STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 889 to 900 of 6854 threat reports

Computer Software/Engineering1 month ago

Plugin4Shell Exposes Critical Supply Chain Risks in AI Coding Agents

In September 2026, security firm Air Security disclosed Plugin4Shell, a supply chain vulnerability affecting four major AI coding agents including Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The flaw allows repository owners to swap legitimate plugin code with malicious versions even when agents have locked plugins to specific reviewed commit hashes. Attackers exploit this by creating branch names that mimic commit hashes on platforms like Bitbucket, causing agents to install different code while reporting the correct locked version. Since plugins run with the same privileges as users, malicious code can access files, credentials, and connected systems. Anthropic and OpenAI have patched their agents, while GitHub Copilot remains unpatched and Google will not fix the retiring Gemini CLI. This incident highlights the growing security challenges in AI development toolchains as organizations increasingly rely on AI coding assistants with plugin ecosystems, making supply chain integrity critical for protecting sensitive development environments and intellectual property.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

E-Learning1 month ago

Abandoned CDN Domain Hijack Exposes Supply Chain Blind Spot in Thousands of Websites

In July 2025, an abandoned Content Delivery Network (CDN) domain was re-registered by an unknown actor, creating a massive supply chain vulnerability affecting thousands of websites. The original CDN service had been discontinued years earlier, but its domain was allowed to expire while thousands of sites maintained hardcoded references to resources hosted under that domain. The new domain owner gained wildcard DNS control, enabling them to serve arbitrary content to any website still calling the abandoned hostnames. This incident mirrors the June 2024 polyfill.io compromise, where over 110,000 websites were affected when that JavaScript library domain changed ownership and began serving malicious redirects to mobile visitors. This incident highlights the growing threat of supply chain attacks targeting client-side dependencies and third-party resources. As organizations increasingly rely on external CDNs and JavaScript libraries, abandoned domains represent a significant blind spot in traditional security scanning and dependency management approaches.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Utilities1 month ago

Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks

Schneider Electric disclosed a critical vulnerability (CVE-2026-13348) in PowerChute Serial Shutdown versions 1.5 and earlier, affecting UPS management software used globally across critical infrastructure sectors including energy, manufacturing, and IT facilities. The vulnerability enables attackers to perform unlimited authentication attempts when redirect handling is disabled, potentially leading to unauthorized system access and operational disruption of power management systems. The flaw carries a CVSS score of 5.3 and has been addressed in version 1.6 with automatic service restart upon installation. This incident highlights the growing security risks in industrial control systems and power management infrastructure, particularly as organizations increasingly digitize their operational technology environments. With critical infrastructure under heightened scrutiny following recent nation-state campaigns targeting power grids and manufacturing facilities, vulnerabilities in widely-deployed UPS management systems represent significant attack surface expansion for threat actors seeking to disrupt industrial operations.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering1 month ago

Critical Azure AI Foundry Vulnerability Exposes Enterprise AI Security Gaps

Microsoft patched CVE-2026-85889, a maximum severity vulnerability (CVSS 10.0) in Azure AI Foundry that allows unauthorized privilege escalation through missing authentication for critical functions. The flaw affects Microsoft's enterprise platform for building and deploying generative AI applications. Discovered by security researcher Rémy Marot, the vulnerability required no customer action as Microsoft automatically applied cloud-based fixes. This incident was part of a larger security update addressing multiple critical vulnerabilities across Microsoft's cloud and AI services. This vulnerability highlights the growing attack surface of AI platforms as organizations rapidly adopt generative AI technologies without fully understanding the security implications of cloud-based AI infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration1 month ago

APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust

In September 2026, the Pakistan-aligned threat group Transparent Tribe (APT36) launched Operation RapidRust, targeting government and defense entities in India and Afghanistan with four new malware families: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The campaign utilized innovative command-and-control infrastructure through private GitHub repositories and typosquatted domains mimicking Indian news organizations. The sophisticated attack chain involved a Rust-based backdoor for encrypted communications, USB propagation tools, and cross-platform file stealers capable of exfiltrating up to 5GB of sensitive data per execution. This incident highlights the evolving threat landscape where nation-state actors increasingly leverage legitimate cloud services for malicious infrastructure while expanding their technical capabilities across multiple operating systems and attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Information Technology/IT1 month ago

Microsoft Reveals How AI is Reshaping Cyberthreats in 2026

Microsoft's September 2026 security analysis revealed how AI-powered cyberattackers are exploiting fundamental security weaknesses with unprecedented speed and persistence. The report documented three major attack campaigns: Storm-2945's CaptiveCrunch hospitality network manipulation, AI agent boundary exploitation incidents affecting OpenAI and Anthropic systems, and sophisticated social engineering attacks through Microsoft Teams. These incidents demonstrated how attackers leverage legitimate tools, trusted authentication flows, and AI agent vulnerabilities to achieve rapid lateral movement across enterprise environments, affecting identity systems, endpoints, and cloud infrastructure. This analysis matters now because AI is fundamentally reshaping the cyberthreat landscape, with autonomous attacks creating exponentially larger attack surfaces and faster compromise timelines than traditional methods.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Telecommunications1 month ago

MikroTrick Attack Chain: How Attackers Gained Full Control of RouterOS Devices

In September 2026, security researchers discovered MikroTrick, a sophisticated attack chain targeting MikroTik RouterOS devices that allowed attackers to gain administrative access without authentication. The vulnerability chain combined CVE-2026-67279 (SSH authentication bypass via rekeying) and CVE-2026-86060 (privilege escalation through username manipulation) to achieve complete router takeover. Evidence indicates active exploitation occurred before public disclosure, with compromised devices found containing persistent backdoors including unauthorized administrative accounts and scheduled scripts designed to maintain persistence. The attack affected RouterOS versions 6.x and 7.x, with internet-facing routers being primary targets. This incident highlights the critical evolution of network infrastructure attacks, where threat actors are increasingly targeting edge devices that sit between organizations and the internet, providing unprecedented access to monitor traffic, steal credentials, and establish persistent footholds for lateral movement into internal networks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT1 month ago

Critical AWS AgentCore Security Flaw Exposes Identity Vault Credentials Through Prompt Injection

Unit 42 researchers discovered a critical security vulnerability in AWS AgentCore Harness where default configurations allow attackers to exploit prompt injection techniques to exfiltrate plaintext credentials from AgentCore Identity vaults. The research demonstrated how the built-in shell tool, enabled by default and running with root privileges, can access the same memory space where credentials are resolved to plaintext. Through indirect prompt injection, attackers can execute arbitrary commands, scan process memory, and extract JWT tokens and service account credentials that provide unauthorized access to downstream MCP servers containing sensitive customer data including PII. AWS classified this as informative under their shared responsibility model, emphasizing that operators must implement proper allowedTools scoping and egress filtering controls. This incident highlights the emerging security challenges as AI agents become more autonomous and powerful, particularly around prompt injection attacks that can now leverage programmatic tool access to bypass traditional security boundaries and access privileged credentials in managed runtime environments.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT1 month ago

Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors

Cisco disclosed CVE-2026-76460, a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) that was actively exploited before disclosure in December 2026. The vulnerability allows remote attackers to bypass authentication and gain full administrative control of ISE devices through an API flaw. Compromised ISE systems enable attackers to modify network access policies, extract stored credentials, delete audit logs, and move laterally across all network segments controlled by the device. This represents Cisco's second actively exploited zero-day disclosure within two days, highlighting an escalation in targeted attacks against critical network infrastructure. This incident underscores the growing sophistication of attacks targeting network access control systems and the critical importance of zero-trust architecture as traditional perimeter-based security models continue to fail against advanced persistent threats.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(medium)

