STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 3325 to 3336 of 6917 threat reports

Computer Software/Engineering5 months ago

OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security

In May 2026, cybersecurity researchers identified four critical vulnerabilities in OpenClaw, an AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—enable attackers to bypass sandbox restrictions, escalate privileges, and establish persistent control over affected systems. Exploitation could lead to unauthorized data access, system configuration tampering, and the planting of backdoors, significantly compromising system integrity and security. The discovery of these vulnerabilities underscores the urgent need for robust security measures in AI agent frameworks. As AI systems become more integrated into critical operations, ensuring their security is paramount to prevent potential exploitation by malicious actors.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering5 months ago

mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks

Between April 14 and April 21, 2026, a DShield sensor detected 24 unique IP addresses executing the 'mdrfckr' campaign, a known botnet operation active since 2018. The attackers utilized the SSH client banner 'SSH-2.0-libssh_0.11.1' and produced the hassh fingerprint '03a80b21afa810682a776a7d42e5e6fb', indicating an evolution in their tooling. The campaign's tactics, including writing a persistent SSH key and executing reconnaissance commands, remained consistent with previous observations. This incident underscores the adaptability of threat actors in updating their tools while maintaining established attack methodologies. Organizations should enhance their detection capabilities to identify new SSH client fingerprints associated with known malicious campaigns.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(high)

Read report

Financial Services5 months ago

EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot

In June 2025, security researchers discovered 'EchoLeak' (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. This flaw allowed attackers to exfiltrate sensitive enterprise data, including chat logs, OneDrive files, SharePoint content, and Teams messages, without any user interaction. The attack was initiated through a crafted email that, when processed by Copilot, triggered unauthorized data access and transmission. Microsoft promptly addressed the vulnerability upon disclosure, mitigating potential exploitation. ([techrepublic.com](https://www.techrepublic.com/article/news-microsoft-365-copilot-flaw-echoleak/?utm_source=openai)) The EchoLeak incident underscores the critical need for robust security measures in AI-integrated systems. As AI becomes more embedded in enterprise environments, ensuring comprehensive logging, visibility, and compliance with emerging regulations like the EU AI Act's traceability requirements is paramount to prevent similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Government Administration5 months ago

FrostyNeighbor's 2026 Cyberattack on Ukrainian Government: A Detailed Analysis

In March 2026, the Belarus-aligned cyberespionage group FrostyNeighbor launched a sophisticated spear-phishing campaign targeting Ukrainian governmental organizations. The attackers distributed malicious PDF documents impersonating the Ukrainian telecommunications company Ukrtelecom. These PDFs contained links that, upon clicking, led to a multi-stage infection chain. If the victim's IP address was identified as Ukrainian, the server delivered a malicious RAR archive containing a JavaScript-based downloader known as PicassoLoader. This downloader collected system information and, upon validation, deployed a Cobalt Strike beacon, granting the attackers remote control over the compromised systems. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in Eastern Europe, highlighting the increasing sophistication of phishing campaigns and the use of geofencing to target specific regions. Organizations must remain vigilant against such targeted attacks, especially those employing multi-stage infection chains and advanced payloads like Cobalt Strike.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(low)

Read report

Financial Services5 months ago

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

In May 2026, Palo Alto Networks' Unit 42 identified a new variant of the Gremlin Stealer malware, which has evolved from a basic credential harvester into a sophisticated modular toolkit. This variant employs advanced obfuscation techniques, including concealing malicious payloads within embedded resource files and utilizing instruction virtualization to evade detection. Gremlin Stealer targets sensitive information such as payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP and VPN credentials, exfiltrating this data to attacker-controlled servers for potential exploitation. The rapid evolution of Gremlin Stealer underscores a broader trend in the cyber threat landscape, where infostealers are becoming more sophisticated and harder to detect. This development highlights the urgent need for organizations to enhance their cybersecurity measures, particularly in monitoring and defending against advanced malware that employs complex evasion tactics.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Telecommunications5 months ago

Cisco SD-WAN Zero-Day CVE-2026-20182 Exploited by UAT-8616

In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager platforms. This flaw allows unauthenticated remote attackers to gain administrative access by exploiting weaknesses in the peering authentication mechanism. The threat group UAT-8616 has been actively exploiting this vulnerability, leading to unauthorized control over affected systems. Cisco has released patches to address this issue and urges immediate application to prevent further exploitation. This incident underscores the persistent targeting of network infrastructure by advanced threat actors. Organizations must prioritize timely patch management and enhance monitoring to detect and mitigate such sophisticated attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services5 months ago

Alleged Dream Market Administrator Indicted for Money Laundering

In May 2026, Owe Martin Andresen, the alleged main administrator of the defunct darknet marketplace Dream Market, was indicted in the United States on multiple counts of money laundering. Andresen, known by the alias "Speedstepper," is accused of accessing dormant cryptocurrency wallets containing millions of dollars in commission payments from Dream Market, which operated from 2013 until its shutdown in 2019. He allegedly transferred these funds into new cryptocurrency wallets and converted them into gold bars, directing shipments to his residence in Germany. German authorities arrested Andresen on May 7, 2026, under separate charges of concealment money laundering. ([justice.gov](https://www.justice.gov/usao-ndga/pr/german-citizen-charged-laundering-funds-linked-prominent-darknet-marketplace-dream?utm_source=openai)) This case underscores the persistent challenges law enforcement faces in tracking and prosecuting cybercriminals who exploit digital currencies and anonymized platforms to launder illicit proceeds. The indictment highlights the importance of international cooperation in addressing cybercrime and the evolving tactics used by threat actors to obfuscate their activities.

