STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 205 to 216 of 6832 threat reports

Government Administration1 week ago

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

In October 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Plex Media Server (four CVEs covering SSRF, URI scheme injection, and path traversal), EG Secure Solutions SiteGuard Server Edition (OS command injection), and Siemens Software Center (uncontrolled search path element). These vulnerabilities collectively enable attackers to achieve initial access, remote code execution, and full system control. Federal agencies operating under BOD 26-04 face mandatory remediation timelines, while CISA urges all organizations to prioritize patching these high-risk flaws across publicly exposed assets before threat actors can leverage pre-patch compromise windows. This catalog addition reflects a sustained attacker focus on commercial media platforms, enterprise security gateways, and industrial software distribution infrastructure. The breadth of affected vendors—consumer-grade to OT-adjacent—signals that ransomware groups and nation-state actors are actively scanning for unpatched instances, making rapid remediation and network segmentation critical defensive priorities across all sectors.

Threat report

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services1 week ago

When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection

In October 2026, Proofpoint revealed at its Protect 2026 conference that generative AI has fundamentally eroded the behavioral signals email security tools have relied upon for years. Attackers now produce fluent, hyper-personalized, and structurally unique messages at machine speed, eliminating the template reuse, language artifacts, and infrastructure patterns that traditional filters detect. A documented campaign targeted more than 30 real estate agents at a single firm with individually tailored property enquiries, each from a distinct mailbox, before pivoting to a weaponized video-meeting invitation. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints totaling approximately $3.05 billion in losses, underscoring the financial scale of the threat. This report marks a structural inflection point: behavior-based email detection is no longer sufficient as a primary defense layer. Proofpoint's introduction of intent-based, multi-tier AI reasoning—anchored in its Nexus Intent-Based Detection Model—signals an industry-wide shift toward evaluating what a message is trying to accomplish rather than how it looks, a paradigm that will pressure every enterprise email security program to reassess its detection architecture.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Government Administration1 week ago

Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders

Between August 2025 and August 2026, a previously undocumented China-aligned threat cluster tracked as Bronze Sandcastle conducted cyber-espionage campaigns against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea. The group's signature technique is DLL sideloading via legitimate Sandboxie executables, where a malicious sbiedll.dll is planted alongside trusted, digitally signed binaries to execute attacker-controlled code in memory. Encrypted config.ini payloads deploy a full-featured backdoor capable of keylogging, screenshot capture, network enumeration, and C2 communication over public file-sharing services and GitHub repositories, minimizing static detection and leaving minimal disk artifacts. Bronze Sandcastle exemplifies a maturing pattern among China-nexus APTs: abusing trusted application ecosystems and living-off-the-land techniques to bypass endpoint defenses. As DLL sideloading variants proliferate across APT41, Mustang Panda, and now Bronze Sandcastle, defenders face mounting pressure to shift from file-based detection toward behavioral monitoring of in-memory execution chains and anomalous outbound traffic.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Government Administration1 week ago

SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks

Since August 2024, the SafePay ransomware group has compromised at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. Threat actors gain initial access by exploiting unpatched VPN and edge-device vulnerabilities—including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766—and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, actors employ living-off-the-land binaries (PsExec, WinRM, RDP), disable security tooling, escalate privileges via UAC bypass and token impersonation, and exfiltrate data with FileZilla, RClone, WinSCP, and Backblaze B2 before encrypting files with a hybrid ChaCha20/RSA scheme and demanding cryptocurrency ransoms. SafePay ranked among the most active ransomware groups in 2026, demonstrating that double-extortion operations targeting unpatched edge devices and flat, under-segmented networks remain highly effective. The group's systematic abuse of legitimate administrative tools underscores a growing industry-wide challenge: distinguishing malicious LOTL activity from routine IT operations without robust east-west visibility and zero-trust segmentation controls.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT1 week ago

PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP

In October 2026, the PHP project issued emergency patches for two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—rated 9.2 on the CVSS v4.0 scale. Discovered by researchers at Wiz, Calif, and OpenAI's Codex Security team, the flaws reside in the PHP runtime engine itself, meaning every web application running on a vulnerable PHP version is exposed regardless of application-level security. Attackers can execute arbitrary code without authentication, with Apache mod_php servers at highest risk. Early exploit attempts were observed by Cloudflare before patches shipped, and organizations including BambooHR and Dutch government portals took services offline as a precaution. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This incident underscores a growing trend of AI-assisted vulnerability research accelerating exploit development timelines from months to days. The PHP2Shell flaws affect an estimated 77% of all websites using server-side languages, making this one of the broadest-impact web infrastructure vulnerabilities in recent years and raising urgent questions about runtime-layer security hygiene.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Internet1 week ago

