STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 457 to 468 of 6836 threat reports

Utilities3 weeks ago

Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure

A critical buffer overflow vulnerability (CVE-2026-15340) was discovered in the Savannah lwIP SMTP client version 2.2.1, affecting industrial control systems and critical infrastructure worldwide. The vulnerability, scored 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication by exploiting the client's failure to validate input sizes during buffer operations. The flaw impacts energy and water treatment facilities globally, as the lwIP stack is widely deployed in embedded systems and IoT devices. A patch has been released and organizations are urged to update immediately to prevent potential system crashes and remote code execution. This incident highlights the growing threat to operational technology environments as attackers increasingly target embedded systems and industrial protocols. With critical infrastructure under constant threat from nation-state actors and the expanding attack surface of connected industrial devices, vulnerabilities in fundamental networking components like lwIP pose significant risks to essential services.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Oil/Energy/Solar/Greentech3 weeks ago

Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure

Hitachi Energy disclosed critical vulnerabilities in end-of-life RTU500 industrial control systems, discovered by Dragos researchers and published in CISA advisory ICSA-26-279-06. The vulnerabilities affect RTU500 CMU firmware versions 11.x and prior, including authentication bypass (CVE-2026-8065), directory traversal (CVE-2026-8066), and improper authorization issues that allow remote attackers to upload malicious firmware, overwrite system files, and execute arbitrary commands. These legacy systems lack modern security controls and encrypted communications, creating significant risks for critical infrastructure operators worldwide who have not upgraded to supported firmware versions 12.7.8 or 13.9.1. This incident highlights the growing threat to aging industrial control systems as attackers increasingly target critical infrastructure through legacy vulnerabilities and insufficient operational technology security measures.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering3 weeks ago

Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours

In October 2026, threat actors began exploiting CVE-2026-21589, a critical arbitrary file access vulnerability in Atlassian Data Center products including Jira, Confluence, and Bitbucket. The flaw allows unauthenticated attackers to access sensitive files through path traversal manipulation, potentially exposing credentials and configuration data. Exploitation attempts began within two hours of public technical details being released, with 15 documented attacks from IP addresses in Japan and the US targeting honeypot networks. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, demonstrating how modern threat actors rapidly weaponize public proof-of-concept code to target enterprise infrastructure at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration3 weeks ago

Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise

Johnson Controls EasyIO FG industrial control systems contain critical vulnerabilities (CVE-2026-27872 and CVE-2026-27873) allowing attackers to gain full unauthorized device access through hard-coded credentials and improper privilege management. The affected firmware versions (≤2.0b52) impact building automation systems worldwide across critical infrastructure sectors including manufacturing, transportation, and energy. With CVSS scores of 7.7, successful exploitation could result in complete device compromise and operational disruption. Johnson Controls has declared the product end-of-life with no patches available, recommending migration to current-generation systems. This incident highlights the growing threat to industrial control systems and the risks posed by legacy IoT devices with embedded security flaws. As critical infrastructure becomes increasingly connected, organizations face mounting pressure to address vulnerabilities in operational technology environments that were never designed with cybersecurity in mind.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(low)

Read report

Utilities3 weeks ago

Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution

Hitachi Energy disclosed a critical Remote Code Execution vulnerability (CVE-2026-34197) in Apache ActiveMQ components within their SOI (System Operation Interface) product versions 2.0.0 to 2.2.0. The vulnerability stems from improper input validation in Apache ActiveMQ's Jolokia JMX-HTTP bridge, allowing authenticated attackers to execute arbitrary code through crafted discovery URIs that trigger Spring XML application context loading. With a CVSS score of 8.8, this supply chain vulnerability affects critical energy infrastructure worldwide and can compromise confidentiality, integrity, and availability of industrial control systems. Hitachi Energy has released EP2 patch to upgrade ActiveMQ to version 5.19.5 and implement additional security measures. This incident highlights the growing threat landscape targeting industrial control systems and critical infrastructure through supply chain vulnerabilities. As nation-state actors increasingly focus on energy sector disruption and industrial espionage, organizations must prioritize patching and securing third-party components in operational technology environments.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services3 weeks ago

FortiBleed Campaign Exposes Critical Gaps in Network Device Security

The FBI and Secret Service issued warnings in October 2026 that the FortiBleed credential harvesting campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This Russian-speaking operation has successfully compromised over 86,644 device credentials across 194 countries using a sophisticated five-stage attack chain involving credential stuffing, passive traffic interception, GPU-accelerated password cracking, and lateral movement. The campaign exploits reused credentials and legacy SHA-256 password storage, with attackers creating persistent backdoor accounts and selling access to ransomware groups including INC and Lynx operators. This incident highlights the escalating threat to network perimeter devices as initial access brokers increasingly target enterprise VPN infrastructure to enable downstream ransomware operations, making credential security and multi-factor authentication critical defensive priorities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Oil/Energy/Solar/Greentech3 weeks ago

Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems

Hitachi Energy disclosed critical vulnerabilities in their REB500 industrial control system affecting versions 8.3.3.1 and prior. Two CVEs (CVE-2024-8176 and CVE-2025-59375) target the libexpat library used by IEC 61850 functionality, allowing authenticated attackers with local access to execute denial of service attacks through crafted messages. CVE-2024-8176 involves stack overflow through uncontrolled recursion, while CVE-2025-59375 enables resource exhaustion via unbounded memory allocation. Both vulnerabilities carry CVSS scores of 6.5 and can disrupt critical energy infrastructure operations. Hitachi Energy has released version 8.3.4.0 to address these issues. These vulnerabilities highlight the growing threat landscape facing industrial control systems as critical infrastructure becomes increasingly digitized. With energy sector attacks rising and nation-state actors targeting industrial systems, organizations must prioritize OT security updates and implement proper network segmentation to protect against similar library-based exploits.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Utilities3 weeks ago

Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks

Hitachi Energy Asset Suite versions 9.9.0 and prior contain critical unauthenticated servlet access vulnerabilities (CVE-2026-7395 and CVE-2026-11796) that allow attackers to compromise confidentiality, integrity, and availability of energy sector systems. CVE-2026-7395 enables unauthorized configuration file uploads through HTTPPublishAdapterTestServlet, while CVE-2026-11796 allows unauthenticated access to multiple servlets that can trigger denial-of-service conditions. These vulnerabilities affect critical infrastructure worldwide, with systems deployed across global energy networks. This incident highlights the growing security risks in industrial control systems as energy infrastructure becomes increasingly digitized and interconnected, particularly following recent high-profile attacks on critical infrastructure by nation-state actors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Information Technology/IT3 weeks ago

PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign

In 2026, cybersecurity researchers identified the Canto Incognito campaign, deploying PoeLLM malware to build a cryptocurrency mining botnet targeting AI and LLM infrastructure. Active since April 2026, the campaign infected over 3,400 servers, peaking at nearly 2,200 affected systems in mid-June. The Italian-speaking threat actors used a creative technique, hiding command-and-control addresses within poems hosted on GitHub, and targeted enterprise-facing deployments including LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances to exploit their computational power for illicit mining operations. This incident highlights the growing threat to AI infrastructure as organizations rapidly deploy LLM services without adequate security controls, making them attractive targets for cryptojacking operations due to their powerful computing resources and often inadequate monitoring.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(high)

Read report

Computer Software/Engineering3 weeks ago

Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution

A critical vulnerability (CVE-2026-105192) in LMCache, an open-source caching system for large language model servers, allows unauthenticated remote code execution with a severity score of 9.8/10. The flaw affects LMCache versions 0.3.9 through 0.5.5 in multiprocess mode, where attackers can exploit Python pickle deserialization through ZeroMQ messaging to execute arbitrary code. The vulnerability particularly impacts deployments using routable network addresses, including LMCache's own Kubernetes example configuration, with no patch currently available. This incident highlights the growing security risks in AI infrastructure as organizations rapidly adopt LLM technologies without adequate security controls. The vulnerability represents a broader trend of supply chain risks in AI frameworks, following similar ShadowMQ vulnerabilities discovered across multiple AI inference platforms in 2025.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering3 weeks ago

Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours

On October 5th, 2024, Atlassian published patches for a critical directory traversal vulnerability (CVE-2026-21589) affecting multiple products including Jira, Confluence, and Bitbucket. The vulnerability allows attackers to read arbitrary files within the web application directory by exploiting a path traversal flaw using the pattern "::" which gets translated to "/" on the server. Within 48 hours of the Watchtowr proof-of-concept publication, SANS Internet Storm Center honeypots detected active exploitation attempts from multiple Digital Ocean IP addresses targeting the /WEB-INF/web.xml file to extract sensitive configuration data. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, with threat actors rapidly weaponizing published proof-of-concepts. The coordinated scanning activity from Digital Ocean infrastructure demonstrates how cloud platforms are increasingly leveraged for vulnerability research and exploitation campaigns targeting newly disclosed CVEs.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(low)

Read report

Financial Services3 weeks ago

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Enterprise AI deployments are creating unprecedented attack surfaces that extend far beyond the AI model itself, encompassing the entire application stack including tools, data pipelines, APIs, identity systems, and cloud infrastructure. Unlike traditional applications with predictable logic, AI systems introduce probabilistic behavior and natural language processing that can be manipulated through prompt injection attacks to execute unauthorized actions across internal systems. These attacks can chain together to compromise service accounts, bypass tenant isolation, and expose sensitive data across multiple customer environments. The integration of AI into core business workflows has fundamentally altered the enterprise security landscape, requiring organizations to rethink their approach to threat modeling and security testing. Current security practices that focus solely on model safety or traditional application security miss critical vulnerabilities in the interconnected AI ecosystem, leaving organizations exposed to sophisticated attack chains that can traverse from user-facing chatbots to critical backend infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...37 38 39 40 41...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure

Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure

Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours

Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise

Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution

FortiBleed Campaign Exposes Critical Gaps in Network Device Security

Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems

Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks

PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign

Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution

Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure

Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure

Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours

Johnson Controls EasyIO FG Critical Vulnerabilities: Hard-Coded Credentials Enable Full Device Compromise

Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution

FortiBleed Campaign Exposes Critical Gaps in Network Device Security

Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems

Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks

PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign

Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution

Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?