Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 229 to 240 of 5923
Critical OT Vulnerability Exposes Industrial Control Systems to Code Execution Attacks
Rockwell Automation's ControlFLASH software versions 15.07 and earlier contain a critical vulnerability (CVE-2026-12663) that grants write permissions to the 'Everyone' group on installation directories. This security flaw allows attackers to execute arbitrary code at the logged-in user's permission level, potentially compromising industrial control systems across critical infrastructure sectors including manufacturing, energy, and water systems. The vulnerability stems from missing authentication for critical functions and affects installations worldwide. Rockwell has released version 15.08 to address this issue and provided manual mitigation steps for systems that cannot immediately upgrade. This incident highlights the growing cybersecurity risks facing operational technology (OT) environments as industrial systems become increasingly connected and targeted by threat actors seeking to disrupt critical infrastructure operations.
1 week ago
Kill Chain
Chrome V8 Zero-Day CVE-2026-85046: Critical Browser Security Incident Analysis
Google patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome's V8 JavaScript engine, actively exploited in the wild. The zero-day flaw allowed remote attackers to execute arbitrary code through crafted HTML pages, representing the sixth Chrome zero-day addressed by Google in 2026. Security researcher Salvatore Gulizia discovered the bug in V8's compilers that led to array element type confusion, enabling arbitrary read/write operations on the JavaScript heap. This incident highlights the continued targeting of browser engines by threat actors seeking code execution capabilities through web-based attack vectors, emphasizing the critical importance of rapid patch deployment for client-side security vulnerabilities.
1 week ago
Kill Chain
Critical Vulnerabilities in Tycon Systems Industrial Monitoring Devices Threaten Infrastructure Security
In September 2026, CISA disclosed three critical vulnerabilities (CVE-2026-77847, CVE-2026-82712, CVE-2026-82684) affecting Tycon Systems TPDIN-Monitor-WEB3 industrial control system devices version 2.2.9 and prior. These vulnerabilities include hard-coded credentials, cross-site request forgery, and missing authorization controls that could enable attackers to perform man-in-the-middle attacks, extract system credentials, cause factory resets, or retrieve sensitive operational data from critical infrastructure systems deployed worldwide in energy and manufacturing sectors. These vulnerabilities highlight the ongoing security challenges in operational technology environments where legacy authentication models and insufficient access controls create attack vectors that could disrupt critical infrastructure operations and expose sensitive industrial data.
1 week ago
Kill Chain
Critical Plex Security Update: Multiple Vulnerabilities Patched in September 2026
In September 2026, Plex urged users to immediately update their Media Server and Desktop applications following the discovery of multiple undisclosed security vulnerabilities. The streaming media service released patches in Plex Media Server version 1.43.3 and Plex Desktop 1.115.0, with CVE identifiers requested for the flaws. While technical details remain undisclosed, this follows a pattern of critical Plex vulnerabilities, including a high-severity authentication bypass flaw (CVE-2025-34158) patched in August 2025 that exposed server owner credentials to any authenticated user. This incident highlights the ongoing security challenges facing media streaming infrastructure, particularly as threat actors increasingly target home and small business servers. With over 360,000 Plex servers exposed to the internet and a history of exploitation including the 2022 LastPass breach chain, these vulnerabilities underscore the critical need for rapid patch deployment and network segmentation.
1 week ago
Kill Chain
Mass WordPress Plugin Exploitation: 440,000 Attacks Target Critical RCE Flaws
In July-August 2026, threat actors launched widespread exploitation campaigns targeting critical remote code execution vulnerabilities in two popular WordPress plugins: Super Forms (CVE-2026-14894, CVSS 9.8) and Elementor Pro (CVE-2026-32475, CVSS 9.0-9.8). Both flaws allow unauthenticated attackers to upload malicious PHP files through missing file type validation, enabling complete site takeover. Wordfence blocked over 440,000 exploit attempts across both vulnerabilities, with attackers deploying web shells like "Mushr00w_upl.php" to establish persistent access and exfiltrate data. The mass exploitation demonstrates the continued threat to web applications through plugin vulnerabilities. These attacks highlight the accelerating pace of WordPress plugin exploitation in 2026, as threat actors increasingly target content management systems to gain initial access for broader campaigns including ransomware deployment and data theft operations.
1 week ago
Kill Chain
Critical Configuration Flaw Exposed in Inductive Automation Ignition SCADA Platform
In September 2026, CISA disclosed CVE-2026-77393 affecting Inductive Automation's Ignition SCADA platform versions 8.1.53 and earlier. The vulnerability stems from incorrect default permissions where the Gateway's 'Create Project Role(s)' setting shipped blank, allowing any authenticated user to create projects if they could execute gateway scripts. This configuration flaw exposed industrial control systems to potential unauthorized project creation and manipulation. Inductive Automation addressed the issue in version 8.1.54 by restricting project creation to Designer sessions and eliminating reliance on the problematic setting. This incident highlights the growing security challenges facing industrial control systems as they become increasingly connected and targeted by threat actors. With critical infrastructure under constant threat and new regulations emphasizing OT security, even seemingly minor configuration vulnerabilities can create significant exposure points for manufacturing and energy sector organizations.
