STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 4057 to 4068 of 6938 threat reports

Health Care / Life Sciences7 months ago

Hims & Hers Data Breach: Lessons in Securing Third-Party Platforms

In early February 2026, telehealth company Hims & Hers experienced a data breach when unauthorized individuals accessed their third-party customer service platform, Zendesk. The attackers infiltrated the system between February 4 and February 7, compromising support tickets that contained customer names, contact information, and other personal data. Notably, medical records and doctor communications remained unaffected. The breach was attributed to the ShinyHunters extortion group, which exploited compromised Okta SSO accounts to gain access to Zendesk and exfiltrate millions of support tickets. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hims-and-hers-warns-of-data-breach-after-zendesk-support-ticket-breach/?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups targeting third-party service platforms through sophisticated social engineering and credential compromise techniques. Organizations must enhance their security measures, particularly around SSO systems and third-party integrations, to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services7 months ago

Drift Protocol's $285 Million Exploit: A Case Study in DeFi Vulnerabilities

On April 1, 2026, Solana-based decentralized exchange Drift Protocol suffered a significant security breach resulting in the loss of approximately $285 million. The attackers employed a sophisticated strategy involving the creation of a fictitious asset, CarbonVote Token (CVT), which was manipulated to appear as legitimate collateral through wash trading and oracle exploitation. Utilizing pre-signed durable nonce transactions and social engineering tactics, the attackers gained unauthorized access to Drift's administrative controls, enabling them to list CVT as valid collateral and remove withdrawal limits. This allowed for rapid, large-scale withdrawals of genuine assets, including USDC, SOL, and JLP tokens, within a 12-minute window. The stolen funds were swiftly bridged to Ethereum, complicating recovery efforts. ([trmlabs.com](https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist?utm_source=openai)) This incident underscores the evolving threat landscape in decentralized finance (DeFi), highlighting the vulnerabilities associated with governance mechanisms, oracle dependencies, and administrative controls. The use of durable nonce transactions and social engineering reflects a trend towards more complex and coordinated attacks targeting DeFi platforms. Additionally, the suspected involvement of North Korean state-sponsored actors emphasizes the geopolitical dimensions of cyber threats in the cryptocurrency sector. ([thehackernews.com](https://thehackernews.com/2026/04/drift-loses-285-million-in-durable.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Banking/Mortgage7 months ago

New SparkCat Variant Targets iOS and Android Users, Stealing Crypto Wallet Recovery Phrases

In April 2026, cybersecurity researchers identified a new variant of the SparkCat malware infiltrating both the Apple App Store and Google Play Store. This sophisticated malware masquerades as legitimate applications, such as enterprise messengers and food delivery services, to gain access to users' photo galleries. Once installed, it employs optical character recognition (OCR) technology to scan images for cryptocurrency wallet recovery phrases, subsequently exfiltrating this sensitive information to attacker-controlled servers. The malware's advanced obfuscation techniques and cross-platform capabilities underscore the evolving threat landscape targeting mobile users. The resurgence of SparkCat highlights a concerning trend in mobile malware development, emphasizing the need for heightened vigilance among users and app store operators. The ability of such malware to bypass official app store security measures and target sensitive financial information calls for enhanced detection mechanisms and user education to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services7 months ago

Microsoft Reveals Stealthy Cookie-Controlled PHP Web Shells on Linux Servers

In April 2026, Microsoft Defender Security Research Team identified a sophisticated attack technique where threat actors deploy PHP-based web shells on Linux servers, utilizing HTTP cookies as control channels. This method allows attackers to execute remote code by embedding commands within cookie values, enabling stealthy persistence through cron jobs that recreate the web shell even after removal. The approach effectively conceals malicious activities within normal web traffic, significantly complicating detection efforts. This incident underscores a growing trend of attackers leveraging legitimate web components to maintain undetected access to compromised systems. The use of cookie-controlled web shells highlights the need for enhanced monitoring of web server activities and the implementation of robust security measures to detect and prevent such covert operations.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration7 months ago

TA416's Renewed Cyber Espionage Campaigns Target European Governments

In mid-2025, the China-aligned threat actor TA416 resumed cyber espionage operations targeting European government and diplomatic entities after a two-year hiatus. The group employed sophisticated techniques, including web bug reconnaissance and evolving malware delivery methods, to deploy the PlugX backdoor via DLL sideloading. These campaigns primarily focused on individuals associated with NATO and EU delegations, leveraging compromised accounts and freemail services to distribute malicious payloads. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai)) This resurgence underscores the persistent threat posed by state-sponsored actors to governmental institutions, highlighting the need for enhanced cybersecurity measures and vigilance against evolving attack vectors. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services7 months ago

