STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 3505 to 3516 of 6927 threat reports

Telecommunications6 months ago

UAE Faces Unprecedented Cyberattacks Amid Regional Tensions

In early 2026, the United Arab Emirates (UAE) experienced a significant surge in cyberattacks, with daily breach attempts escalating from 90,000–200,000 to between 600,000 and 800,000 following the onset of military operations by Israel and the U.S. against Iran. These attacks, attributed to nation-state actors and hacktivist groups, targeted critical infrastructure sectors such as finance, telecommunications, aviation, law enforcement, and energy. The UAE's Cybersecurity Council reported that the national cyber defense system successfully thwarted these organized cyberattacks, which included ransomware, phishing campaigns, and the exploitation of artificial intelligence technologies to develop sophisticated offensive tools. ([gulfnews.com](https://gulfnews.com/uae/government/uae-thwarts-terrorist-cyberattacks-targeting-vital-digital-infrastructure-1.500451219?utm_source=openai)) This escalation underscores the evolving nature of cyber threats in the region, highlighting the increasing integration of advanced technologies into malicious digital activities. The UAE's proactive defense measures and improved cyber visibility have been instrumental in mitigating the impact of these attacks, reflecting a broader trend of heightened cyber resilience among Gulf nations. ([thenationalnews.com](https://www.thenationalnews.com/future/technology/2026/02/18/uae-cybersecurity-fake-news-disinformation/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services6 months ago

Critical Remote Code Execution Vulnerability in Palo Alto PAN-OS (CVE-2026-0300)

In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software, specifically within the User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability affects multiple versions of PAN-OS, including 12.1, 11.2, 11.1, and 10.2, with exploitation observed in instances where the User-ID Authentication Portal is exposed to untrusted networks or the public internet. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The active exploitation of CVE-2026-0300 underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in critical network infrastructure. Organizations are urged to implement immediate mitigations, such as restricting access to the User-ID Authentication Portal to trusted internal networks, to reduce the risk of compromise. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services6 months ago

CloudZ RAT and Pheno Plugin Exploit Windows Phone Link to Steal Credentials

In May 2026, cybersecurity researchers uncovered an intrusion involving the CloudZ remote access tool (RAT) and a previously undocumented plugin named Pheno. The attackers exploited Microsoft's Phone Link application to intercept sensitive mobile data, including SMS messages and one-time passwords (OTPs), without compromising the mobile device itself. This method allowed the attackers to bypass two-factor authentication mechanisms by accessing credentials synchronized between the victim's PC and mobile device. This incident highlights the evolving tactics of threat actors who are increasingly targeting legitimate cross-device synchronization features to facilitate credential theft. Organizations should reassess their security postures, especially concerning applications that bridge mobile and desktop environments, to mitigate similar threats.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Industrial Automation6 months ago

ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now

In January 2026, ABB identified a vulnerability in its B&R PVI client application, specifically versions prior to 6.5.0. The flaw, designated as CVE-2026-0936, involves the insertion of sensitive information into log files. If exploited, an authenticated local attacker could access credential information processed by the PVI client. Notably, the logging function is disabled by default, mitigating immediate risk. ABB has released version 6.5.0 to address this issue and recommends users update promptly. This incident underscores the critical importance of secure logging practices in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must proactively manage vulnerabilities to safeguard sensitive information and maintain system integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Government Administration6 months ago

Critical Vulnerability in Johnson Controls CEM AC2000: CVE-2026-21661

In May 2026, a critical vulnerability (CVE-2026-21661) was identified in Johnson Controls' CEM AC2000 versions 10.6, 11.0, and 12.0. This flaw, stemming from an uncontrolled search path element, allows standard users to escalate privileges on the host machine via DLL hijacking. The vulnerability affects sectors such as Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy. Johnson Controls has released specific updates to remediate this issue. The incident underscores the persistent risks associated with DLL hijacking vulnerabilities in critical infrastructure systems. Organizations are urged to promptly apply the recommended updates and review their security protocols to prevent potential exploitation.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Oil/Energy/Solar/Greentech6 months ago

Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208

In April 2026, Hitachi Energy disclosed a vulnerability in its PCM600 product, specifically affecting versions up to 3.1 SP3. The flaw, identified as CVE-2018-1002208, stems from the use of SharpZipLib versions prior to 1.0 RC1, which are susceptible to directory traversal attacks. Exploiting this 'Zip-Slip' vulnerability, attackers can write arbitrary files via crafted Zip archives, potentially compromising system integrity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2018-1002208?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilant dependency management. Organizations must proactively address known vulnerabilities in third-party libraries to mitigate risks associated with supply chain attacks and ensure the security of their operational environments.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services6 months ago

MuddyWater's Deceptive Ransomware Attack via Microsoft Teams

In early 2026, the Iranian state-sponsored hacking group MuddyWater executed a sophisticated cyber-espionage operation disguised as a Chaos ransomware attack. Utilizing Microsoft Teams for social engineering, the attackers engaged in interactive screen-sharing sessions to harvest credentials and manipulate multi-factor authentication (MFA). Once inside, they bypassed traditional ransomware workflows, opting instead for data exfiltration and establishing long-term persistence through remote management tools like DWAgent and AnyDesk. This operation highlights the evolving tactics of state-sponsored actors in obfuscating their activities by mimicking financially motivated cybercriminals. The incident underscores a growing trend where nation-state actors adopt cybercriminal methodologies to obscure attribution and complicate defensive responses. Organizations must remain vigilant against such deceptive tactics, emphasizing the need for robust security measures, continuous monitoring, and employee training to counteract sophisticated social engineering attacks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Industrial Automation6 months ago

Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043

In January 2026, ABB disclosed a critical vulnerability (CVE-2025-11043) in its B&R Automation Studio software versions prior to 6.5. This flaw involves improper certificate validation in the OPC-UA and ANSL over TLS clients, potentially allowing unauthenticated attackers to intercept and manipulate data exchanges. Such exploitation could lead to unauthorized access and control over industrial automation systems, posing significant risks to operational integrity. The increasing reliance on secure communication protocols in industrial control systems underscores the importance of robust certificate validation mechanisms. This incident highlights the necessity for organizations to promptly update affected systems and implement comprehensive security measures to mitigate similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering6 months ago

Critical SQL Injection Vulnerability in LiteLLM Exploited Within 36 Hours

In April 2026, a critical pre-authentication SQL injection vulnerability, CVE-2026-42208, was discovered in LiteLLM, an open-source proxy facilitating unified API access to multiple large language model providers. This flaw allowed unauthenticated attackers to execute arbitrary SQL commands, leading to unauthorized access to sensitive data, including API keys for providers like OpenAI, Anthropic, and AWS Bedrock. Exploitation was observed within 36 hours of public disclosure, highlighting the rapid weaponization of such vulnerabilities. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) The swift exploitation of CVE-2026-42208 underscores the increasing targeting of AI infrastructure by threat actors. Organizations utilizing AI services must prioritize timely patching and robust security measures to protect against similar vulnerabilities and safeguard sensitive credentials.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT6 months ago

Understanding CVE-2026-31431: The 'Copy Fail' Linux Privilege Escalation Vulnerability

On April 29, 2026, researchers disclosed a critical local privilege escalation vulnerability in the Linux kernel, identified as CVE-2026-31431, commonly referred to as 'Copy Fail'. This flaw allows unprivileged local users to escalate their privileges to root across major Linux distributions released since 2017, including Ubuntu, Red Hat Enterprise Linux, and SUSE. The vulnerability stems from a logic error in the kernel's cryptographic subsystem, specifically within the algif_aead module of the AF_ALG interface, enabling attackers to modify the in-memory cache of privileged executable files without altering the physical files on disk. This issue is particularly concerning in environments such as Kubernetes clusters and multi-tenant hosts, where it can facilitate container escapes and compromise of shared resources. Given the availability of a reliable proof-of-concept exploit and active exploitation in the wild, organizations are urged to apply vendor-issued kernel updates immediately to mitigate the risk.

