STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 5833 to 5844 of 6939 threat reports

Industrial Automation10 months ago

Festo ICS Hidden Function Flaw Raises Global Manufacturing Security Stakes

In November 2025, Festo SE & Co. KG disclosed a critical security vulnerability (CVE-2023-3634) in its MSE6-C2M/D2M/E2M industrial control modules. The flaw, caused by hidden functionality accessible to remote, low-privileged authenticated users, could enable attackers to trigger undocumented test modes leading to a complete loss of confidentiality, integrity, and availability across affected devices. Operations worldwide in the critical manufacturing sector were potentially exposed due to this vulnerability, rated CVSS 8.8, though no evidence of active exploitation was reported. The issue prompted coordinated advisories from CERT@VDE and CISA, highlighting the systemic risk to industrial automation environments. This incident highlights ongoing threats to operational technology (OT) and industrial control systems, as the trend of exploiting hidden or undocumented features grows. With manufacturing and critical infrastructure increasingly interconnected, such vulnerabilities pose a greater risk of targeted disruptions and underscore the urgent need for proactive cybersecurity and compliance safeguards in OT environments.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(medium)

Read report

Construction10 months ago

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

In November 2025, Automated Logic disclosed critical vulnerabilities impacting multiple legacy versions of its WebCTRL Premium Server and related Carrier i-Vu and SiteScan Web products. Reported by researchers Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine, the flaws—CVE-2024-8527 (Open Redirect) and CVE-2024-8528 (Cross-site Scripting)—could allow remote attackers to deceive users into navigating to malicious sites or executing attacker-controlled scripts. These vulnerabilities affect industrial control solutions deployed globally within the Critical Manufacturing sector, potentially enabling credential theft, phishing, or unauthorized access to sensitive building automation environments. This incident underscores the urgent need for timely patching and secure software development in critical infrastructure industries. As web application attacks increase and threat actors target supply chain and operational technology, coordinated disclosures and swift remediation remain vital to reduce risk and comply with tightening regulatory frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Higher Education/Acadamia10 months ago

Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk

In November 2025, Festo SE & Co. KG disclosed a supply chain vulnerability affecting its Didactic products due to the integration of vulnerable versions of Siemens TIA Portal (V15–V18). The issue, tracked as CVE-2023-26293, stems from improper input validation, allowing attackers to leverage a path traversal flaw. This could result in the creation or overwriting of arbitrary files if a user is tricked into opening a malicious PC system configuration file, leading to potential arbitrary code execution. The exploit, which requires local access with user interaction, impacts engineering systems used globally across critical sectors, including manufacturing, energy, communications, and commercial facilities. This vulnerability is significant as it illustrates the increasing prevalence of supply chain risks in industrial and critical infrastructure software. With threat actors increasingly exploiting the software supply chain and user-driven entry vectors, maintaining rigorous update and validation processes has become a pressing challenge for organizations worldwide.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Utilities10 months ago

CISA Exposes Multi-Vendor ICS Vulnerabilities: 2025 Critical Infrastructure Security Alert

In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued six critical advisories revealing vulnerabilities across various Industrial Control Systems (ICS) devices, including those from Automated Logic, ICAM365, Opto 22, Festo, and Emerson. Attackers could exploit these flaws—ranging from weak authentication to remote code execution—potentially enabling unauthorized access, data exfiltration, or disruption of operational technology environments. ICS operators were urged to review technical details and partner with vendors for rapid mitigation to prevent lateral movement or credential compromise impacting essential infrastructure. This incident highlights the growing convergence of operational technology and IT risk, with threat actors increasingly targeting ICS environments. The regulatory and threat landscape is evolving, compelling organizations to strengthen segmentation, network monitoring, and zero trust security controls in light of rising attacks on critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Health Care / Life Sciences10 months ago

Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks

In November 2025, a critical vulnerability (CVE-2024-3871) was disclosed affecting Emerson's Appleton UPSMON-PRO, a monitoring solution widely deployed in critical infrastructure sectors including manufacturing and healthcare. Security researchers found that remotely sent, specially crafted UDP packets could trigger a stack-based buffer overflow, granting attackers SYSTEM-level privileges and permitting remote code execution on unpatched systems. The product, which reached End of Life status prior to disclosure, is still in use across several organizations, amplifying the impact of the vulnerability on global operational technology environments. This incident underscores a growing pattern of legacy ICS software vulnerabilities being targeted via low-complexity, remote attacks. Increased regulatory scrutiny and the advancing sophistication of attackers elevate the importance of updating unsupported systems and implementing defense-in-depth strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(medium)

Read report

Commercial Real Estate10 months ago

iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025

In November 2025, critical vulnerabilities were disclosed affecting iCam365 CCTV camera models P201 and QC021 (versions 43.4.0.0 and prior), allowing unauthorized access to video streams and configuration data via missing authentication controls. CVE-2025-64770 and CVE-2025-62674 enable attackers present on the same network segment to exploit unauthenticated access to ONVIF and RTSP services, potentially exposing sensitive surveillance footage and device configurations across commercial facilities globally. The vulnerabilities were reported by researcher Truong Nguyen Long and published by CISA after vendor non-responsiveness. This exposure highlights the persistent risk of IoT and security camera devices with weak or missing access controls, coinciding with broader trends of exploitation in internet-connected infrastructure. As remote surveillance soars and IoT devices proliferate, such lapses in device security increase the attack surface for organizations across industries.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(medium)

Read report

Industrial Automation10 months ago

Critical OS Command Injection Vulnerability Hits Opto 22 ICS Devices in 2025

In November 2025, Opto 22 announced a critical vulnerability (CVE-2025-13087) affecting its GRV-EPIC and groov RIO programmable logic controllers. Discovered by security researchers from Meta, the flaw resides in the Groov Manage REST API, allowing attackers with administrative access to exploit improper neutralization of special elements and execute arbitrary shell commands as root on affected devices. This vulnerability places manufacturing environments deploying these controllers at risk of remote code execution and potential full device compromise, particularly in critical infrastructure operations worldwide. The incident highlights the continued targeting of industrial control systems by security researchers and underscores the urgency for timely patching in operational technology (OT) environments. With attackers increasingly seeking entry via API abuse and elevated privileges, organizations must remain vigilant against growing threats to cloud-connected OT and IIoT assets.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(low)

Read report

Financial Services10 months ago

AI Agents: The New Attack Surface for Network Compromise in 2024

In early 2024, cybersecurity researchers highlighted a critical weakness in agentic AI systems, demonstrating that malicious actors can subvert autonomous AI agents to alter behavior and compromise entire enterprise networks. By leveraging AI agent hijacking, attackers manipulated goal-seeking models and agent-to-agent communications to bypass security controls, escalate privileges, and move laterally within high-value environments. The incident revealed how the expanding AI/ML attack surface introduces new entry vectors tied to agent autonomy, cloud AI orchestration, and internal east-west traffic, posing operational risk to organizations deploying intelligent automation at scale. This incident underscores the urgent need for AI security frameworks and robust segmentation controls as enterprises accelerate agent and copilot deployments. With rapid adoption of agentic AI, attackers are increasingly exploiting flaws in agent autonomy and communication to orchestrate sophisticated attacks, raising the bar for zero trust and security visibility in multi-cloud environments.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Telecommunications10 months ago

China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)

In 2024, ESET researchers uncovered a sustained campaign by the China-linked PlushDaemon APT that targeted edge and network devices in government, telecommunications, and technology sectors, enabling advanced adversary-in-the-middle (AitM) attacks. PlushDaemon deployed a sophisticated network implant capable of intercepting, modifying, and redirecting encrypted and unencrypted traffic, allowing the threat actor to facilitate credential theft and covert surveillance. The operation exploited weak segmentation and insufficient east-west controls, compromising business operations and exposing sensitive communications to persistent espionage. This incident is particularly relevant as APTs increasingly leverage traffic interception at the network device layer, bypassing traditional endpoint security and highlighting urgent gaps in zero trust, segmentation, and encrypted traffic monitoring solutions.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(low)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services10 months ago

Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny

In June 2024, Fortinet disclosed that a second zero-day vulnerability affecting its FortiWeb Web Application Firewall (WAF) products was actively exploited in the wild. Attackers leveraged the undisclosed flaw to bypass security controls and potentially gain unauthorized remote access to customer environments, raising major concerns about the rapidity and transparency of Fortinet's incident response. The breach followed an earlier 2024 WAF zero-day, indicating a worrying escalation in threat actor targeting and sophistication against network-edge defense systems. This incident underscores the increasing prevalence of zero-day attacks against security appliances themselves, a trend accelerated by sophisticated threat actors who seek to exploit both technical weaknesses and delayed vendor responses. Rapid incident disclosure and robust patching are now critical to safeguarding key infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Banking/Mortgage10 months ago

WhatsApp 'Eternidade' Trojan Self-Propagates Across Brazil

In early 2024, a sophisticated infostealer campaign dubbed 'Eternidade' began targeting Brazilian Portuguese–speaking WhatsApp users. The attackers distributed a trojan combining phishing, credential theft, and worm-like self-propagation via compromised WhatsApp messages. Victims were lured with messages containing malicious links; once infected, devices exposed sensitive banking credentials and personal data to attackers. The malware leveraged localized tactics and social engineering to increase infection rates and circumvent traditional perimeter defenses, leading to widespread compromise across individual users and organizations reliant on WhatsApp for communication. The rapid spread, data loss, and potential for further extortion amplified business and consumer risks. This breach signals the growing sophistication of infostealer operations, especially their ability to exploit trusted communication apps in regionally tailored attacks. The incident raises alarm over encrypted-messaging-based malware and highlights gaps in endpoint and messaging security as threat actors increasingly weaponize social communication platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Package/Freight Delivery10 months ago

How Phishing-as-a-Service Scams Exploited USPS and E-Z Pass: The Lighthouse Case

In 2025, Google filed a legal complaint against a China-based cybercriminal group alleged to have developed 'Lighthouse' Phishing-as-a-Service (PaaS) kits. These kits empower low-skilled actors to execute widespread smishing (SMS phishing) and e-commerce scams by providing templates, domain setup tools, and fake websites mimicking trusted brands such as USPS and E-Z Pass. Victims are lured via texts about overdue fees or package deliveries, redirecting them to realistic phishing sites that harvest credentials and financial information. The campaign leveraged legitimate ad platforms and payment methods, increasing its reach and credibility. The incident underscores the rising threat and sophistication of PaaS offerings, which lower the barrier for cybercrime and accelerate the proliferation of phishing campaigns. As threat actors streamline attack automation and mimic reputable organizations, enterprises must adapt with real-time detection, segmented network defenses, and stronger authentication measures.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

1...485 486 487 488 489...579

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Festo ICS Hidden Function Flaw Raises Global Manufacturing Security Stakes

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk

CISA Exposes Multi-Vendor ICS Vulnerabilities: 2025 Critical Infrastructure Security Alert

Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks

iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025

Critical OS Command Injection Vulnerability Hits Opto 22 ICS Devices in 2025

AI Agents: The New Attack Surface for Network Compromise in 2024

China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)

Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny

WhatsApp 'Eternidade' Trojan Self-Propagates Across Brazil

How Phishing-as-a-Service Scams Exploited USPS and E-Z Pass: The Lighthouse Case

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Festo ICS Hidden Function Flaw Raises Global Manufacturing Security Stakes

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

Festo Didactic 2025 Incident: Siemens TIA Portal Supply Chain Vulnerability Exposes Critical Risk

CISA Exposes Multi-Vendor ICS Vulnerabilities: 2025 Critical Infrastructure Security Alert

Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks

iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025

Critical OS Command Injection Vulnerability Hits Opto 22 ICS Devices in 2025

AI Agents: The New Attack Surface for Network Compromise in 2024

China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)

Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny

WhatsApp 'Eternidade' Trojan Self-Propagates Across Brazil

How Phishing-as-a-Service Scams Exploited USPS and E-Z Pass: The Lighthouse Case

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?