STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 301 to 312 of 6836 threat reports

Information Technology/IT2 weeks ago

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Banking/Mortgage2 weeks ago

Hirudo Android Malware: The Next Evolution in Banking App Attacks

In October 2024, researchers discovered Hirudo, a sophisticated Android banking trojan that replaces legitimate banking applications with malicious versions to bypass security controls. The malware targets financial institutions across Indonesia, China, India, Mexico, Morocco, and Thailand by distributing infected apps through fake shopping, adult content, and entertainment platforms. Once installed, Hirudo uninstalls genuine banking apps and replaces them with patched versions containing hooking engines that disable app signature verification, accessibility checks, and Play Integrity controls while enabling credential theft, screen recording, and remote device access. This incident highlights the evolution of mobile banking malware toward application-level compromises rather than traditional device-level attacks, representing a significant escalation in threat sophistication that challenges current mobile security paradigms and banking app protection mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Government Administration2 weeks ago

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services2 weeks ago

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Financial Services2 weeks ago

Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps

In October 2026, Ledger discovered a sophisticated supply-chain attack targeting its cryptocurrency hardware wallets sold through Southeast Asian reseller CryptoBilis. Attackers implanted microcontrollers into devices that intercepted 24-word recovery phrases and transmitted them via LTE using provisioned eSIMs, leading to cryptocurrency theft from multiple users. The implants operated independently without modifying Ledger's Secure Element or OS, making them undetectable by standard integrity checks. Ledger responded by halting sales across Southeast Asia and Hong Kong while investigating the breach's full scope. This incident highlights the growing sophistication of supply-chain attacks targeting cryptocurrency infrastructure, occurring amid increased regulatory scrutiny and the rising adoption of hardware wallets by institutional investors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. The operation disrupted a sophisticated supply chain infiltration where DPRK operatives used stolen identities, laptop farms, and remote access tools to secure employment at U.S. companies while generating revenue for the sanctioned regime. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. This incident highlights the evolving threat of state-sponsored actors infiltrating corporate supply chains through identity fraud and remote work infrastructure, representing a critical escalation in North Korea's cyber operations targeting Western technology companies and their sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

The U.S. Department of Justice charged 14 individuals and dismantled over 40 laptop farms across Texas in October 2026, disrupting a North Korean fraudulent IT worker scheme known as Famous Chollima. Operating from 2019 to July 2025, the operation involved North Korean IT workers using stolen U.S. identities to secure remote positions at over 70 American companies, generating approximately $3 million in revenue that was funneled back to the DPRK regime to fund nuclear weapons programs. The scheme utilized U.S.-based facilitators who hosted company laptops and enabled financial transfers, while threat actors employed sophisticated techniques including device hash spoofing and subcontracting work to South Asian and West African freelancers. This incident highlights the evolving sophistication of nation-state actors using social engineering and identity theft to penetrate corporate networks at scale. The case demonstrates how geopolitical adversaries are increasingly leveraging legitimate business processes and remote work infrastructure to circumvent sanctions and fund military programs, making insider threat detection and identity verification critical security priorities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services2 weeks ago

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

In October 2026, Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interfaces with a CVSS score of 8.6. The zero-day flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. Limited exploitation has been observed targeting the management interface from three identified IP addresses, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 17, 2026. This incident highlights the growing trend of sophisticated attackers targeting network infrastructure devices to establish persistent access and pivot into internal networks. As organizations increasingly rely on cloud-native architectures and zero-trust frameworks, vulnerabilities in critical security appliances represent high-value targets for threat actors seeking to bypass perimeter defenses and compromise enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(medium)

Read report

Information Technology/IT2 weeks ago

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks. This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services2 weeks ago

Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation

In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally. This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services2 weeks ago

Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis

In October 2026, Cisco disclosed CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway with a CVSS score of 9.8, actively exploited by threat actors. The flaw allows unauthenticated attackers to write files to the appliance's operating system by sending crafted email attachments through the gateway, potentially achieving root-level command execution. Cisco discovered the vulnerability through internal security scanning and became aware of active exploitation in October 2026, affecting gateways with File Reputation service enabled and Content Scanner Tools versions older than 25.3.0.5525. This incident highlights the continuing trend of attackers targeting email security infrastructure as critical attack vectors, particularly as organizations increasingly rely on cloud-based email filtering solutions. The vulnerability represents part of a broader pattern of sophisticated attacks against enterprise security appliances that serve as chokepoints for organizational communications.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Government Administration2 weeks ago

TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments

TAG-193, also known as Silent Lynx and tracked as UAT-6275, conducted sustained cyber-espionage operations targeting government organizations across Central Asia and the Commonwealth of Independent States throughout 2024. The threat actor focused on diplomatic institutions, economic development agencies, and environmental policy organizations, leveraging evolving malware delivery techniques and expanded toolkits. The campaign demonstrated particular interest in water resources, forestry management, and regional infrastructure information with potential strategic value for negotiations and economic planning. Research by Cisco Talos and Recorded Future's Insikt Group revealed possible links to Kazakhstan, though the group's exact origins remain unclear. This incident highlights the growing trend of nation-state actors targeting regional governance and resource management data as geopolitical tensions increase around critical infrastructure and environmental policies in Central Asia.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

1...24 25 26 27 28...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

Hirudo Android Malware: The Next Evolution in Banking App Attacks

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation

Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis

TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

Hirudo Android Malware: The Next Evolution in Banking App Attacks

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation

Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis

TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?