STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 1549 to 1560 of 6877 threat reports

Oil/Energy/Solar/Greentech2 months ago

Philips and GE Breached by Clop Ransomware Exploiting CVE-2026-12569

In August 2026, the Clop ransomware gang exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM platforms to breach systems at Philips and General Electric (GE). This vulnerability allowed remote code execution through the deserialization of untrusted data. The attackers infiltrated these systems, exfiltrating sensitive data such as backups, project plans, facility photos, drawings, diagrams, and blueprints. Philips confirmed the breach, stating it was contained and did not impact customer environments, while GE acknowledged awareness and is assessing the potential issue. This incident underscores the persistent threat posed by ransomware groups targeting critical vulnerabilities in widely used enterprise software. Organizations must remain vigilant, ensuring timely application of security patches and continuous monitoring to detect and mitigate such exploits promptly.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Financial Services2 months ago

Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability

In July 2026, a critical vulnerability known as Certighost (CVE-2026-54121) was identified in Microsoft's Active Directory Certificate Services (AD CS). This flaw allowed authenticated, low-privileged domain users to exploit the certificate enrollment process, obtaining certificates that impersonate Domain Controllers. By leveraging this vulnerability, attackers could escalate their privileges, potentially leading to full domain compromise. Microsoft addressed this issue with a security update released on July 14, 2026. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/detecting-cve-2026-54121-certighost-with-microsoft-defender/4542861?utm_source=openai)) The release of a public proof-of-concept (PoC) exploit on July 24, 2026, heightened the urgency for organizations to apply the patch promptly. This incident underscores the critical importance of securing certificate authorities and regularly auditing Active Directory configurations to prevent privilege escalation attacks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Oil/Energy/Solar/Greentech2 months ago

Cavern C2 Framework's Evolution: Leveraging DNS and Google Apps Script for Stealth

In August 2026, cybersecurity researchers identified advancements in the Cavern (aka Cav3rn) command-and-control (C2) framework, utilized by Iranian nation-state hackers targeting Israeli entities. The updated framework incorporates a complex C2 module that leverages DNS A-record responses to dynamically select between direct HTTPS communication and a Google Apps Script relay for each transaction. This evolution enhances the framework's ability to blend malicious traffic with legitimate network activity, complicating detection efforts. The Cavern framework, first documented in July 2026, is associated with the Cavern Manticore group, linked to Iran's Ministry of Intelligence and Security (MOIS), and shares overlaps with other Iranian threat actors such as MuddyWater and Lyceum. The modular architecture of Cavern facilitates various post-exploitation activities, including file operations, database enumeration, Active Directory reconnaissance, and network tunneling. The integration of legitimate services like Google Apps Script and Microsoft 365 calendars into its C2 channels underscores a strategic shift towards more covert and resilient communication methods. This development highlights the increasing sophistication of nation-state cyber operations and the challenges in detecting and mitigating such threats.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 months ago

Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen

In August 2026, a threat actor known as "TheHatman" claimed to have stolen 3.64 million employee records from multiple Fortune 500 companies by exploiting compromised credentials to access their Microsoft Azure infrastructures. The stolen data reportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and other tenant account records. Companies allegedly affected include McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, and Kyndryl. Some organizations have disputed the claims, stating that the data appears outdated and that no credible evidence of a breach was found. This incident underscores the persistent threat posed by credential-based attacks and highlights the importance of robust authentication mechanisms. The use of techniques such as password spraying and Multi-Factor Authentication (MFA) fatigue attacks demonstrates the evolving tactics of cybercriminals targeting cloud infrastructures.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering2 months ago

Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security

In June 2026, a security vulnerability was identified in Snowflake's public GitHub repository, specifically within the 'snowflake-connector-net' project. The flaw resided in the 'jira_issue.yml' GitHub Actions workflow, which processed issue titles and bodies without proper sanitization. This oversight allowed attackers to craft malicious GitHub issues that, when processed by the workflow, executed unauthorized commands. These commands had access to internal Jira credentials, potentially exposing sensitive project information. Snowflake promptly addressed the issue by updating the workflow to handle inputs securely and rotated the compromised Jira tokens. No evidence of unauthorized access was found during their investigation. This incident underscores the critical importance of input validation and secure coding practices in CI/CD pipelines. As organizations increasingly rely on automated workflows, ensuring that these processes are safeguarded against injection attacks is paramount to maintaining the integrity and security of development environments.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Computer Software/Engineering2 months ago

Critical Vulnerability in Forminator WordPress Plugin (CVE-2026-15748) Puts Sites at Risk

In August 2026, a critical vulnerability (CVE-2026-15748) was identified in the Forminator Forms WordPress plugin, affecting over 600,000 active installations. This flaw allowed unauthenticated attackers to upload arbitrary files, including executable PHP scripts, leading to potential remote code execution and complete site compromise. The issue stemmed from insufficient file type validation in the 'handle_file_upload()' function, particularly when forms contained both a File Upload field and a Select field. The vulnerability was addressed in version 1.56.2, released on July 31, 2026. This incident underscores the persistent risks associated with web application vulnerabilities, especially in widely used plugins. It highlights the importance of regular security assessments and prompt updates to mitigate potential exploits that can lead to significant operational disruptions and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering2 months ago

GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)

In August 2026, GitLab identified and patched a critical vulnerability (CVE-2026-19478) in its Community and Enterprise Editions. This flaw allowed unauthenticated attackers to remotely modify or delete public projects and user data via a GraphQL directive. The vulnerability affected versions from 18.2 up to 18.11.10, 19.0 up to 19.0.7, 19.1 up to 19.1.5, and 19.2 up to 19.2.3. GitLab released patches in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4 to address this issue. This incident underscores the critical importance of timely vulnerability management and patching in software development environments. The exploitation of such vulnerabilities can lead to significant data loss and operational disruptions, emphasizing the need for robust security practices and continuous monitoring.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Telecommunications2 months ago

Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices

In August 2026, security researchers identified a new Linux-based botnet named Evooo1Bot, which extends the capabilities of the infamous Mirai malware beyond traditional Distributed Denial of Service (DDoS) attacks. Evooo1Bot exploits vulnerabilities in various Internet-facing devices, including those from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, some dating back to 2007. Once compromised, these devices are utilized for credential theft, establishing encrypted command-and-control communications, and setting up reverse SOCKS proxies, effectively transforming them into persistent attacker infrastructure. ([arstechnica.com](https://arstechnica.com/security/2026/03/14000-routers-are-infected-by-malware-thats-highly-resistant-to-takedowns/?utm_source=openai)) The emergence of Evooo1Bot underscores the evolving threat landscape where botnets are increasingly used for multifaceted cyberattacks beyond DDoS. This development highlights the critical need for organizations to secure Internet of Things (IoT) devices, promptly apply security patches, and implement robust network monitoring to detect and mitigate such sophisticated threats.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Banking/Mortgage2 months ago

WindRelay Malware: A New Threat to Contactless Payments

In August 2026, cybersecurity researchers identified 'WindRelay,' a novel Android malware that exploits Near Field Communication (NFC) technology to facilitate contactless payment fraud. The attack begins with social engineering tactics, where victims are deceived into installing a Remote Access Trojan (RAT) named SpyNote. This RAT enables attackers to remotely deploy the WindRelay malware onto the victim's device. Once installed, WindRelay transforms the compromised smartphone into an unauthorized NFC relay, capturing live card data when victims are manipulated into tapping their payment cards against their own infected devices. This data is then transmitted in real-time to fraudsters, who use it to perform unauthorized transactions at payment terminals. The campaign has primarily targeted individuals in Czechia, Slovakia, and Slovenia, with at least 23 samples of WindRelay identified between November 2025 and July 2026. This incident underscores a significant evolution in mobile payment fraud, combining advanced malware capabilities with sophisticated social engineering to exploit NFC technology. The emergence of WindRelay highlights the increasing sophistication of cybercriminals in leveraging mobile technologies for financial fraud. As NFC-based payment systems become more prevalent, the risk of similar attacks is likely to rise, emphasizing the need for enhanced security measures and user awareness to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services2 months ago

