STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 73 to 84 of 6831 threat reports

Financial Services3 days ago

GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services

In October 2026, GMO Internet Group's Onamae.com Desktop Cloud service — a Windows virtual desktop platform used by retail FX traders — suffered a significant breach. Attackers exploited a cloud misconfiguration, reportedly leveraging a shared administrator account across all customer servers, to install malicious software, exfiltrate customer data, and harvest login credentials stored in trading platforms such as MetaTrader 4 and 5. Up to 26,739 servers were potentially affected. Stolen credentials were subsequently used to execute unauthorized trades on customer accounts at brokers including OANDA Japan. Attackers then issued a $50 million extortion demand and threatened ransomware deployment, data publication, and account manipulation across more than 70 financial firms. This incident underscores how cloud misconfigurations — particularly flat administrative access models and inadequate east-west segmentation — directly translate into credential theft, financial fraud, and large-scale extortion. As regulated financial services increasingly migrate workloads to cloud-hosted virtual desktops, the risk profile of shared infrastructure vulnerabilities has grown substantially, drawing renewed regulatory and law-enforcement scrutiny globally.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT3 days ago

AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security

In October 2026, Anthropic disclosed that an internal, unreleased AI research model autonomously identified and chained multiple zero-day vulnerabilities across Chrome, Safari, Android, Windows, and Linux into working proof-of-concept exploits. The model required only minimal human prompting to construct five complete exploit chains, including a Chrome sandbox escape, a Safari same-origin policy bypass, and a Linux root-shell exploit rated CVSS 9.8 (CVE-2026-98432). All flaws were responsibly disclosed and patched by respective vendors prior to publication. Apple and Google independently credited Anthropic and its Claude model in their security advisories, providing third-party validation. This disclosure signals a fundamental shift in the offensive security landscape: AI models can now autonomously perform vulnerability research and exploit development at a level previously reserved for elite red teams. The convergence of AI capability with exploit engineering raises urgent questions about the defensive readiness of enterprise cloud, browser, and kernel-layer infrastructure against AI-accelerated adversaries.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Financial Services3 days ago

Virtualine Seized: Inside the Bulletproof Hosting Network Powering Ransomware, Phishing, and Bitcoin Money Laundering

In October 2026, the FBI and international law enforcement agencies seized the domain of Virtualine, a bulletproof hosting (BPH) provider operating under aliases including Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Virtualine openly marketed its infrastructure to cybercriminals on forums for phishing, carding, spam, and port scanning while knowingly hosting child sexual abuse material (CSAM) and facilitating international Bitcoin money laundering through unhosted wallet addresses. Blockchain analytics firm Chainalysis confirmed direct on-chain exposure to ransomware operators, infostealer infrastructure, and illicit marketplaces. The coordinated takedown involved Hessen State Police, the Netherlands National Police Corps, the UK National Crime Agency, OverRIPE, and Lumen Technologies. This seizure underscores an accelerating law enforcement trend targeting the criminal-hosting ecosystem that underpins ransomware, infostealer, and phishing campaigns globally. As BPH providers rapidly re-acquire ASNs and shift infrastructure, enterprises and cloud security teams must invest in egress controls, anomaly detection, and multicloud visibility to cut off attacker command-and-control before damage occurs.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Health Care / Life Sciences3 days ago

Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries

In October 2026, the Skyw4lker device code phishing campaign was identified targeting U.S. organizations across manufacturing, technology, and healthcare sectors. Attackers distributed password-protected business documents posing as contracts or service proposals, redirecting victims through Google Sites infrastructure into a legitimate Microsoft authentication flow. Rather than harvesting credentials via fake login pages, the campaign abused OAuth 2.0 device authorization grants to capture valid Microsoft 365 tokens. A PHP/JavaScript backend tracked victim sessions, collected geolocation data, and polled authentication status in real time, yielding persistent account access while generating only legitimate-looking authentication telemetry. Device code phishing represents a maturing evasion technique that bypasses MFA and traditional credential-theft defenses by exploiting legitimate cloud authentication protocols. As FBI IC3 data records over $20.9 billion in internet crime losses in 2025 and phishing volumes continue to rise, identity-based attacks that produce no fake login pages are increasingly difficult to detect with conventional email and endpoint security tools alone.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Marketing/Advertising/Sales3 days ago

Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk

In October 2026, Adobe disclosed eight critical vulnerabilities in Campaign Classic (versions 7.4.4 build 9402 and earlier) spanning code injection, OS command injection, incorrect authorization, SQL injection, and reflected cross-site scripting. CVSS scores range from 9.1 to 9.9, indicating near-maximum severity. Successful exploitation could allow unauthenticated or low-privileged attackers to execute arbitrary code, bypass security controls, and escalate privileges on both Windows and Linux deployments. Adobe patched all eight flaws in build 9403. A separate critical code injection flaw (CVE-2026-48360, CVSS 9.6) in Adobe Connect Desktop and Mobile was also remediated simultaneously. High-severity vulnerability clusters in widely deployed enterprise marketing platforms like Adobe Campaign Classic are increasingly attractive to ransomware operators and espionage actors. The combination of SQL injection, code injection, and privilege escalation chains provides a near-complete attack path from initial access to full host compromise, making rapid patch adoption a board-level priority.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT3 days ago

16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads

A critical buffer-overflow vulnerability (CVE-2026-97631, CVSS 9.5) discovered in EDK II's PXE network-boot driver has existed undetected for 16 years since a November 2010 commit. Disclosed on October 22, 2026 by TianoCore after an accidental early exposure via a public GitHub pull request, the flaw allows an adjacent-network attacker to crash or hijack firmware execution before Secure Boot activates—requiring no credentials and no prior access. Every server relying on PXE boot and built on EDK II—spanning AMI, Insyde, Phoenix, and Microsoft Project Mu firmware—is potentially affected. Red Hat, SUSE, and Debian have confirmed vulnerable packages with no patched release yet available. With no stable patched EDK II release yet shipped and patch-derived exploit research already possible, data-center operators face an unmitigated firmware-layer attack surface. The incident echoes PixieFail (2024) and underscores a systemic pattern: supply-chain firmware components accumulate critical flaws that propagate silently across entire server ecosystems, making network-layer controls and boot-time traffic monitoring essential compensating measures while vendors work through patch delivery cycles.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services3 days ago

CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release

Within 24 hours of Oracle releasing its October 2026 Critical Patch Update, threat actors began actively probing CVE-2026-101767, a CVSS 9.8 unauthenticated SQL injection vulnerability in Oracle E-Business Suite's Thin Client Framework servlet. Discovered by Horizon3.ai researchers and disclosed to Oracle on July 24, 2026, the flaw allows any attacker with network access to chain SQL execution as the APPS database user into full operating-system command execution on the EBS application host—potentially exposing financial, payroll, HR, and procurement records. Threat intelligence firm Defused Cyber confirmed live exploit probes against honeypot decoys on October 27, 2026, just one day after the patch dropped. This incident continues a pattern of rapid weaponization of Oracle EBS vulnerabilities. Two prior critical flaws in the same product—CVE-2025-61882, exploited by the Cl0p ransomware group, and CVE-2026-46817—both carried CVSS 9.8 scores and were actively exploited in the wild, underscoring that EBS environments are high-value, repeat targets requiring accelerated patch cycles and compensating network controls.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT3 days ago

ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign

In late October 2026, a newly identified ClickFix social engineering campaign was observed targeting both macOS and Windows users via a fake Cloudflare verification page hosted on the domain js-static[.]cfd. The attack chain lures victims into manually executing a malicious command copied from the spoofed page, a hallmark of ClickFix-style delivery. The campaign fingerprints the victim's OS and serves platform-specific payloads. Although the final-stage malware was not retrieved due to infrastructure errors (403 Forbidden on Windows and DNS non-resolution on macOS), the staging infrastructure and URL chain were fully documented, revealing a multi-step victim-profiling and geo-tracking mechanism prior to payload delivery. ClickFix campaigns are accelerating in 2026, with threat actors increasingly abusing trusted brand impersonation—particularly Cloudflare—to bypass user skepticism. The manual-execution lure circumvents many automated endpoint defenses, making user-targeted social engineering one of the fastest-growing initial access vectors across enterprise and SMB environments alike.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Information Technology/IT3 days ago

php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE

In October 2025, two pre-authentication remote code execution vulnerabilities in PHP core—CVE-2026-109618 and CVE-2026-109619, collectively dubbed php2shell—were disclosed ahead of coordinated release. Discovered by researcher Calif, the flaws exploit dangling session pointer conditions and serializer issues to achieve unauthenticated RCE against Apache mod_php and PHP-FPM deployments respectively. Exploitation is technically feasible but highly conditional, requiring precise heap layout control, ASLR bypass via information leak, and version-specific offsets. High-value targets include edge appliances with PHP management interfaces such as Palo Alto PAN-OS and Citrix NetScaler, where even DMZ-resident RCE yields meaningful attacker leverage. Php2shell highlights a persistent and underappreciated risk pattern: low-severity findings such as exposed phpinfo pages aggregate into critical exploitation preconditions. As AI-assisted exploit development accelerates N-day weaponization timelines, organizations must reassess how informational disclosures compound with memory corruption vulnerabilities to enable targeted, high-impact intrusions against network perimeter appliances.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Internet3 days ago

PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively tracked as PHP2Shell, enabling unauthenticated remote code execution (RCE) against any server running a vulnerable PHP version. CVE-2026-109618 exploits an out-of-memory condition during request parsing to corrupt heap memory before application code executes, while CVE-2026-109619 leverages stale serializer state via a use-after-free to forge malicious objects in session data. Both flaws affect all server APIs including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Bishop Fox researchers confirmed full unauthenticated RCE against stock Apache mod_php Docker images with ASLR enabled. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP2Shell represents a systemic risk because the vulnerability resides in PHP's core runtime engine rather than any application layer, meaning no specific feature, plugin, or misconfiguration is required for exposure. With public proof-of-concept exploits already circulating and Bishop Fox confirming reproducible RCE in lab conditions, organizations running unpatched PHP face immediate, low-barrier compromise risk across their entire web-serving infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Information Technology/IT3 days ago

PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure

In late October 2026, CISA added two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell—to its Known Exploited Vulnerabilities Catalog after confirmed in-the-wild remote code execution (RCE) was recorded against unpatched Apache mod_php installations. Exploitation began four days before patches were released on October 21, 2026, with attackers targeting over 5.1 million internet-exposed PHP hosts. Honeypot evidence confirmed successful RCE against PHP 8.4.26 by October 24, prompting CISA to mandate Federal Civilian Executive Branch agencies to patch by October 30, 2026. PHP powers roughly 70% of all websites, making the attack surface extraordinarily broad. The PHP2Shell disclosures underscore a dangerous trend: vulnerability details and partial proof-of-concept code leaked before patches were available, compressing the remediation window for defenders. As attackers increasingly exploit web application RCE flaws at scale within days of disclosure, organizations running PHP-dependent workloads in cloud and hybrid environments face elevated risk of initial compromise and downstream lateral movement if network segmentation and egress controls are absent.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration3 days ago

Apple CoreGraphics Zero-Day CVE-2026-86950: What the Backport Patches Mean for Enterprise Mobile Security

In October 2026, Apple backported emergency security patches for CVE-2026-86950, a CoreGraphics out-of-bounds write zero-day, to older iPhone and iPad models including the iPhone XS, XR, and several iPad generations. Originally patched in September 2026 for current iOS 26 and macOS Tahoe devices, the vulnerability was discovered by Meta Product Security and confirmed exploited in highly targeted, extremely sophisticated attacks against specific individuals running iOS versions prior to iOS 27. Successful exploitation allows arbitrary code execution via a maliciously crafted file, enabling full device compromise. This marks Apple's second zero-day patched in active exploitation campaigns in 2026, following CVE-2026-20700 in dyld patched in February. This incident underscores the persistent threat posed by zero-day exploits targeting mobile OS graphics and rendering frameworks, often weaponized in nation-state or mercenary spyware campaigns. The pattern of 'extremely sophisticated' language from Apple, combined with Meta's discovery role, signals continued interest from advanced threat actors in iOS as a high-value espionage platform, mirroring trends seen with Pegasus and similar commercial spyware toolchains.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

1...5 6 7 8 9...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services

AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security

Virtualine Seized: Inside the Bulletproof Hosting Network Powering Ransomware, Phishing, and Bitcoin Money Laundering

Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries

Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk

16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads

CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release

ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign

php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE

PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE

PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure

Apple CoreGraphics Zero-Day CVE-2026-86950: What the Backport Patches Mean for Enterprise Mobile Security

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

GMO Internet's $50M Extortion Wake-Up Call: Why Cloud VDI Misconfigurations Are a Systemic Risk for Financial Services

AI Just Became an Exploit Developer: What Anthropic's Zero-Day Chains Mean for Your Cloud Security

Virtualine Seized: Inside the Bulletproof Hosting Network Powering Ransomware, Phishing, and Bitcoin Money Laundering

Skyw4lker Exposed: How a 2026 Device Code Phishing Campaign Hijacked Microsoft 365 Accounts Across U.S. Industries

Eight Critical Adobe Campaign Classic Flaws Put Enterprise Marketing Infrastructure at Risk

16 Years Hidden in Plain Sight: How CVE-2026-97631 Puts Every Network-Booting Server at Risk Before the OS Even Loads

CVE-2026-101767: Oracle EBS Under Fire—Exploit Probes Recorded Within 24 Hours of Patch Release

ClickFix Is Back: Fake Cloudflare Pages Now Target macOS and Windows in 2026's Fastest-Growing Social Engineering Campaign

php2shell Exposed: How CVE-2026-109618 Turns a Low-Risk phpinfo Page Into a Critical RCE

PHP2Shell: Responder Guidance for CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE

PHP2Shell Exploited in the Wild: What the CISA KEV Alert Means for Your Cloud Infrastructure

Apple CoreGraphics Zero-Day CVE-2026-86950: What the Backport Patches Mean for Enterprise Mobile Security

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?