STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 4933 to 4944 of 6939 threat reports

Internet9 months ago

Match Group's 2026 Data Breach: A Wake-Up Call for Digital Security

In late January 2026, Match Group, the parent company of popular dating platforms such as Hinge, Match.com, and OkCupid, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers claimed to have exfiltrated over 10 million user records, including user IDs, transaction details, IP addresses, and internal corporate documents. The breach was reportedly facilitated through a vulnerability in AppsFlyer, a mobile marketing analytics platform utilized by Match Group. Match Group promptly initiated an investigation with external cybersecurity experts and began notifying affected users. Preliminary findings indicated that user login credentials, financial information, and private communications were not accessed. ([cybernews.com](https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated cybercriminal organizations like ShinyHunters, known for targeting high-profile companies and leaking sensitive data. The breach highlights the critical importance of securing third-party integrations and the need for robust cybersecurity measures to protect user data. Organizations must remain vigilant and proactive in identifying and mitigating potential vulnerabilities to prevent similar incidents.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services9 months ago

How the 2024 Microsoft Office Zero-Day Shaped Urgent Security Responses

In June 2024, Microsoft was compelled to release an emergency patch for a critical zero-day vulnerability affecting Microsoft Office products. The issue allowed attackers to exploit crafted Office documents, enabling remote code execution if a victim opened a malicious file. Attackers leveraged social engineering—including phishing—to trick users into opening infected attachments, bypassing standard email and endpoint defenses. Rapid weaponization of the exploit by criminal groups and likely state-backed actors resulted in significant risk for businesses using vulnerable Office deployments, with potential for data theft, malware infection, and lateral movement across networks. This attack highlights a pervasive trend of adversaries capitalizing on zero-day vulnerabilities in widely used productivity platforms. As seen in recent high-profile breaches, rapid exploitation before patches can be applied increases organizational risk and regulatory scrutiny, necessitating faster detection, patching, and user education across industries.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Health Care / Life Sciences9 months ago

Sicarii Ransomware: The 2024 False-Flag Attack with Unbreakable Encryption

In early 2024, a new ransomware variant dubbed 'Sicarii' surfaced, reportedly leveraging poorly designed, obfuscated code and incorporating Hebrew language elements that may serve as a false flag to mislead investigators about its origin. The ransomware, first detected in late 2023, compromises victim environments, encrypts files, and delivers notes demanding payment in cryptocurrency for data recovery. Although initial analysis indicates programming weaknesses, security researchers confirmed that its encryption implementation is resilient, making recovery without payment infeasible. The malware also exhibits unique lateral movement and persistence behaviors before exfiltrating data to attacker-controlled infrastructure. This incident is reflective of a broader increase in ransomware operations deploying deceptive attribution techniques and leveraging unconventional languages or scripts. The emergence of ‘Sicarii’ underscores the persistent threat and ever-evolving tactics used by ransomware groups to evade detection and complicate response efforts for organizations worldwide.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Utilities9 months ago

2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface

In early 2024, security researchers uncovered a critical vulnerability affecting widely used Telnet server software running on hundreds of thousands of legacy and IoT devices worldwide. Attackers exploited the bug, which allowed unauthenticated remote access using unencrypted Telnet sessions, to compromise network and industrial systems, bypass access controls, and rapidly pivot laterally. Many affected devices remained unpatched due to lack of vendor support, making remediation difficult and exposing organizations in healthcare, manufacturing, and critical infrastructure to potential downtime and data theft. This incident highlights the enduring risk of forgotten, legacy protocols like Telnet persisting in enterprise environments. Attackers increasingly scan for and exploit such overlooked attack surfaces, emphasizing the need for proactive inventory, segmentation, and the retirement of obsolete network services to defend against emergent threats.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(low)

Read report

Computer Software/Engineering9 months ago

WinRAR Patch Delays Enable Nation-State Attackers in 2024

In early 2024, nation-state threat actors from Russia and China exploited a critical WinRAR vulnerability (CVE-2023-38831) well after a public patch became available in July 2023. Attackers leveraged the flaw via malicious archive files to gain initial access, with phishing lures targeting small- and medium-sized businesses (SMBs) and government targets. Despite availability of security updates and widespread coverage, a significant number of organizations remained unpatched, enabling cyber-espionage operations, data theft, and operational disruptions. This incident highlights the persistent risk posed by software supply chain vulnerabilities, especially when patch adoption is slow. The continued exploitation of a months-old flaw underscores how threat actors weaponize common utilities and rely on lagging defenses, driving urgency for improved vulnerability management and zero trust controls.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(medium)