High impact

Kill Chain

ICInitial Compromise(low)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Hardware6 months ago

New Rowhammer Attacks Compromise NVIDIA GPUs, Leading to Full System Control

In April 2026, independent research teams unveiled novel Rowhammer attacks targeting NVIDIA's Ampere-generation GPUs, specifically the RTX 3060 and RTX 6000 models. These attacks, named GDDRHammer and GeForge, exploit vulnerabilities in GDDR6 memory to induce bit flips, granting attackers arbitrary read/write access to CPU memory and leading to full system compromise. The attacks are particularly effective when IOMMU memory management is disabled, a common default in BIOS settings. ([arstechnica.com](https://arstechnica.com/security/2026/04/new-rowhammer-attacks-give-complete-control-of-machines-running-nvidia-gpus/?utm_source=openai)) The emergence of these GPU-focused Rowhammer attacks signifies a critical evolution in hardware-based vulnerabilities, extending beyond traditional CPU memory exploits. This development underscores the urgent need for enhanced security measures in GPU architectures, especially as GPUs play pivotal roles in cloud computing and AI applications. Organizations must reassess their hardware security protocols to mitigate these advanced threats.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Utilities6 months ago

CISA's CI Fortify Initiative: Strengthening Critical Infrastructure Resilience

In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) launched the 'CI Fortify' initiative to bolster the resilience of U.S. critical infrastructure against state-sponsored cyber threats, particularly from Chinese groups Salt Typhoon and Volt Typhoon. This program focuses on enabling essential services to operate independently for extended periods by isolating operational technology (OT) networks from IT systems and third-party connections during emergencies. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai)) The urgency of this initiative is underscored by recent cyber activities targeting critical sectors such as electricity, water, and telecommunications. These incidents highlight the need for infrastructure operators to develop and implement isolation and recovery plans to maintain service continuity amidst potential cyber disruptions. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1...291 292 293 294 295...578

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

UAE Faces Unprecedented Cyberattacks Amid Regional Tensions

Critical Remote Code Execution Vulnerability in Palo Alto PAN-OS (CVE-2026-0300)

CloudZ RAT and Pheno Plugin Exploit Windows Phone Link to Steal Credentials

ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now

Critical Vulnerability in Johnson Controls CEM AC2000: CVE-2026-21661

Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208

MuddyWater's Deceptive Ransomware Attack via Microsoft Teams

Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043

Critical SQL Injection Vulnerability in LiteLLM Exploited Within 36 Hours

Understanding CVE-2026-31431: The 'Copy Fail' Linux Privilege Escalation Vulnerability

New Rowhammer Attacks Compromise NVIDIA GPUs, Leading to Full System Control

CISA's CI Fortify Initiative: Strengthening Critical Infrastructure Resilience

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

UAE Faces Unprecedented Cyberattacks Amid Regional Tensions

Critical Remote Code Execution Vulnerability in Palo Alto PAN-OS (CVE-2026-0300)

CloudZ RAT and Pheno Plugin Exploit Windows Phone Link to Steal Credentials

ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now

Critical Vulnerability in Johnson Controls CEM AC2000: CVE-2026-21661

Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208

MuddyWater's Deceptive Ransomware Attack via Microsoft Teams

Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043

Critical SQL Injection Vulnerability in LiteLLM Exploited Within 36 Hours

Understanding CVE-2026-31431: The 'Copy Fail' Linux Privilege Escalation Vulnerability

New Rowhammer Attacks Compromise NVIDIA GPUs, Leading to Full System Control

CISA's CI Fortify Initiative: Strengthening Critical Infrastructure Resilience

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?