PHP's Worst Day in Years: CVE-2026-109618 & CVE-2026-109619 Put Every Web Server at Risk

On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—affecting all PHP versions from PHP 5 through the latest releases, with a combined CVSS score of 9.4. CVE-2026-109618 enables remote code execution through out-of-memory corruption via malformed multipart MIME requests that bypass post_max_size controls, while CVE-2026-109619 exploits a use-after-free condition triggered by improper global state resets between worker requests. Proof-of-concept exploits were publicly released before the patch, and Cloudflare confirmed active in-the-wild exploitation within hours of disclosure. Organizations running PHP-based web applications—covering an estimated 77% of all server-side web infrastructure—faced immediate, widespread exposure. This incident underscores the systemic risk of pre-patch PoC availability colliding with mass-deployed open-source runtimes. The combination of unauthenticated remote code execution, a massive attack surface, and rapid weaponization mirrors the Log4Shell pattern, reinforcing the urgency of runtime traffic inspection and egress controls as compensating measures when patch cycles lag exploit availability.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Higher Education/Acadamia1 week ago

How a Single Threat Actor Used Jailbroken AI to Run Credential Theft, VoIP Fraud, and Data Exfiltration Simultaneously

In October 2026, Palo Alto Networks Unit 42 exposed a financially motivated threat actor operating under the handle BUGSTER who weaponized AI tooling—specifically the Hermes Agent framework paired with DeepSeek V4 and Cursor IDE, both with safety controls disabled—to execute multi-vector cybercrime campaigns primarily targeting Indian universities and e-commerce platforms. Operating from a single US-based server, BUGSTER leveraged AI-generated reconnaissance scripts to brute-force a university WordPress portal, exfiltrate a MongoDB database containing more than 5,200 student and faculty PII records, enumerate e-commerce API tokens and payment merchant IDs, and plan VoIP telecommunications fraud infrastructure. The actor also automated Wi-Fi password cracking via physical proximity devices and performed cryptocurrency whale reconnaissance. This incident underscores a rapidly accelerating trend: AI is collapsing the skill barrier for cybercrime. A single, relatively unsophisticated actor operated across credential theft, fraud, C2 deployment, and physical wireless attacks simultaneously—capabilities that historically required distinct specialist skill sets. The Hermes plus DeepSeek toolchain is now being adopted independently by multiple unrelated actors, signaling emergence of a new low-cost, low-friction criminal AI stack.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Internet1 week ago

22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619

In October 2026, Unit 42 researchers disclosed two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619—each carrying a CVSS 4.0 score of 9.2. CVE-2026-109618 exploits improper control flow in out-of-memory error handling via longjmp(), leaving request memory uninitialized and enabling reliable RCE through OOM triggers. CVE-2026-109619 allows attackers to read or branch on freed global memory during subsequent requests, also achieving arbitrary code execution. Palo Alto Networks Cortex Xpanse identified over 22.6 million potentially exposed instances globally, and at least one European government proactively took its public website offline. Proof-of-concept code has been observed by Unit 42 researchers, indicating active weaponization risk. These vulnerabilities reflect a broadening attacker focus on foundational web runtime environments rather than application-layer logic alone. As PHP continues to underpin millions of web servers and content management systems worldwide, critical runtime flaws like these represent a systemic risk that demands immediate patching, attack surface management, and inline threat prevention—particularly as autonomous vulnerability discovery tools lower the bar for exploitation at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Information Technology/IT1 week ago

One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack

In October 2024, an unidentified threat actor exploited a compromised multi-tenant API secret tied to ConnectWise Cloud Backup (formerly SkyKick), gaining unauthorized access to Microsoft 365 environments across hundreds of customer tenants. The attacker leveraged the stolen credential to bypass MFA, perform Microsoft Graph API reconnaissance, elevate privileges, and implant persistent backdoor credentials in affected tenants. Huntress confirmed successful sign-ins across more than 300 Entra tenants, with 162 verified compromises. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services roughly two days after initial attack activity was observed on October 15, 2024. This incident exemplifies the systemic risk of shared multi-tenant application secrets in managed service provider ecosystems. A single compromised credential cascaded into hundreds of downstream customer breaches, underscoring how supply-chain trust relationships and privileged API access can become force-multipliers for attackers targeting SMB-focused MSP platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Defense/Space1 week ago

Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage

Russian GRU-linked threat actor APT28 (also known as Fancy Bear, Swallowtail, and Forest Blizzard) conducted a targeted espionage campaign against at least three NATO-affiliated organizations: a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. Symantec researchers identified the intrusions, which involved hands-on-keyboard activity, repeated access to compromised hosts over the span of a week, and credential theft. The attackers deployed the Hookedge backdoor and a previously undocumented in-memory loader (ld.exe) that decrypts its payload only with a runtime key, making forensic recovery impossible without both components. The campaign is assessed as intelligence collection targeting European defense and government entities, potentially linked to Russia's ongoing war against Ukraine. This incident underscores the sustained sophistication of state-sponsored APT operations against defense industrial base targets. APT28's use of novel, memory-resident loaders and dedicated command-and-control infrastructure signals an evolution in operational security tradecraft, making detection and attribution increasingly difficult for defenders relying on static signatures or perimeter-only controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT1 week ago

php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks

In October 2026, the PHP project issued an emergency out-of-band patch release to address two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'php2shell' by researchers. Both flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5 onward, placing an estimated 1.3–1.9 million internet-exposed hosts at risk. Exploit code and a proof-of-concept video leaked online before the official advisory, prompting Cloudflare to detect early in-the-wild attacks and deploy emergency firewall rules across its entire customer base. Patches were shipped as versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The php2shell disclosure highlights the compounding risk posed by PHP's enormous installed base—powering 70–80% of known server-side web infrastructure including WordPress, Drupal, and Laravel—combined with the reality that the majority of exposed hosts run end-of-life branches ineligible for official patches. Pre-patch exploit leakage, rapid weaponization, and confirmed early attacks reflect an accelerating trend in which vulnerability disclosure timelines collapse, leaving defenders minimal response windows.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering1 week ago

GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now

In October 2026, OVHcloud disclosed that its open-source CLI tool hosted on GitHub was backdoored by the GlassWorm threat actor after attackers compromised a developer's GitHub account that had been silently controlled since at least March 2026. Versions 0.11.0 through 0.15.0 were trojanized with an infostealer designed to harvest secrets stored on disk. The malicious releases were live for approximately 94 minutes before detection following a customer report. GitHub's release immutability feature had been disabled, allowing tampered binaries to bypass CI/CD pipelines entirely. Affected platforms include macOS, Linux, and Windows, and all secrets on exposed machines should be treated as compromised. This incident underscores a growing and sophisticated pattern in supply-chain attacks where threat actors target developer tooling ecosystems—GitHub, npm, VSCode, and OpenVSX—to silently poison trusted distribution channels. With GlassWorm active since late 2025 and expanding its targeting scope, organizations relying on open-source CLI tools and package managers face escalating credential-theft risk with minimal detection windows.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1...16 17 18 19 20...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection

Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders

SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks

PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP

PHP's Worst Day in Years: CVE-2026-109618 & CVE-2026-109619 Put Every Web Server at Risk

How a Single Threat Actor Used Jailbroken AI to Run Credential Theft, VoIP Fraud, and Data Exfiltration Simultaneously

22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619

One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack

Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage

php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks

GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

When Every Email Looks Legitimate: How Generative AI Is Defeating Behavioral Detection

Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders

SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks

PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP

PHP's Worst Day in Years: CVE-2026-109618 & CVE-2026-109619 Put Every Web Server at Risk

How a Single Threat Actor Used Jailbroken AI to Run Credential Theft, VoIP Fraud, and Data Exfiltration Simultaneously

22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619

One API Secret, Hundreds of Breaches: Inside the ConnectWise Cloud Backup Supply-Chain Attack

Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage

php2shell: Two Critical PHP RCE Vulnerabilities Trigger Emergency Patches and Confirmed Early Attacks

GlassWorm Backdoors OVHcloud CLI on GitHub: What Developer and Cloud Security Teams Must Do Now

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?