Read report

Gambling/Casinos9 months ago

China-Backed PeckBirdy APT Orchestrates Cross-Platform Attacks in 2024

In early 2024, the China-linked threat group dubbed 'PeckBirdy' orchestrated sophisticated cross-platform cyberattacks against Asian government entities and gambling platforms. Utilizing the JScript C2 framework, the attackers deployed new backdoors to penetrate both Windows and Linux systems, enabling remote command execution and persistent access. The dual-campaign approach demonstrated PeckBirdy's flexibility, targeting sectors with rich data and financial value. The initial compromise was achieved via spear-phishing emails and exploit delivery, followed by lateral movement to critical systems. Exfiltration of sensitive data and ongoing espionage activities resulted in operational disruptions and an increased risk of regulatory exposure for targeted organizations. This incident underscores the evolving nature of state-sponsored APT operations, notably the growing crossover between espionage and financially-motivated attacks. PeckBirdy's toolset and cross-platform reach reflect a trend where threat actors innovate rapidly, blending custom malware with proven C2 tactics, raising the stakes for defenders in Asia and beyond.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Computer/Network Security9 months ago

Fortinet’s 2024 Zero-Day SSO Breach: Key Lessons in Cloud Identity Security

In June 2024, Fortinet disclosed a critical zero-day vulnerability that was actively exploited by threat actors to compromise FortiCloud single sign-on (SSO) authentication, enabling unauthorized access to customer devices. Attackers leveraged the flaw to perform malicious SSO logins, bypassing authentication controls and potentially moving laterally within affected network environments. In response, Fortinet took the unprecedented step of disabling FortiCloud SSO services temporarily for all users while investigating and developing a fix. This incident underscores significant risks associated with identity and access management in cloud-delivered network security platforms. This breach highlights the growing prevalence of zero-day exploitation targeting authentication mechanisms and cloud infrastructure. As attackers increasingly focus on SSO and federated identity systems, organizations must reassess their reliance on third-party authentication, strengthen monitoring, and accelerate adoption of zero trust strategies.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration9 months ago

Fortinet 2026 Breach: Authentication Bypass via FortiCloud SSO Drives Widespread Exploitation

In January 2026, Fortinet suffered a critical security incident when attackers exploited CVE-2026-24858, an authentication bypass vulnerability impacting FortiCloud SSO on key products like FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer. Malicious actors with valid FortiCloud accounts could access devices registered to other users, enabling unauthorized firewall changes, new privileged account creation, and illicit VPN reconfiguration, even on systems patched for earlier SSO flaws. Fortinet responded by temporarily disabling and then remediating FortiCloud SSO, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. This incident underscores the risks of centralized identity platforms and SSO misconfigurations, as well as the persistent attacker interest in cloud-managed network appliances. Growing exploitation of authentication bypass vulnerabilities has regulatory and operational implications for organizations reliant on integrated cloud services.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Commercial Real Estate9 months ago

Johnson Controls Metasys Vulnerability: 2026 SQL Exposure Threatens Critical Infrastructure

In January 2026, Johnson Controls disclosed a critical vulnerability (CVE-2025-26385) affecting multiple Metasys products including the Application and Data Server (ADS), Extended Application and Data Server (ADX), LCS8500, NAE8500, System Configuration Tool (SCT), and Controller Configuration Tool (CCT). The flaw, stemming from improper neutralization of special elements used in a command, could allow remote, unauthenticated attackers to execute arbitrary SQL statements, leading to potential alteration or loss of critical data. Attackers could exploit the issue remotely over network-exposed ports, causing high impact to confidentiality, integrity, and availability across critical infrastructure sectors worldwide. This incident underscores the increasing risks posed by vulnerabilities in operational technology and industrial control systems. As attackers continue to target widely deployed OT/ICS solutions, organizations must accelerate patch deployment, network segmentation, and adopt hardened security practices to protect essential services and meet evolving regulatory expectations.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(medium)

Read report

Information Technology/IT9 months ago

Fake Dating App Used to Deliver Android Spyware in Pakistan

In early 2024, an Android spyware campaign was uncovered by ESET researchers targeting users in Pakistan via a fraudulent dating app masquerading as a legitimate platform. The attackers lured victims using romance scam tactics, convincing users to download the malicious app outside of trusted marketplaces. Once installed, the spyware harvested sensitive data including call logs, messages, and device information, forwarding it to remote command-and-control servers linked to an ongoing espionage operation. The threat actors exhibited targeted behavior, indicating a capability for victim profiling and data exfiltration on mobile devices. This incident underscores a broader cybersecurity trend: growing use of socially engineered lures and repurposed surveillance tooling in region-specific espionage. Mobile attack vectors are increasingly leveraged for targeted intelligence gathering, amplifying urgency for robust defenses and heightened awareness of app distribution risks.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services9 months ago