Threat report

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT5 months ago

Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability

In May 2026, a critical vulnerability known as Fragnesia (CVE-2026-46300) was discovered in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files. Security researcher William Bowling identified this issue and released a proof-of-concept exploit demonstrating its potential impact. The vulnerability affects all Linux kernels released before May 13, 2026, and is part of the broader 'Dirty Frag' class of vulnerabilities. The disclosure of Fragnesia underscores the ongoing challenges in securing the Linux kernel against privilege escalation attacks. With public exploits available and patches being rolled out, organizations must prioritize updating their systems to mitigate potential threats. This incident highlights the importance of proactive vulnerability management and the need for continuous monitoring of emerging security flaws.

High impact

Kill Chain

ICInitial Compromise(low)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Internet5 months ago

NGINX Vulnerability CVE-2026-42945: What You Need to Know

In May 2026, a critical vulnerability (CVE-2026-42945) was discovered in NGINX's ngx_http_rewrite_module, affecting versions 0.6.27 through 1.30.0. This heap buffer overflow flaw can be exploited by unauthenticated attackers using specially crafted HTTP requests, leading to denial-of-service conditions and, under certain configurations, remote code execution. The issue arises when NGINX configurations utilize both 'rewrite' and 'set' directives, a common pattern in API gateways and reverse proxy setups. The discovery of this 18-year-old vulnerability underscores the importance of regular code audits and timely patching. Given NGINX's widespread use across various industries, organizations are urged to update to the latest versions to mitigate potential risks associated with this flaw.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Transportation5 months ago

Cyber-Enabled Cargo Theft: A $725 Million Wake-Up Call for the Transportation Industry

In 2025, cybercriminals orchestrated a series of sophisticated attacks targeting the transportation and logistics sectors, resulting in approximately $725 million in cargo theft losses across North America. These threat actors employed phishing emails, spoofed websites, and compromised carrier accounts to infiltrate freight brokers and carriers. Once inside, they posted fraudulent listings on load boards, deceiving legitimate carriers into transporting shipments to unauthorized destinations controlled by the criminals. This method allowed entire truckloads of goods, including pharmaceuticals and consumer products, to be rerouted and stolen without physical hijacking. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai)) The surge in cyber-enabled cargo theft underscores the evolving tactics of organized crime, blending traditional theft with advanced cyber techniques. This trend highlights the urgent need for enhanced cybersecurity measures within the transportation industry to protect against such multifaceted threats.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services5 months ago

KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware

In April 2026, the threat actor KongTuke initiated a campaign leveraging Microsoft Teams to impersonate internal IT support staff. By contacting employees through external Teams chats, they persuaded victims to execute a malicious PowerShell command, leading to the deployment of ModeloRAT malware. This tactic enabled KongTuke to establish persistent access to corporate networks within minutes, facilitating data exfiltration and potential ransomware attacks. This incident underscores a significant shift in cybercriminal strategies, highlighting the exploitation of trusted communication platforms for social engineering. The rapid execution and effectiveness of this method emphasize the need for organizations to reassess and strengthen their security protocols, particularly concerning collaboration tools.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Telecommunications5 months ago

Cisco CVE-2026-20182: Critical SD-WAN Zero-Day Exploited in the Wild

In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager, which was actively exploited in zero-day attacks. This flaw allowed unauthenticated remote attackers to gain administrative privileges by sending crafted requests, potentially enabling them to manipulate network configurations and insert rogue devices into the SD-WAN fabric. The vulnerability affected both on-premises and cloud deployments, posing significant risks to organizations relying on Cisco's SD-WAN solutions. The discovery of CVE-2026-20182 underscores the persistent targeting of network infrastructure by sophisticated threat actors. This incident highlights the critical need for organizations to promptly apply security patches, monitor for unauthorized access, and implement robust network segmentation to mitigate the impact of such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1...276 277 278 279 280...577

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security

mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks

EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot

FrostyNeighbor's 2026 Cyberattack on Ukrainian Government: A Detailed Analysis

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

Cisco SD-WAN Zero-Day CVE-2026-20182 Exploited by UAT-8616

Alleged Dream Market Administrator Indicted for Money Laundering

Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability

NGINX Vulnerability CVE-2026-42945: What You Need to Know

Cyber-Enabled Cargo Theft: A $725 Million Wake-Up Call for the Transportation Industry

KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware

Cisco CVE-2026-20182: Critical SD-WAN Zero-Day Exploited in the Wild

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security

mdrfckr Campaign Adopts Updated SSH Client in April 2026 Attacks

EchoLeak: Unveiling the Zero-Click Vulnerability in Microsoft 365 Copilot

FrostyNeighbor's 2026 Cyberattack on Ukrainian Government: A Detailed Analysis

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

Cisco SD-WAN Zero-Day CVE-2026-20182 Exploited by UAT-8616

Alleged Dream Market Administrator Indicted for Money Laundering

Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability

NGINX Vulnerability CVE-2026-42945: What You Need to Know

Cyber-Enabled Cargo Theft: A $725 Million Wake-Up Call for the Transportation Industry

KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware

Cisco CVE-2026-20182: Critical SD-WAN Zero-Day Exploited in the Wild

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?