Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2101 to 2112 of 5957
Palo Alto GlobalProtect VPN Auth Bypass Flaw (CVE-2026-0257) Exploited in Attacks
In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in their PAN-OS GlobalProtect portal and gateway, allowing unauthenticated attackers to establish unauthorized VPN connections. Initially rated as medium severity, the flaw's risk escalated when active exploitation was observed starting May 17, 2026, leading to unauthorized access attempts on corporate networks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0257?utm_source=openai)) The active exploitation of CVE-2026-0257 underscores the critical need for organizations to promptly apply security patches and review VPN configurations to prevent unauthorized access, especially as attackers increasingly target remote access solutions.
3 months ago
Kill Chain
CIFSwitch Vulnerability: A Critical Threat to Linux Systems
In May 2026, a critical local privilege escalation vulnerability named 'CIFSwitch' was discovered in the Linux kernel's CIFS subsystem. This flaw allows unprivileged users to forge CIFS authentication key descriptions, exploit the kernel's key request mechanism, and gain root privileges. The vulnerability affects multiple Linux distributions, including Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali Linux, and SLES 15 SP7, particularly those with cifs-utils versions 6.14 and higher. The issue arises from the kernel's failure to verify that cifs.spnego key requests originate from its CIFS client, enabling attackers to manipulate the authentication workflow and execute arbitrary code with root privileges. The discovery of CIFSwitch underscores the persistent risks associated with longstanding vulnerabilities in widely used systems. Its exploitation highlights the necessity for organizations to promptly apply security patches, review system configurations, and implement robust monitoring to detect and mitigate potential threats arising from such vulnerabilities.
3 months ago
Kill Chain
Polish Water Treatment Plant Breach: A Wake-Up Call for Critical Infrastructure Security
Between 2024 and 2025, Poland's Internal Security Agency (ABW) reported that state-sponsored threat actors, including APT28 and APT29, infiltrated industrial control systems (ICS) at five municipal water treatment facilities. The attackers exploited weak passwords and internet-exposed systems, gaining the capability to manipulate operational parameters, potentially compromising water quality and public safety. This breach underscores the critical vulnerabilities in essential infrastructure and the pressing need for robust cybersecurity measures. The incident highlights a growing trend of cyberattacks targeting operational technology (OT) systems within critical infrastructure sectors. As adversaries increasingly focus on these sectors, organizations must prioritize securing OT environments to prevent potential disruptions and safeguard public health.
3 months ago
Kill Chain
Urgent: PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) Exploited in the Wild
In May 2026, Palo Alto Networks disclosed an authentication bypass vulnerability (CVE-2026-0257) in its PAN-OS software, affecting GlobalProtect portals and gateways. This flaw allows unauthenticated attackers to establish unauthorized VPN connections, potentially exposing internal networks. The vulnerability impacts specific PAN-OS versions and configurations where authentication override cookies are enabled. Exploitation was observed as early as May 17, 2026, with attackers gaining VPN access to internal networks. While no lateral movement was detected, the unauthorized access poses significant security risks. Organizations are urged to apply patches or mitigations promptly to prevent potential breaches.
3 months ago
Kill Chain
CISA Adds CVE-2026-0257 to Known Exploited Vulnerabilities Catalog
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability affects the GlobalProtect portal and gateway components of Palo Alto Networks' PAN-OS software, allowing unauthenticated attackers to bypass security restrictions and establish unauthorized VPN connections. The flaw is present in multiple versions of PAN-OS, with patches available for affected systems. Organizations using vulnerable versions are urged to apply the necessary updates promptly to mitigate potential risks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0257?utm_source=openai)) The inclusion of CVE-2026-0257 in the KEV Catalog underscores the ongoing threat posed by authentication bypass vulnerabilities in widely used network security products. As attackers continue to exploit such flaws, it is imperative for organizations to maintain vigilant patch management practices and monitor for emerging threats to safeguard their networks.
3 months ago
Kill Chain
Tennessee Man Indicted for Child Exploitation Linked to Extremist Group '764'
In May 2026, Zachary Sweeney, a 30-year-old from Columbia, Tennessee, was indicted on multiple counts of child sexual exploitation. Sweeney allegedly groomed and coerced minors into producing child sexual abuse material (CSAM), which he distributed and, in some cases, sold. His activities, dating back to at least 2022, included traveling across several states to meet victims in person, where he reportedly drugged, raped, and filmed sexual acts with minors. Sweeney's involvement with the nihilistic violent extremist group '764' underscores the group's exploitation of vulnerable individuals to further their agenda of societal destabilization. ([justice.gov](https://www.justice.gov/usao-mdtn/pr/nashville-man-connected-nihilistic-violent-extremist-nve-group-indicted-sexual?utm_source=openai)) This case highlights the persistent and evolving threat posed by online extremist networks that exploit digital platforms to perpetrate and disseminate CSAM. The intersection of violent extremism and child exploitation necessitates heightened vigilance and coordinated efforts among law enforcement agencies to combat these multifaceted crimes.
