STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 3337 to 3348 of 6917 threat reports

Computer Software/Engineering5 months ago

TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale

In May 2026, the TeamPCP hacker group infiltrated Mistral AI's codebase management system, exfiltrating nearly 5 gigabytes of internal repositories and source code. This breach was part of the broader 'Mini Shai-Hulud' supply-chain attack, which compromised official packages from TanStack and Mistral AI through stolen CI/CD credentials and legitimate workflows. The attackers are now demanding $25,000 for the stolen data, threatening to leak it publicly if a buyer isn't found within a week. This incident underscores the escalating threat of supply-chain attacks targeting software development processes. Organizations must prioritize securing their CI/CD pipelines and implement robust monitoring to detect unauthorized access promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering5 months ago

Critical Authentication Bypass Vulnerability in Burst Statistics WordPress Plugin (CVE-2026-8181)

In May 2026, a critical authentication bypass vulnerability, CVE-2026-8181, was discovered in the Burst Statistics WordPress plugin, affecting versions 3.4.0 and 3.4.1. This flaw allowed unauthenticated attackers to impersonate administrator accounts by exploiting improper handling of authentication functions, potentially leading to full site compromise. The vulnerability was actively exploited shortly after disclosure, with over 7,400 attacks recorded within 24 hours. This incident underscores the persistent threat posed by vulnerabilities in widely used WordPress plugins. It highlights the importance of prompt patching and vigilant monitoring, as attackers rapidly exploit such flaws to gain unauthorized access and control over websites.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer/Network Security5 months ago

May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection

In May 2026, multiple critical cybersecurity incidents emerged, notably the exploitation of a buffer overflow vulnerability (CVE-2026-0300) in Palo Alto Networks' PAN-OS User-ID Authentication Portal, allowing unauthenticated attackers to execute arbitrary code with root privileges. Additionally, Anthropic's AI model, Mythos, identified a low-severity vulnerability in the widely-used cURL tool, sparking debates about the efficacy of AI in vulnerability detection. These incidents underscore the persistent challenges in securing network infrastructure and the evolving role of AI in cybersecurity. The active exploitation of the PAN-OS vulnerability highlights the urgency for organizations to apply patches promptly and reassess their exposure to untrusted networks. Simultaneously, the discourse surrounding Mythos's findings emphasizes the need for a balanced approach to integrating AI tools in security workflows, ensuring they complement human expertise without overreliance.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering5 months ago

Malicious 'node-ipc' Versions Compromise Developer Credentials

On May 14, 2026, malicious versions of the widely used npm package 'node-ipc' were published, specifically versions 9.1.6, 9.2.3, and 12.0.1. These versions contained obfuscated backdoor code designed to steal developer credentials, including cloud service keys, SSH keys, and other sensitive information. The malware executed upon requiring the package, exfiltrating data to an attacker-controlled server. The compromised versions were published by an unauthorized account, indicating a potential maintainer account takeover. ([thehackernews.com](https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises. The event highlights the necessity for continuous monitoring and verification of third-party dependencies to safeguard against unauthorized code injections.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Telecommunications5 months ago

Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Controller (CVE-2026-20182)

In May 2026, Cisco disclosed a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN Controller and Manager, formerly known as vSmart and vManage. This flaw allows unauthenticated, remote attackers to gain administrative privileges by exploiting weaknesses in the peering authentication mechanism. Successful exploitation enables attackers to access NETCONF, facilitating unauthorized manipulation of network configurations. Cisco has released software updates to address this issue, emphasizing the absence of viable workarounds. Organizations are urged to apply these patches promptly to mitigate potential risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW?utm_source=openai)) The exploitation of CVE-2026-20182 underscores a concerning trend of attackers targeting critical network infrastructure components. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to monitor for unauthorized access attempts. The ongoing exploitation of such vulnerabilities emphasizes the importance of proactive security measures to protect against evolving threats. ([news.backbox.org](https://news.backbox.org/2026/05/14/ongoing-exploitation-of-cisco-catalyst-sd-wan-vulnerabilities/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Government Administration5 months ago

