STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 637 to 648 of 6838 threat reports

Computer Software/Engineering1 month ago

PhantomSub Campaign Exposes Critical Gap in Package Repository Security

In September 2026, cybersecurity researchers discovered the PhantomSub campaign involving 101 malicious npm packages that collectively garnered 490,000 downloads. These packages, masquerading as legitimate Baileys WhatsApp API libraries, automatically subscribed developers' WhatsApp accounts to spam groups without consent. The campaign targeted developers building WhatsApp bots, with attackers primarily monetizing through Indonesian mobile game account sales and bot-building services. The malware operated through three variants with different obfuscation techniques, all designed to add victims to attacker-controlled channels for commercial gain. This incident highlights the growing sophistication of supply chain attacks targeting open-source ecosystems, particularly as developers increasingly rely on third-party packages for messaging and automation features. The campaign's success demonstrates how attackers exploit trust in popular libraries to achieve social engineering objectives beyond traditional data theft.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Government Administration1 month ago

Star Blizzard's RedFlick Evolution: How Russian APT Refined Espionage Tactics in 2026

Since January 2026, Russian state-sponsored threat actor Star Blizzard (FSB Centre 18) has significantly evolved their cyber espionage operations by implementing the RedFlick malware delivery technique and transitioning from targeted spear-phishing to large-scale phishing campaigns. The actor deployed CosmicPulse backdoor through sophisticated infection chains involving VHDX files, scheduled tasks, and PDF-concealed payloads, targeting over 100 organizations including Ukrainian institutions, international NGOs, Western think tanks, and government entities supporting Ukraine. RedFlick represents a notable operational shift that reduces required user interactions while improving scalability and detection evasion capabilities. This campaign demonstrates the accelerating sophistication of nation-state actors adapting their tactics in response to geopolitical conflicts, with Russian APT groups increasingly automating and scaling their operations to maximize intelligence collection efficiency against Western policy institutions.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Financial Services1 month ago

Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026

In September 2026, Kiteworks (formerly Accellion) proactively shut down its systems for nine hours after receiving federal intelligence about a potential imminent cyber attack. During this precautionary shutdown, the company discovered and patched a previously unknown critical vulnerability that affected less than 1% of its customer base. Working with federal intelligence authorities, Kiteworks developed and deployed a fix while systems were offline, implementing additional protective layers across all environments. No evidence suggests the vulnerability was ever exploited maliciously, and all systems were safely restored after the threat window passed. This incident highlights the growing trend of proactive cybersecurity measures and public-private intelligence sharing in 2026, as organizations increasingly prioritize prevention over reaction in the face of sophisticated nation-state threats and coordinated attack campaigns targeting critical infrastructure providers.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT1 month ago

OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets

A widespread security vulnerability affecting Kubernetes operators has been identified through research by Palo Alto Networks Unit 42, revealing that over 5% of operators in the OperatorHub registry contain excessive RBAC permissions that violate the principle of least privilege. The investigation led to the discovery of CVE-2026-6389, a high-severity vulnerability (CVSS 8.8) in IBM's Turbonomic Prometurbo operator that granted cluster-wide access to secrets across all namespaces. Using their open-source OperTraitor tool, researchers found that many operators function as silent backdoors due to overly permissive service account configurations, with outdated and abandoned components remaining easily accessible through default registries. This vulnerability becomes critically relevant as the industry transitions toward AI-driven agentic operators that combine traditional Kubernetes automation with large language models. The shift to autonomous, AI-enhanced cluster management amplifies the risk of RBAC misconfigurations, transforming passive security gaps into active threat vectors capable of autonomous decision-making with excessive privileges.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services1 month ago

