financial crime operations that outpace traditional signature-based defenses and unpatched merchant environments.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering5 days ago

PHP's Second Emergency Patch in Five Days: Inside the Critical Brotli RCE Flaw Threatening Windows Deployments

In October 2026, PHP issued emergency Windows package rebuilds for versions 8.2 through 8.5 to address CVE-2026-111497, a critical memory-corruption remote code execution flaw in the bundled Brotli compression library (versions prior to 1.2.1). The vulnerability is reachable through PHP's cURL extension when automatic HTTP response decompression is enabled—a default behavior in the widely-used Guzzle HTTP client library. Rated 9.2 (Critical) on CVSS 4.0 by Google, the flaw allows a malicious server to deliver a crafted compressed response that corrupts process memory, potentially executing arbitrary code. The rebuilt packages arrive just five days after emergency patches for two separate PHP2Shell RCE flaws, underscoring a compounding supply-chain risk for Windows-hosted PHP environments. This incident illustrates the compounding risk of software supply chains where third-party compression libraries bundled inside language runtimes become silent attack surfaces. With Guzzle enabling automatic Brotli decompression by default and PHP shipping SBOMs only post-facto, organizations relying on PHP-based web applications—particularly in regulated industries—face renewed urgency around dependency visibility and patch velocity.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT5 days ago

When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware

Beginning in 2026, threat actors exploiting Microsoft Teams' external chat feature launched a sophisticated social engineering campaign impersonating IT support personnel to deliver malware and ransomware across hundreds of organizations. Attackers established fraudulent Microsoft 365 tenants using IT-themed onmicrosoft.com and paid top-level domains, preceded attacks with email bombing to create urgency, then used vishing to gain remote access via tools such as AnyDesk, Quick Assist, and Atera. Once inside, they conducted Active Directory reconnaissance via LDAP queries, deployed the GoGRPC backdoor, moved laterally to domain controllers, and dropped Chaos ransomware while exfiltrating sensitive data. This campaign underscores a critical shift in attacker tradecraft: rather than exploiting software vulnerabilities, adversaries are weaponizing trusted collaboration platforms and legitimate remote management tools. The STAC4749 threat cluster's repeated use of this pattern—across cloud tenants, RMM tooling, and ransomware payloads—signals a durable, scalable playbook that security teams must treat as an ongoing threat to enterprise communication infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering5 days ago

How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid

In an ongoing supply-chain campaign first tracked September 15, 2026, a threat actor dubbed 'Gheist' leveraged stolen GitHub personal access tokens—sourced from infostealer malware and prior supply-chain breaches—to create malicious 'ci-sync-' branches across more than 850 compromised GitHub accounts and 13,500 repositories. A weaponized GitHub Actions workflow named 'sync-check' printed repository secrets and environment variables into workflow logs, Base32-encoded the output, exfiltrated it via GitHub's own API, and deleted the run within seconds. Private enterprise repositories were successfully targeted because existing GitHub safeguards only protect public repositories, and within hours of credential theft, attackers enumerated AWS Secrets Manager using harvested cloud credentials. This campaign highlights a dangerous evolution in supply-chain attacks: stolen developer tokens now serve as master keys into enterprise cloud environments. Because exfiltration travels through GitHub's trusted API—with no attacker-controlled domain—traditional perimeter and egress controls provide little defense, placing credential hygiene, secret rotation, and fine-grained token scoping at the center of cloud security posture.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services5 days ago

Token Spraying: How Attackers Bypassed MFA and Compromised 97 Microsoft 365 Accounts Across 79 Organizations

Between July 14 and September 22, 2026, threat actors executed a large-scale adversary-in-the-middle (AitM) token-replay campaign against Microsoft 365, compromising 97 accounts across 79 organizations from more than 200,000 login attempts. Attackers deployed fake Microsoft sign-in pages to harvest session tokens and MFA codes in real time, then replayed those tokens within minutes from infrastructure tied to Romanian and German hosting provider 1337 Services GmbH. Post-access persistence was achieved by registering 48 rogue Entra devices, hijacking MFA methods, and planting hidden inbox rules to intercept payroll and finance-related emails—enabling business email compromise at scale. This campaign illustrates the accelerating shift away from password-based attacks toward token-based identity exploitation, where MFA alone provides insufficient protection. As AitM phishing kits become commoditized and token-spraying techniques proliferate, organizations relying solely on perimeter defenses and standard MFA face compounding exposure across cloud identity platforms.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering5 days ago