FrostyNeighbor APT's Targeted Cyberespionage Campaign in Poland and Ukraine

In March 2026, the Belarus-aligned advanced persistent threat (APT) group known as FrostyNeighbor launched a targeted cyberespionage campaign against government organizations in Poland and Ukraine. The attackers employed spear-phishing emails containing blurred PDF attachments that impersonated legitimate entities, such as Ukrainian telecom provider Ukrtelecom. These PDFs included malicious links leading to a multi-stage infection chain, culminating in the deployment of Cobalt Strike for post-compromise operations. Notably, the group implemented server-side victim validation, delivering payloads only to users from specific geographic locations, thereby enhancing the precision and effectiveness of their attacks. This incident underscores the evolving sophistication of nation-state cyber threats, particularly in Eastern Europe. The use of geofencing and advanced spear-phishing techniques highlights the need for organizations to bolster their cybersecurity defenses, especially against highly targeted and adaptive adversaries.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services5 months ago

Understanding the Risks: AI Integration and Cloud Security

In 2025, the enterprise risk landscape experienced a paradigm shift: the adoption of AI and LLMs officially becoming the primary driver of cloud risk. Today, almost 88% of organizations now leverage AI in at least one business function. With this level of integration, the risk of AI is now outpacing traditional security guardrails, culminating in a highly complex and interconnected attack surface. SentinelOne’s new AI and Cloud Verified Exploit Paths and Secrets Scanning Report examines this evolving threatscape and draws on telemetry from over 11,000 anonymized customer environments to offer deeper visibility into how threat actors are actively exploiting modern cloud and AI infrastructures. A primary finding of the 2026 report is the rising proliferation of AI-specific credentials. The data indicates that AI-related secrets — such as OpenAI API Keys, Azure OpenAI API Keys, and others — increased by approximately 140% in a span of one year. This growth correlates directly with the rapid embedding of AI technologies into customer support systems, internal tooling, financial platforms, and product experiences. Ubiquitous deployment has generated a widespread organizational pattern known as 'shadow AI' – the unsanctioned use of AI tools in an environment without formal IT approval or security oversight. In practice, this occurs when developers or internal teams utilize unmanaged or personal LLM keys to process corporate data outside of sanctioned IT or security channels. Since these AI integrations span numerous internal applications, the same API keys are frequently duplicated and stored within code repositories, SaaS configurations, and development scripts. Compounding this, these credentials are often implemented without proper access controls or routine rotation schedules. The sprawl of these credentials renders them difficult to track via standard secrets management protocols, establishing a requirement for more centralized governance over how AI keys are issued and utilized.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services5 months ago

Inside the Breach: Unveiling 'The Gentlemen' Ransomware Group's Operations

In early May 2026, the ransomware group known as 'The Gentlemen' suffered a significant data breach when an anonymous entity compromised their internal backend database. This breach exposed approximately 16GB of internal communications, tools, and operational data, which were subsequently offered for sale on underground forums. The leaked information provided unprecedented insight into the group's organizational structure, revealing a hierarchical system led by an individual known as 'zeta88,' who oversees operations, target selection, and ransom negotiations. The group employs a generous affiliate model, offering a 90/10 payout split, and utilizes a variety of tools and techniques, including AI-assisted coding, to enhance their ransomware development and deployment processes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/gentlemen-raas-gang-data-leak?utm_source=openai)) This incident underscores the evolving landscape of cyber threats, highlighting the increasing sophistication and organizational complexity of ransomware groups. The exposure of 'The Gentlemen's' internal operations offers valuable intelligence for cybersecurity professionals, enabling the development of more effective defense strategies against similar threats. Additionally, the breach serves as a reminder of the potential vulnerabilities within cybercriminal organizations themselves, which can be exploited to disrupt their activities. ([blog.checkpoint.com](https://blog.checkpoint.com/research/when-the-ransomware-gang-gets-hacked-what-the-gentlemen-leak-reveals-about-modern-ransomware-risk/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering5 months ago

GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems

In May 2026, a campaign named 'GemStuffer' exploited over 150 RubyGems packages to exfiltrate data scraped from UK local government portals. Unlike typical supply chain attacks that aim to distribute malware to developers, this operation utilized the RubyGems registry as a storage and retrieval channel for the exfiltrated data. The attackers published numerous packages containing scripts that collected public data from government websites and then uploaded this data back to RubyGems, effectively using the platform as a 'dead drop' for data storage. This method allowed the threat actors to bypass traditional command-and-control infrastructures, making detection more challenging. ([thecodingzebra.com](https://www.thecodingzebra.com/cybersecurity/gemstuffer-abuses-150-rubygems/?utm_source=openai)) This incident underscores a novel abuse of software package registries, highlighting the need for enhanced monitoring and security measures within these ecosystems. The use of legitimate platforms for data exfiltration represents an evolution in threat actor tactics, emphasizing the importance of vigilance in software supply chain security. ([cyberleveling.com](https://cyberleveling.com/blog/rubygems-gemstuffer-supply-chain-2026?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(low)