3 months ago
Kill Chain
Google Chrome's New DBSC Feature: A Leap Forward in Browser Security
In May 2026, Google announced the general availability of Device Bound Session Credentials (DBSC) in Chrome, a security feature designed to prevent session cookie theft. DBSC cryptographically binds session cookies to a user's device using hardware-backed security modules like the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS. This binding ensures that even if session cookies are exfiltrated, they cannot be used on unauthorized devices, thereby mitigating risks associated with session hijacking and account takeovers. ([developer.chrome.com](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials?hl=en&utm_source=openai)) The introduction of DBSC addresses the growing threat posed by infostealer malware, which has been increasingly used to extract session cookies and bypass multi-factor authentication. By implementing DBSC, Google enhances user security by proactively preventing unauthorized access through stolen session cookies, marking a significant advancement in browser security measures. ([techradar.com](https://www.techradar.com/pro/security/google-chrome-rolls-out-a-new-tool-to-try-and-stop-infostealer-malware-in-its-tracks?utm_source=openai))
3 months ago
Kill Chain
Charter Communications Data Breach 2026: A Case Study in Social Engineering Attacks
In early April 2026, Charter Communications, a major U.S. telecommunications provider, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers gained access through a voice phishing (vishing) attack that compromised an employee's Microsoft Entra account, allowing them to infiltrate Charter's Salesforce system. This breach resulted in the exfiltration of personal information from approximately 4.9 million accounts, including names, email addresses, physical addresses, phone numbers, phone types, plan information, support ticket data, and some Customer Proprietary Network Information (CPNI). Charter confirmed the breach but stated that no sensitive personal or CPNI data was exfiltrated. After the company refused to pay the ransom demanded by ShinyHunters, the stolen data was leaked on the dark web. This incident underscores the growing threat posed by sophisticated social engineering attacks targeting employee credentials to access sensitive corporate systems. The breach highlights the critical need for robust security measures, including comprehensive employee training on phishing tactics and the implementation of multi-factor authentication, to prevent unauthorized access and protect customer data.
3 months ago
Kill Chain
Google Engineer Charged with Insider Trading on Polymarket
In May 2026, Michele Spagnuolo, a 36-year-old Google security engineer, was charged with insider trading after allegedly using confidential company data to place bets on the cryptocurrency-based prediction platform Polymarket, resulting in $1.2 million in gains. Spagnuolo accessed internal Google tools containing nonpublic search trend data and, under the alias "AlphaRaccoon," placed bets on Polymarket regarding Google's top trending search terms for 2025. His actions led to charges including commodities fraud, wire fraud, and money laundering, with potential prison sentences ranging from 10 to 20 years if convicted. This incident underscores the growing concerns over the misuse of proprietary information in emerging financial platforms like prediction markets. It highlights the need for robust internal controls and monitoring mechanisms to prevent insider trading and protect the integrity of both corporate data and financial markets.
3 months ago
Kill Chain
Data Broker Sentenced for Selling Elderly Americans' Personal Information
Between 2016 and 2023, Troy Murray, a 57-year-old from North Carolina, operated under the alias "Steve Dixon" to sell personal information of over 7 million elderly Americans to Jamaican scammers. These "lead lists" included names, phone numbers, addresses, and email addresses, which were used to perpetrate lottery fraud schemes. Murray charged approximately $500 per list, generating over $5.2 million in illicit profits. He was sentenced in May 2026 to 121 months in prison, three years of supervised release, and ordered to forfeit $5.2 million. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-sent-to-prison-for-selling-data-of-7-millions-elderly-americans/amp/?utm_source=openai)) This case underscores the escalating threat of elder fraud, with the FBI reporting a 37% increase in complaints from individuals aged 60 and older in 2025 compared to the previous year. Total losses for this demographic reached nearly $7.8 billion, highlighting the urgent need for enhanced protective measures and regulatory oversight to safeguard vulnerable populations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/man-sent-to-prison-for-selling-data-of-7-millions-elderly-americans/amp/?utm_source=openai))
3 months ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising 17 million infected devices, including computers, tablets, and smartphones. The operation involved seizing over 200 servers located in the Netherlands that controlled the botnet's infrastructure. This network was utilized for various cyberattacks, such as distributed denial-of-service (DDoS) attacks and malicious traffic proxying. The botnet was linked to a service called Asocks, which offered proxy services using compromised devices without the owners' knowledge. This incident underscores the growing threat posed by botnets leveraging residential devices, highlighting the need for enhanced security measures to protect consumer hardware from unauthorized exploitation.
3 months ago
Kill Chain
Addressing Container Security Vulnerabilities: Insights from 2026
In 2026, Kaspersky's research highlighted significant security vulnerabilities within containerized environments, emphasizing the risks associated with outdated software, misconfigurations, and the use of untrusted images. The study revealed that 64 out of 100 analyzed Docker images contained critical vulnerabilities, with only 10% being fully up to date. These vulnerabilities expose organizations to potential attacks, including unauthorized access, data breaches, and system compromises. The findings underscore the necessity for organizations to implement robust security measures, such as regular updates, thorough configuration audits, and the use of trusted container images, to safeguard their containerized infrastructures.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