Apple Releases Critical Update to Patch DarkSword Exploit in iOS 18

In March 2026, Apple addressed the DarkSword exploit chain, a sophisticated malware targeting iOS versions 18.4 through 18.7. DarkSword enabled attackers to gain unauthorized access to sensitive user data by exploiting multiple vulnerabilities, primarily through malicious websites. Initially, Apple released patches for iOS 26, leaving many devices running iOS 18 vulnerable. However, on April 1, 2026, Apple extended the security update to iOS 18.7.7, safeguarding users who had not upgraded to the latest OS. ([techcrunch.com](https://techcrunch.com/2026/04/01/apple-releases-security-fix-for-older-iphones-and-ipads-to-protect-against-darksword-attacks/?utm_source=openai)) This incident underscores the evolving threat landscape where advanced exploit kits are increasingly accessible to a broader range of threat actors. The public availability of DarkSword's code on platforms like GitHub has heightened the risk, emphasizing the necessity for timely software updates and robust security measures to protect against such vulnerabilities. ([tomsguide.com](https://www.tomsguide.com/phones/iphones/darksword-exploit-just-went-global-millions-of-iphones-now-wide-open-to-hackers?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Retail Industry7 months ago

Hasbro's 2026 Cyberattack: A Wake-Up Call for Corporate Cybersecurity

In late March 2026, Hasbro, Inc., a leading American toy and entertainment company, detected unauthorized access to its network. Upon discovery on March 28, the company promptly activated its security incident response protocols, implemented containment measures—including taking certain systems offline—and engaged third-party cybersecurity experts to investigate the breach. While essential business operations such as order processing and product shipping continued through business continuity plans, Hasbro cautioned that interim measures might persist for several weeks, potentially causing delays. The full scope of the incident, including whether sensitive data was compromised, remains under investigation. ([techcrunch.com](https://techcrunch.com/2026/04/01/hasbro-hacked-may-take-several-weeks-to-recover/?utm_source=openai)) This incident underscores the escalating threat landscape facing large corporations, particularly those with complex digital infrastructures. The attack on Hasbro highlights the critical importance of robust cybersecurity measures and incident response strategies to mitigate operational disruptions and protect sensitive information.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering7 months ago

TeamPCP's 2026 Supply Chain Attacks: Lessons for Software Security

In March 2026, the cybercriminal group TeamPCP orchestrated a series of sophisticated supply chain attacks targeting widely used open-source software components, including Aqua Security's Trivy, Checkmarx's KICS GitHub Action, and the LiteLLM Python package. By compromising these trusted tools, TeamPCP embedded credential-stealing malware, enabling them to harvest sensitive data such as cloud credentials, SSH keys, and Kubernetes tokens from numerous organizations. The European Commission and AI startup Mercor were among the victims, with the former experiencing a significant data breach involving approximately 92 GB of sensitive information. The rapid succession and scale of these attacks underscore the critical vulnerabilities present in software supply chains and the need for enhanced security measures. ([darkreading.com](https://www.darkreading.com/threat-intelligence/teampcp-attacks-hacker-infighting?utm_source=openai)) The involvement of additional threat actors, notably ShinyHunters and Lapsus$, has further complicated the threat landscape. These groups have been observed leveraging the stolen data for extortion and monetization purposes, indicating a dangerous convergence between supply chain attackers and extortion gangs. This development highlights the evolving nature of cyber threats and the importance of proactive defense strategies to mitigate the risks associated with compromised software dependencies. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/teampcp-exploit-stolen-supply/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Utilities7 months ago

Critical RCE Vulnerability in Hitachi Energy's Ellipse Platform

In early 2026, a critical vulnerability (CVE-2025-10492) was identified in Hitachi Energy's Ellipse enterprise asset management platform, specifically within the JasperReports component used for custom reporting. This Java deserialization flaw allows remote code execution without authentication or user interaction, affecting Ellipse versions 9.0.50 and earlier. The vulnerability poses significant risks to critical infrastructure sectors, including energy and manufacturing, by potentially enabling unauthorized access and control over essential systems. ([windowsforum.com](https://windowsforum.com/threads/hitachi-ellipse-jasperreports-flaw-cve-2025-10492-rce-risk-and-mitigation-steps.409447/?utm_source=openai)) The exploitation of this vulnerability underscores the persistent threat posed by deserialization flaws in widely used third-party libraries. Organizations are urged to assess their exposure, apply available patches, and implement recommended mitigations to safeguard against potential attacks targeting this and similar vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services7 months ago