The New Face of Email Threats: How AI is Revolutionizing Social Engineering

Modern email-based social engineering attacks have evolved significantly beyond traditional phishing methods, leveraging AI to craft sophisticated campaigns that bypass conventional security awareness training. Attackers now employ AI-powered tools to generate grammatically perfect content, use QR codes to evade URL inspection, and deploy techniques like ConsentFix and ClickFix that manipulate legitimate authentication flows. These attacks target active user sessions and authentication tokens rather than just passwords, with QR code phishing accounting for one in nine detected phishing emails in recent ESET telemetry. This evolution represents a critical shift in the threat landscape as cybercriminals increasingly weaponize AI to scale personalized attacks and exploit the expanding attack surface of cloud-native environments. Organizations must move beyond traditional awareness training to implement zero-trust verification controls and advanced detection capabilities that can identify sophisticated social engineering attempts in real-time.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering1 month ago

AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities

In 2024, GitHub Security Lab researchers developed an open-source AI security agent that successfully identified 24 vulnerabilities across multiple Android applications, including critical flaws in popular apps like OsmAnd navigation (10+ million downloads) and Wikipedia. The AI-powered taskflows discovered sophisticated vulnerabilities including location tracking bypasses, account takeover mechanisms, and intent-based security flaws that traditional security testing might have missed. The research demonstrates how AI agents can systematically analyze mobile application codebases to identify complex logic vulnerabilities and API misuse patterns. This research highlights the growing effectiveness of AI-assisted security testing as mobile applications become increasingly complex and traditional manual code review struggles to scale. With Android's security model continuously evolving and new attack vectors emerging through deep links and inter-app communication, automated AI-driven vulnerability discovery represents a critical advancement in proactive mobile security.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Law Enforcement1 month ago

State Surveillance Exploits WhatsApp and Signal Device Linking Features

German law enforcement has been exploiting device linking features in encrypted messaging apps WhatsApp and Signal to conduct surveillance operations. The technique involves connecting a police-controlled computer to a suspect's messaging account through either physical access to their device or intercepting verification codes via state-sanctioned phishing attacks and SMS interception. Once connected, all messages are delivered to the law enforcement device without breaking encryption, effectively bypassing the security protections these apps provide. This surveillance method has raised significant concerns about digital privacy and the potential for abuse of legitimate messaging features by state actors. This incident highlights the growing sophistication of state-sponsored surveillance techniques that exploit legitimate application features rather than traditional cryptographic attacks. As governments worldwide expand digital surveillance capabilities and encrypted communications become more prevalent, understanding these attack vectors is crucial for both individual privacy protection and organizational security planning.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services1 month ago

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

In September 2024, Citrix NetScaler appliances became targets of active zero-day exploitation involving CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on the CVSS scale. Attackers exploited a command injection vulnerability affecting all NetScaler devices in default configurations, achieving remote code execution. The incident was particularly notable for Citrix's delayed disclosure, leaving customers without official warnings for over 36 hours while exploitation was actively occurring. Security professionals, insurance providers, and researchers issued unofficial warnings through back channels before Citrix finally published patches and advisories. With over 50,000 publicly exposed NetScaler instances potentially vulnerable, the incident highlighted critical gaps in vendor communication during active exploitation scenarios. This incident underscores the growing trend of attackers targeting network infrastructure appliances as initial access vectors, particularly in an era where traditional perimeter security models are increasingly inadequate. The delayed vendor response demonstrates the urgent need for organizations to implement zero-trust architectures and real-time threat detection capabilities rather than relying solely on vendor patches and advisories.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(medium)

Read report

Financial Services1 month ago

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

In December 2024, Kiteworks, a secure file transfer provider, issued an unprecedented advisory telling customers to take production systems offline following credible threat intelligence from federal authorities about an imminent cyberattack. The company proactively shut down customer environments over the weekend while working with federal intelligence agencies and security partners including Mandiant. During the shutdown, Kiteworks discovered and patched a critical vulnerability in their Advanced Forms product affecting approximately 50 organizations, with no evidence of exploitation. The company resumed normal operations after continuous monitoring showed no malicious activity. This incident highlights the growing trend of proactive threat response and public-private intelligence sharing in cybersecurity. As supply chain attacks continue to target file transfer and collaboration platforms, the willingness of vendors to prioritize security over operational convenience signals a maturation in industry threat response practices.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration1 month ago