Read report

Electrical/Electronic Manufacturing5 months ago

Foxconn's 2026 Ransomware Breach: A Wake-Up Call for Manufacturing Cybersecurity

In May 2026, Foxconn, a leading electronics manufacturer, confirmed a cyberattack affecting several of its North American facilities. The Nitrogen ransomware group claimed responsibility, alleging the theft of 8 terabytes of data, including confidential project files from major clients such as Apple, Nvidia, Intel, Google, and Dell. The attack disrupted operations, forcing some employees to revert to manual processes or halt work temporarily. Foxconn's cybersecurity team responded promptly, implementing measures to restore normal production. This incident underscores the escalating threat to the manufacturing sector, which has seen a significant rise in ransomware attacks due to its critical role in global supply chains and low tolerance for operational downtime. The breach highlights the need for robust cybersecurity measures to protect sensitive data and maintain business continuity.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Internet5 months ago

NGINX Rift: Unveiling the 18-Year-Old CVE-2026-42945 Vulnerability

In May 2026, a critical vulnerability (CVE-2026-42945) was discovered in NGINX's ngx_http_rewrite_module, present since 2008. This heap buffer overflow flaw allows unauthenticated attackers to send crafted HTTP requests, potentially causing worker process crashes or remote code execution, especially on systems with Address Space Layout Randomization (ASLR) disabled. The issue affects NGINX Plus and NGINX Open Source versions up to 1.30.0 and has been patched in subsequent releases. The disclosure of this 18-year-old vulnerability underscores the importance of regular code audits and timely patching. With NGINX's widespread use across the internet, organizations are urged to update their systems promptly to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT5 months ago

Fragnesia (CVE-2026-46300): Critical Linux Kernel Vulnerability Grants Root Access

On May 13, 2026, security researcher William Bowling of the V12 security team disclosed a critical local privilege escalation vulnerability in the Linux kernel, dubbed 'Fragnesia' and tracked as CVE-2026-46300. This flaw resides in the XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to modify read-only files in the kernel page cache, leading to root access without requiring race conditions. A proof-of-concept exploit has been released, and patches are currently being developed by major Linux distributions. ([almalinux.org](https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/?utm_source=openai)) This vulnerability is particularly concerning as it follows two similar high-severity Linux kernel flaws—'Copy Fail' and 'Dirty Frag'—disclosed within the past two weeks, indicating a troubling trend of critical vulnerabilities in core kernel components. ([threataft.com](https://threataft.com/articles/fragnesia-linux-kernel-local-privilege-escalation?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

1...277 278 279 280 281...577

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale

Critical Authentication Bypass Vulnerability in Burst Statistics WordPress Plugin (CVE-2026-8181)

May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection

Malicious 'node-ipc' Versions Compromise Developer Credentials

Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Controller (CVE-2026-20182)

FrostyNeighbor APT's Targeted Cyberespionage Campaign in Poland and Ukraine

Understanding the Risks: AI Integration and Cloud Security

Inside the Breach: Unveiling 'The Gentlemen' Ransomware Group's Operations

GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems

Foxconn's 2026 Ransomware Breach: A Wake-Up Call for Manufacturing Cybersecurity

NGINX Rift: Unveiling the 18-Year-Old CVE-2026-42945 Vulnerability

Fragnesia (CVE-2026-46300): Critical Linux Kernel Vulnerability Grants Root Access

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale

Critical Authentication Bypass Vulnerability in Burst Statistics WordPress Plugin (CVE-2026-8181)

May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection

Malicious 'node-ipc' Versions Compromise Developer Credentials

Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Controller (CVE-2026-20182)

FrostyNeighbor APT's Targeted Cyberespionage Campaign in Poland and Ukraine

Understanding the Risks: AI Integration and Cloud Security

Inside the Breach: Unveiling 'The Gentlemen' Ransomware Group's Operations

GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems

Foxconn's 2026 Ransomware Breach: A Wake-Up Call for Manufacturing Cybersecurity

NGINX Rift: Unveiling the 18-Year-Old CVE-2026-42945 Vulnerability

Fragnesia (CVE-2026-46300): Critical Linux Kernel Vulnerability Grants Root Access

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?