Tycoon2FA Phishing Platform: Takedown and Rapid Resurgence in 2026

In March 2026, an international law enforcement operation led by Europol and Microsoft dismantled Tycoon2FA, a phishing-as-a-service platform active since 2023. Tycoon2FA utilized adversary-in-the-middle techniques to intercept credentials and bypass multi-factor authentication, compromising over 96,000 organizations worldwide. The operation resulted in the seizure of 330 domains integral to Tycoon2FA's infrastructure, significantly disrupting its operations. However, within days, Tycoon2FA operators resumed their phishing campaigns, highlighting the resilience and adaptability of such cybercriminal enterprises. This incident underscores the persistent threat posed by sophisticated phishing platforms and the challenges in achieving lasting disruption of their activities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration7 months ago

Operation TrueChaos: Exploiting TrueConf Client Vulnerability CVE-2026-3502

In March 2026, a sophisticated cyber-espionage campaign, dubbed Operation TrueChaos, exploited a zero-day vulnerability (CVE-2026-3502) in the TrueConf Client, a video conferencing platform widely used by governments, military, and large enterprises. Attackers compromised the update mechanism, replacing legitimate updates with malicious payloads, leading to arbitrary code execution. This breach primarily targeted Southeast Asian government entities, with evidence suggesting involvement of Chinese state-backed hackers. The campaign utilized the Havoc post-exploitation framework to conduct stealthy command-and-control operations, reconnaissance, and deployment of additional malicious payloads. TrueConf has since patched the flaw in version 8.5.3, released in March 2026. Users of older versions are strongly advised to update immediately to mitigate potential risks. ([techradar.com](https://www.techradar.com/pro/security/by-replacing-a-legitimate-update-with-a-malicious-one-they-turned-the-products-update-flow-into-a-malware-distribution-channel-experts-find-flaw-in-trueconf-video-conferencing-tool-used-by-governments-military?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering7 months ago

CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation

On April 3, 2026, Trail of Bits released CoBRA, an open-source tool designed to simplify Mixed Boolean-Arithmetic (MBA) obfuscation. MBA obfuscation, commonly used by malware authors and software protectors, disguises simple operations behind complex arithmetic and bitwise expressions, making analysis challenging. CoBRA effectively simplifies 99.86% of over 73,000 tested expressions, providing security professionals with a powerful resource for deobfuscating code and enhancing malware analysis. The release of CoBRA addresses a significant challenge in cybersecurity, as MBA obfuscation has been a persistent hurdle in malware analysis. By automating the simplification process, CoBRA enables faster and more accurate analysis of obfuscated code, thereby improving threat detection and response capabilities.

Threat report

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1...337 338 339 340 341...579

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Hims & Hers Data Breach: Lessons in Securing Third-Party Platforms

Drift Protocol's $285 Million Exploit: A Case Study in DeFi Vulnerabilities

New SparkCat Variant Targets iOS and Android Users, Stealing Crypto Wallet Recovery Phrases

Microsoft Reveals Stealthy Cookie-Controlled PHP Web Shells on Linux Servers

TA416's Renewed Cyber Espionage Campaigns Target European Governments

Apple Releases Critical Update to Patch DarkSword Exploit in iOS 18

Hasbro's 2026 Cyberattack: A Wake-Up Call for Corporate Cybersecurity

TeamPCP's 2026 Supply Chain Attacks: Lessons for Software Security

Critical RCE Vulnerability in Hitachi Energy's Ellipse Platform

Tycoon2FA Phishing Platform: Takedown and Rapid Resurgence in 2026

Operation TrueChaos: Exploiting TrueConf Client Vulnerability CVE-2026-3502

CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Hims & Hers Data Breach: Lessons in Securing Third-Party Platforms

Drift Protocol's $285 Million Exploit: A Case Study in DeFi Vulnerabilities

New SparkCat Variant Targets iOS and Android Users, Stealing Crypto Wallet Recovery Phrases

Microsoft Reveals Stealthy Cookie-Controlled PHP Web Shells on Linux Servers

TA416's Renewed Cyber Espionage Campaigns Target European Governments

Apple Releases Critical Update to Patch DarkSword Exploit in iOS 18

Hasbro's 2026 Cyberattack: A Wake-Up Call for Corporate Cybersecurity

TeamPCP's 2026 Supply Chain Attacks: Lessons for Software Security

Critical RCE Vulnerability in Hitachi Energy's Ellipse Platform

Tycoon2FA Phishing Platform: Takedown and Rapid Resurgence in 2026

Operation TrueChaos: Exploiting TrueConf Client Vulnerability CVE-2026-3502

CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?