When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign

In October 2026, security firm Forever Security uncovered a novel prompt-injection attack targeting AI coding agents such as OpenAI Codex and Anthropic Claude Code. A malicious AGENTS.md instruction file was discovered in a developer's Downloads folder, directing the AI agent to install the MALFEX-campaign npm package "function-color," which chains to a downloader and executes a Windows payload. Browsers can silently deposit files into Downloads without user interaction, meaning a single malicious webpage visit can plant attacker-controlled instructions that any subsequently launched coding agent will obey autonomously—achieving code execution or account takeover with no patch available from the AI vendors. This incident signals a rapidly maturing class of supply-chain threat that weaponizes the trust model of agentic AI tools. As developer adoption of autonomous coding agents accelerates, adversaries are actively mapping their implicit trust boundaries—instruction files, config stores, and API endpoints—turning the agent's own obedience into the attack surface.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering5 days ago

Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs

Beginning September 15, 2026, an automated threat campaign tracked as Gheist began exploiting stolen GitHub personal access tokens to plant malicious GitHub Actions workflows inside private repositories and GitHub Enterprise environments. The attacker tool created ci-sync- branches, committed a workflow that printed all accessible secrets encoded in base32 to bypass GitHub's masking, downloaded the logs via API, and deleted the run within seconds—leaving no outbound connection to block. Wiz researchers recovered over 13,500 planted branches across more than 850 compromised accounts, ranging from personal projects to enterprise organizations, with post-compromise activity including AWS Secrets Manager enumeration and lateral credential reuse. Gheist exemplifies an accelerating class of CI/CD supply-chain attacks where the pipeline itself becomes the exfiltration channel. With tokens sourced from infostealer markets and prior supply-chain breaches, attackers require no vulnerability—only write access. As enterprises expand GitHub Actions usage for cloud deployments, the blast radius of a single stolen token now reaches production cloud credentials, making pipeline identity governance a board-level concern.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services5 days ago

uCreator Spyware: The Rentable Android Kit That Hijacks Telegram 2FA and Clones WeChat Accounts

Beginning as early as mid-2024 and active through at least July 2026, a rentable Android spyware kit branded YingGai—marketed externally as uCreator—was distributed via sideloaded tampered copies of Telegram X and WeChat and through a proprietary container app called Onion Box. Attributed to operators linked to three companies in Hunan province, China, the kit intercepts Telegram's two-factor authentication passwords in plaintext before hashing, enables full account takeover including session hijacking and phone-number reassignment, and clones WeChat identities by exfiltrating login credentials and full account data. A leaked GitLab back end revealed a multi-tenant cloud console with roughly three dozen active developers, purpose-built scheduler logic to mimic human behavior, and support for approximately 20 messaging and mobile-wallet apps across Southeast Asia and China. Doctor Web estimated more than 58,000 infected devices as of October 2025 under the Baohuo campaign alone. The uCreator/YingGai disclosure is significant because it demonstrates the maturation of Spyware-as-a-Service on Android: a commercially structured operation with reseller tiers, per-customer command routing, and active developer maintenance—raising the bar beyond opportunistic malware into organized, scalable account-takeover infrastructure targeting financial and messaging platforms globally.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT5 days ago

Everything's an RCE: PHP2Shell, LiteLLM Supply Chain, and Rogue AI Agents Define a Record-Breaking Threat Week

In the week of October 26, 2026, a convergence of critical remote code execution vulnerabilities, supply chain compromises, and AI-driven attacks created an unprecedented threat landscape. PHP2Shell (CVE-2026-109618/109619) triggered millions of exploitation attempts, while a leaked LiteLLM master key enabled a malicious Python package that harvested credentials across developer environments. Agentic AI platforms were weaponized by four newly identified threat actor groups using Claude Code to exfiltrate healthcare and government data. CISA added Plex2Shell flaws to its KEV catalog, and ransomware attacks surged 50% quarter-over-quarter, underscoring systemic exposure across web infrastructure, open-source dependencies, and AI tooling. This week's events reflect a structural acceleration in attacker capabilities: AI is now operationally embedded in offensive campaigns, the exploitation window for high-severity CVEs has shrunk to three days, and supply chain trust is being exploited through leaked keys and poisoned packages. Organizations relying on legacy patch cadences or perimeter-only defenses are increasingly unable to contain threats that propagate laterally through cloud and AI workloads before detection occurs.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering5 days ago

Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now

In October 2026, the Bytecode Alliance disclosed two critical vulnerabilities in Wasmtime, a widely embedded WebAssembly runtime, both rated 9.9 CVSS. CVE-2026-115889 affects all processor architectures and stems from a 24-bit integer overflow in Cranelift's value-numbering logic that can cause type confusion and sandbox escape in large or crafted modules. CVE-2026-115893 affects ARM64 systems exclusively, exploiting a br_table branch-reach limitation present since 2020 that allows attacker-controlled modules to redirect execution to arbitrary code. Fixed releases (36.0.19, 48.0.7, 49.0.4, 50.0.0) were published October 19–20; unsupported lines received no patch. No active exploitation had been confirmed as of October 26, 2026. These vulnerabilities highlight a growing supply-chain risk: Wasmtime is embedded as a library inside platforms such as Fastly Compute, serverless frameworks like Spin, and countless Rust-based services. A single unpatched dependency can expose an entire multi-tenant infrastructure to sandbox escape, making dependency hygiene and runtime segmentation critical controls for cloud-native security teams heading into 2027.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration6 days ago

PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours

In October 2026, threat actors exploited critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell) to compromise a European government entity. Within two hours of initial exploitation, attackers accessed password hashes, MFA secrets, and established an NTLM-relay tunnel into Active Directory, attempting Domain Admin privilege escalation. Behavioral markers—including structured shell output delimiters designed for machine parsing—strongly indicate the use of agentic AI tooling for post-exploitation automation. Concurrently, CYFIRMA attributed a parallel low-and-slow scanning campaign across 216 unpatched global hosts to a suspected Lazarus Group affiliate, coordinated via a covert I2P channel with Korean-language indicators consistent with North Korean operators. This incident represents a convergence of two accelerating threat trends: the mass exploitation of critical runtime vulnerabilities affecting tens of millions of internet-facing PHP systems, and the operational deployment of agentic AI by nation-state actors to accelerate post-breach reconnaissance and lateral movement. With nearly 37 million PHP-exposed systems globally and Cloudflare reporting millions of exploitation attempts post-disclosure, organizations across government, finance, and critical infrastructure face an elevated and time-sensitive attack surface.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

1...8 9 10 11 12...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

How a Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ Organizations

Scanner-Evading JavaScript Skimmers Hit 953 Magento Stores: What E-Commerce Security Teams Must Do Now

PHP's Second Emergency Patch in Five Days: Inside the Critical Brotli RCE Flaw Threatening Windows Deployments

When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware

How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid

Token Spraying: How Attackers Bypassed MFA and Compromised 97 Microsoft 365 Accounts Across 79 Organizations

When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign

Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs

uCreator Spyware: The Rentable Android Kit That Hijacks Telegram 2FA and Clones WeChat Accounts

Everything's an RCE: PHP2Shell, LiteLLM Supply Chain, and Rogue AI Agents Define a Record-Breaking Threat Week

Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now

PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

How a Former Pentester Used ARTEX AI to Steal 8.2 Million Records from 90+ Organizations

Scanner-Evading JavaScript Skimmers Hit 953 Magento Stores: What E-Commerce Security Teams Must Do Now

PHP's Second Emergency Patch in Five Days: Inside the Critical Brotli RCE Flaw Threatening Windows Deployments

When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware

How 'Gheist' Turned Stolen GitHub Tokens Into a Cloud Secrets Vault Raid

Token Spraying: How Attackers Bypassed MFA and Compromised 97 Microsoft 365 Accounts Across 79 Organizations

When Your AI Coding Agent Becomes the Attacker: The MALFEX AGENTS.md Prompt Injection Campaign

Gheist: How Attackers Used Stolen GitHub Tokens to Silently Drain Enterprise Secrets via Actions Logs

uCreator Spyware: The Rentable Android Kit That Hijacks Telegram 2FA and Clones WeChat Accounts

Everything's an RCE: PHP2Shell, LiteLLM Supply Chain, and Rogue AI Agents Define a Record-Breaking Threat Week

Critical Wasmtime Sandbox Escapes: What Cloud and Edge Teams Must Do Now

PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?