1 week ago
Kill Chain
CVE-2026-77477 Exposes Critical Privilege Escalation Risk in OPC UA Infrastructure
CVE-2026-77477 affects OPCFoundation OPC UA LocalDiscoveryServer (LDS) installations prior to version 1.04.420, allowing attackers to intercept high-privilege console windows during installation. The vulnerability enables execution of arbitrary commands with elevated privileges when an attacker has physical or remote desktop access during the installation process. This impacts critical infrastructure sectors including chemical, energy, food and agriculture, and manufacturing worldwide, with a CVSS score of 4.6 (Medium severity). This vulnerability highlights the growing security challenges in industrial control systems and OT environments, where installation-time privilege escalation can provide attackers with persistent access to critical infrastructure components.
1 week ago
Kill Chain
Ted Backdoor Reveals Critical Gap in Load Balancer Security
In September 2026, North Korean state-sponsored actors deployed a sophisticated backdoor called 'Ted' by compromising HAProxy load balancers at two South Korean organizations in the automotive and media sectors. The attackers replaced legitimate HAProxy binaries with trojanized versions containing embedded malware that intercepted web traffic and served altered pages to selected visitors. The implant operated covertly by handling command-and-control requests without reaching backend servers, erasing traces from connection logs and statistics. The attack toolkit included additional trojans targeting system binaries like sshd and crond, along with a companion remote access trojan called curlRAT that maintained persistent access to compromised systems. This incident highlights the evolving sophistication of supply chain attacks where legitimate infrastructure components are weaponized to establish persistent footholds in critical networks. The attack demonstrates advanced techniques for traffic manipulation and steganographic communication that bypass traditional security controls focused on network perimeter defense.
1 week ago
Kill Chain
CVE-2025-10478: Rockwell Automation ICS Module Vulnerability Threatens Critical Infrastructure
A critical denial-of-service vulnerability (CVE-2025-10478) has been discovered in Rockwell Automation's 1756-ENBT ControlLogix EtherNet/IP bridge modules, affecting all versions deployed across critical infrastructure sectors worldwide. Attackers can exploit this flaw by sending crafted CIP packets to crash the module, requiring a manual restart to restore operations. The vulnerability impacts manufacturing, food and agriculture, transportation, and water treatment facilities that rely on these industrial control systems for operational continuity. This incident highlights the growing threat landscape targeting industrial control systems as critical infrastructure becomes increasingly digitized and interconnected. The vulnerability demonstrates how network-accessible ICS components remain vulnerable to simple but effective attacks that can disrupt essential services.
1 week ago
Kill Chain
PostgreSQL's 12-Year Security Blind Spot: CVE-2026-6471 Exposes Critical Database Infrastructure Risks
PostgreSQL disclosed CVE-2026-6471, a critical 12-year-old vulnerability in logical decoding that allows accounts with REPLICATION privileges to execute arbitrary code as the database server's operating system user. The flaw, present since PostgreSQL 9.4 in 2014, enables attackers to bypass existing security restrictions by loading malicious libraries through the CREATE_REPLICATION_SLOT command. Exploitation requires a replication account and wal_level=logical configuration, commonly found in backup tools, standby servers, and CDC pipelines. The vulnerability affects versions before 18.6, 17.11, 16.15, 15.19, and 14.24, with fixes introducing the output_plugin_libraries parameter to whitelist approved plugins. This incident highlights the growing threat to database infrastructure as organizations increasingly rely on distributed data architectures and replication mechanisms. With PostgreSQL powering critical applications across industries, this vulnerability exposes the risks of privilege escalation through seemingly low-privilege backup credentials, emphasizing the need for comprehensive database security controls and regular privilege audits.
1 week ago
Kill Chain
Massive Unicode Phishing Campaign Evades Email Filters Using Invisible Characters
A sophisticated phishing campaign identified by Microsoft in 2026 leveraged invisible Unicode tag characters to bypass email security filters while targeting millions of recipients with financial lures. The campaign, which peaked between February and May 2026, sent up to 2.37 million messages daily using AI-generated content distributed through the legitimate ActiveCampaign marketing platform. Attackers inserted invisible Unicode characters into financial keywords like 'funding' to evade detection while appearing normal to human recipients, demonstrating how AI-era evasion techniques are being adapted for traditional phishing campaigns. This incident highlights the evolving sophistication of email-based attacks in the AI era, where threat actors are exploiting legitimate marketing platforms and advanced obfuscation techniques to scale phishing operations at unprecedented volumes while evading traditional security controls.
1 week ago
Kill Chain
CVE-2026-28323: Critical SAML Bypass Exposes SolarWinds Help Desk Systems
CVE-2026-28323 is a critical SAML authentication bypass vulnerability in SolarWinds Web Help Desk versions 2026.1 and earlier, discovered in July 2026. Attackers can forge SAML responses and bypass login screens entirely without valid credentials, gaining administrative access to help desk systems. The vulnerability stems from conditional signature verification that only validates SAML responses when certificates are present, and accepts unsigned responses even when certificates are configured. With a CVSS score of 9.8, this flaw allows complete takeover of help desk systems containing sensitive corporate data and service tickets through a single HTTP request. This incident highlights the continued risks of legacy SAML implementations as organizations increasingly rely on federated identity for Zero Trust architectures, making proper SAML security validation more critical than ever.
1 week ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