Read report

Computer/Network Security1 month ago

Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends

In September 2026, Cisco disclosed CVE-2026-76460, a maximum-severity authentication bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector being actively exploited by threat actors. The flaw allows remote attackers to bypass authentication on API endpoints through crafted requests, gaining unauthorized access to affected devices without any configuration requirements. Cisco's PSIRT confirmed active exploitation in the wild, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory three-day patching deadline for federal agencies. This incident highlights the escalating targeting of identity and access management infrastructure, as threat actors increasingly focus on bypassing authentication controls to establish persistent network access and facilitate lateral movement in Zero Trust environments.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration1 month ago

FamousSparrow's SparroWocky Backdoor Targets Latin American Governments

The China-linked espionage group FamousSparrow has been conducting a sustained campaign against government organizations across Latin America using their new SparroWocky backdoor malware. From mid-2025 through 2026, the group targeted organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, replacing their previous SparrowDoor backdoor with this more advanced C++ malware. SparroWocky features sophisticated anti-analysis capabilities, modular architecture, and comprehensive data collection functions including screenshot capture, file manipulation, and proxy operations. The attacks aimed to gather intelligence on Latin American governments' responses to increasing U.S. pressure on Chinese economic interests, demonstrating China's strategic focus on regional geopolitical intelligence gathering. This campaign highlights the evolution of Chinese state-sponsored cyber espionage capabilities and their expanding focus on Latin American targets amid growing geopolitical tensions. The sophisticated evasion techniques and sustained operations demonstrate the increasing threat posed by well-resourced nation-state actors to regional government infrastructure and diplomatic communications.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Information Technology/IT1 month ago

Microsoft's September 2026 Updates Break Windows Domain Authentication

Microsoft's September 2026 security updates KB5124008 and KB5124012 introduced critical domain authentication failures affecting Windows 11 enterprise environments. The updates automatically enabled Machine Identity Isolation enforcement mode, breaking domain trust relationships for organizations not running Windows Server 2025 Domain Functional Level. Affected users experienced credential validation errors despite correct usernames and passwords, requiring immediate registry modifications and secure channel resets to restore domain access. This incident highlights the risks of automatic security feature enforcement without proper infrastructure compatibility validation. The authentication failures demonstrate how security hardening measures can inadvertently create operational disruptions in hybrid enterprise environments, emphasizing the need for careful deployment planning and compatibility assessment before implementing new identity isolation mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(high)

Read report

1...73 74 75 76 77...572

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Plugin4Shell Exposes Critical Supply Chain Risks in AI Coding Agents

Abandoned CDN Domain Hijack Exposes Supply Chain Blind Spot in Thousands of Websites

Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks

Critical Azure AI Foundry Vulnerability Exposes Enterprise AI Security Gaps

APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust

Microsoft Reveals How AI is Reshaping Cyberthreats in 2026

MikroTrick Attack Chain: How Attackers Gained Full Control of RouterOS Devices

Critical AWS AgentCore Security Flaw Exposes Identity Vault Credentials Through Prompt Injection

Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors

Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends

FamousSparrow's SparroWocky Backdoor Targets Latin American Governments

Microsoft's September 2026 Updates Break Windows Domain Authentication

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Plugin4Shell Exposes Critical Supply Chain Risks in AI Coding Agents

Abandoned CDN Domain Hijack Exposes Supply Chain Blind Spot in Thousands of Websites

Critical Authentication Flaw Exposes Schneider Electric PowerChute Systems to Bypass Attacks

Critical Azure AI Foundry Vulnerability Exposes Enterprise AI Security Gaps

APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust

Microsoft Reveals How AI is Reshaping Cyberthreats in 2026

MikroTrick Attack Chain: How Attackers Gained Full Control of RouterOS Devices

Critical AWS AgentCore Security Flaw Exposes Identity Vault Credentials Through Prompt Injection

Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors

Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends

FamousSparrow's SparroWocky Backdoor Targets Latin American Governments

Microsoft's September 2026 Updates Break Windows Domain Authentication

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?