Oracle WebLogic Faces Automated Exploit Attempts Targeting CVE-2026-21962

In January 2026, organizations running Oracle WebLogic servers were targeted by a suspicious HTTP exploit attempt leveraging CVE-2026-21962—a recently patched vulnerability with potential for remote code execution. A series of probing requests, traced to a Russian IP address, used manipulated HTTP headers and base64-encoded payloads aiming for potential command injection via WebLogic’s ProxyServlet endpoint. While analysis suggests some exploit attempts may have involved AI-generated slop or automated scanners, reputable sources including detection from security monitors confirmed that real threats actively pursued the vulnerability, making it a high-priority concern for unpatched WebLogic deployments. No widespread compromise has yet been reported, but exposure left unaddressed might allow threat actors illicit server access or lateral movement. This incident is significant as it highlights the rapid weaponization and opportunistic scanning of newly disclosed vulnerabilities, including the use of automated tools and potentially generative AI to accelerate exploit development. The event demonstrates the need for organizations to apply patches promptly and to monitor for unusual web request patterns immediately after vulnerability disclosures.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(low)

Read report

Newspapers/Journalism9 months ago

WhatsApp Unveils "Strict Account Settings" to Combat Spyware in 2024

In June 2024, WhatsApp introduced a lockdown-style "Strict Account Settings" feature to counter the growing threat of spyware targeting its user base—including journalists, activists, and public figures. This proactive measure allows users to limit messaging and attachment options from unknown contacts, mitigating risks of exploitation similar to past incidents like the Pegasus spyware attacks. The rollout follows WhatsApp’s ongoing legal battles with threat actors and reflects the platform’s drive to strengthen user privacy and security in the wake of sophisticated surveillance malware campaigns. This development highlights an industry-wide shift towards advanced, user-accessible security controls as spyware campaigns become more adept at circumventing traditional defenses. Organizations and high-risk users face mounting pressure from both regulatory frameworks and adversary innovation, compelling tech platforms to continually adapt and raise the bar for account protection and threat mitigation.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

1...410 411 412 413 414...579

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Match Group's 2026 Data Breach: A Wake-Up Call for Digital Security

How the 2024 Microsoft Office Zero-Day Shaped Urgent Security Responses

Sicarii Ransomware: The 2024 False-Flag Attack with Unbreakable Encryption

2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface

WinRAR Patch Delays Enable Nation-State Attackers in 2024

China-Backed PeckBirdy APT Orchestrates Cross-Platform Attacks in 2024

Fortinet’s 2024 Zero-Day SSO Breach: Key Lessons in Cloud Identity Security

Fortinet 2026 Breach: Authentication Bypass via FortiCloud SSO Drives Widespread Exploitation

Johnson Controls Metasys Vulnerability: 2026 SQL Exposure Threatens Critical Infrastructure

Fake Dating App Used to Deliver Android Spyware in Pakistan

Oracle WebLogic Faces Automated Exploit Attempts Targeting CVE-2026-21962

WhatsApp Unveils "Strict Account Settings" to Combat Spyware in 2024

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Match Group's 2026 Data Breach: A Wake-Up Call for Digital Security

How the 2024 Microsoft Office Zero-Day Shaped Urgent Security Responses

Sicarii Ransomware: The 2024 False-Flag Attack with Unbreakable Encryption

2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface

WinRAR Patch Delays Enable Nation-State Attackers in 2024

China-Backed PeckBirdy APT Orchestrates Cross-Platform Attacks in 2024

Fortinet’s 2024 Zero-Day SSO Breach: Key Lessons in Cloud Identity Security

Fortinet 2026 Breach: Authentication Bypass via FortiCloud SSO Drives Widespread Exploitation

Johnson Controls Metasys Vulnerability: 2026 SQL Exposure Threatens Critical Infrastructure

Fake Dating App Used to Deliver Android Spyware in Pakistan

Oracle WebLogic Faces Automated Exploit Attempts Targeting CVE-2026-21962

WhatsApp Unveils "Strict Account Settings" to Combat Spyware in 2024

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?