AmnesiaStealer: A New Threat to macOS Security

In August 2026, cybersecurity researchers identified AmnesiaStealer, a sophisticated Rust-based malware targeting macOS systems. Distributed via counterfeit GitHub pages, it employs a multi-stage attack to harvest sensitive data, including Keychain credentials, browser information, and files from applications like Apple Notes and Telegram. Notably, it hijacks Chromium-based browsers, granting attackers live control over user sessions. The malware's deployment involves deceptive prompts to capture system passwords, enabling deep system access and data exfiltration. This incident underscores a growing trend of advanced malware targeting macOS platforms, exploiting user trust through social engineering tactics. The emergence of such threats highlights the necessity for enhanced security measures and user awareness to mitigate risks associated with sophisticated information stealers.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Telecommunications2 months ago

APT36's PATCHCORD Backdoor: A New Threat to South Asian Critical Infrastructure

In August 2026, a cyber espionage campaign attributed to the Pakistan-aligned threat actor APT36 (Transparent Tribe) targeted Afghan telecom providers and South Asian critical infrastructure. The attackers deployed a previously undocumented backdoor named PATCHCORD, delivered through sector-specific lures such as fake VPN installers impersonating Afghan Telecom. PATCHCORD establishes persistence by hijacking browser shortcuts and communicates with a command-and-control server to execute arbitrary commands, enumerate processes, and deploy additional payloads. The campaign also introduced SHEETCORD, a Go-based backdoor utilizing Google Sheets for command-and-control, delivered via domains impersonating India's National Informatics Center. This incident underscores the evolving tactics of APT36, highlighting their focus on critical infrastructure and the use of sophisticated malware to maintain long-term access and exfiltrate sensitive information. Organizations in the region should enhance their cybersecurity measures to detect and mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services2 months ago

August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability

In August 2026, multiple cybersecurity incidents emerged, including the 'City-Forum' campaign targeting unauthenticated guest user access in Salesforce Experience Cloud and ServiceNow Service Portals, leading to significant data exfiltration. Additionally, ShipMonk, a shipping provider for Trezor, suffered a data breach exposing sensitive customer information. Furthermore, Cursor's CLI coding agent was found to execute untrusted repository code without user consent, posing a significant security risk. These incidents underscore the evolving threat landscape, highlighting the need for robust security measures and vigilance against sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...128 129 130 131 132...574

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Philips and GE Breached by Clop Ransomware Exploiting CVE-2026-12569

Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability

Cavern C2 Framework's Evolution: Leveraging DNS and Google Apps Script for Stealth

Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen

Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security

Critical Vulnerability in Forminator WordPress Plugin (CVE-2026-15748) Puts Sites at Risk

GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)

Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices

WindRelay Malware: A New Threat to Contactless Payments

AmnesiaStealer: A New Threat to macOS Security

APT36's PATCHCORD Backdoor: A New Threat to South Asian Critical Infrastructure

August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Philips and GE Breached by Clop Ransomware Exploiting CVE-2026-12569

Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability

Cavern C2 Framework's Evolution: Leveraging DNS and Google Apps Script for Stealth

Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen

Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security

Critical Vulnerability in Forminator WordPress Plugin (CVE-2026-15748) Puts Sites at Risk

GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)

Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices

WindRelay Malware: A New Threat to Contactless Payments

AmnesiaStealer: A New Threat to macOS Security

APT36's PATCHCORD Backdoor: A New Threat to South Asian Critical Infrastructure

August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?