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

In September 2026, CISA issued emergency directives ordering federal agencies to patch two critical Citrix NetScaler zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) by Wednesday after confirming active exploitation. The vulnerabilities allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, affecting thousands of internet-exposed instances. Threat actors were observed placing shellcode directly into memory on vulnerable systems, prompting national cybersecurity agencies to advise organizations to immediately shut down unpatched NetScaler deployments. This incident highlights the persistent targeting of network infrastructure appliances that serve as critical trust boundaries in enterprise environments. The rapid exploitation of these zero-days demonstrates the increasing sophistication of threat actors who can weaponize vulnerabilities within hours of discovery, making traditional patch cycles inadequate for defending against modern attack timelines.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Telecommunications1 month ago

Military Insider Threat: How Zero Trust Could Have Stopped a $1M+ Extortion Campaign

Former U.S. Army soldier Cameron John Wagenius, operating under aliases 'kiberphant0m' and 'cyb3rph4nt0m', was sentenced to 70 months in prison for orchestrating a sophisticated extortion campaign targeting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. Wagenius and his conspirators used SSH brute force tools to steal login credentials, accessed sensitive customer data from telecom giants including AT&T and Verizon, and demanded ransom payments totaling over $1 million while threatening to leak stolen information on cybercrime forums like BreachForums and XSS.is. The operation resulted in $294,978 in documented damages and successful data sales that enabled additional SIM-swapping frauds. This case highlights the growing trend of insider threats leveraging privileged access and sophisticated tooling to execute large-scale extortion campaigns. As organizations face increasing pressure from regulatory frameworks requiring enhanced data protection and zero-trust architectures, incidents like this demonstrate the critical need for comprehensive egress monitoring, anomaly detection, and robust access controls to prevent data exfiltration by malicious insiders.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services1 month ago

Bitget Resumes Operations After $387.5M North Korean Crypto Heist

In September 2026, cryptocurrency exchange Bitget suffered a major security breach attributed to North Korean state-sponsored hackers who stole $387.5 million from the platform's hot and warm wallets. The attackers compromised a critical backend system within Bitget's wallet infrastructure, enabling them to spoof transaction data and trigger unauthorized fund transfers across multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget temporarily suspended all withdrawals as a security measure before gradually resuming services starting with Bitcoin withdrawals. This incident highlights the continuing evolution of North Korean cyber operations targeting cryptocurrency exchanges, representing part of an estimated $6 billion in crypto assets stolen since 2017. The breach demonstrates sophisticated techniques for compromising wallet infrastructure and the ongoing threat to digital asset platforms from nation-state actors seeking to circumvent international sanctions.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...52 53 54 55 56...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

PhantomSub Campaign Exposes Critical Gap in Package Repository Security

Star Blizzard's RedFlick Evolution: How Russian APT Refined Espionage Tactics in 2026

Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026

OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets

The New Face of Email Threats: How AI is Revolutionizing Social Engineering

AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities

State Surveillance Exploits WhatsApp and Signal Device Linking Features

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

Military Insider Threat: How Zero Trust Could Have Stopped a $1M+ Extortion Campaign

Bitget Resumes Operations After $387.5M North Korean Crypto Heist

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

PhantomSub Campaign Exposes Critical Gap in Package Repository Security

Star Blizzard's RedFlick Evolution: How Russian APT Refined Espionage Tactics in 2026

Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026

OperTraitors: Critical RBAC Vulnerability in Kubernetes Operators Exposes Cluster Secrets

The New Face of Email Threats: How AI is Revolutionizing Social Engineering

AI-Powered Security Agent Uncovers 24 Critical Android Vulnerabilities

State Surveillance Exploits WhatsApp and Signal Device Linking Features

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

Military Insider Threat: How Zero Trust Could Have Stopped a $1M+ Extortion Campaign

Bitget Resumes Operations After $387.5M North Korean Crypto Heist

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?