STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 1105 to 1116 of 6867 threat reports

Financial Services1 month ago

Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover

In September 2026, Bitcoin wallet company Alby disclosed a critical vulnerability in Alby Hub versions v1.7.0 through v1.18.5 that allowed attackers to completely take over internet-exposed Lightning wallets and drain funds. The flaw affected self-hosted Bitcoin wallets where owners had inadvertently exposed their Hub management interfaces to the public internet, often following Alby's own documentation that recommended such configurations. At least one user was confirmed affected, with the company providing limited details about the vulnerability mechanism pending responsible disclosure. The incident highlights the ongoing security challenges in cryptocurrency infrastructure, particularly as Bitcoin adoption accelerates and self-custody solutions become more mainstream. With ransomware groups increasingly targeting cryptocurrency platforms and the rise of state-sponsored attacks on financial infrastructure, vulnerabilities in wallet software present critical risks to both individual users and the broader digital asset ecosystem.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering1 month ago

Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection

In August 2026, cybersecurity researchers analyzed a 7GB infostealer dump containing data from 5,871 infected machines across 162 countries, revealing thousands of unexpired authentication tokens for AI services including Google, OpenAI, Anthropic, and others. Information stealers like Lumma Stealer and Vidar harvested session tokens, API keys, and JSON Web Tokens (JWTs) that threat actors can replay to bypass credential-based authentication and multi-factor authentication, effectively gaining unauthorized access to premium AI services without traditional login processes. The stolen data included 555 AI-related JWTs and 2,937 encrypted tokens, with 17.7% containing plaintext personally identifiable information, enabling account takeovers, resource theft, and unauthorized AI service usage sold on underground markets. This incident highlights the growing cybercriminal focus on AI credential theft as premium model access costs create strong financial incentives for stealing rather than purchasing legitimate access, while the proliferation of anti-detect browsers and session replay tools makes monetizing these stolen tokens increasingly accessible to threat actors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering1 month ago

Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs

Trail of Bits researchers discovered a critical vulnerability in Lean 4 theorem prover versions up to 4.33.1 that allowed fabrication of mathematical proofs through string manipulation exploits. The flaw in String.Pos.Raw.extract function created inconsistencies between logical definitions and compiled native code, enabling attackers to manufacture contradictions and prove false theorems, including a bogus proof of Fermat's Last Theorem. This supply-chain vulnerability affects the integrity of formal verification systems used in critical software development and mathematical research. This incident highlights the emerging risks in AI-assisted code generation and formal verification tools as they become integral to software supply chains. With increasing reliance on theorem provers for security-critical applications, vulnerabilities in these foundational tools pose systemic risks to mathematical proofs and software verification processes.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(high)

Read report

Retail Industry1 month ago

StyleSmuggler Attack: How CVE-2026-75650 Exposes Critical E-Commerce Security Gaps

In September 2026, Adobe disclosed CVE-2026-75650, dubbed 'StyleSmuggler,' a critical remote code execution vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source platforms. The vulnerability, scoring a maximum CVSS of 10.0, allows unauthenticated attackers to inject PHP code through Magento's email template engine and execute arbitrary commands by triggering payment failure reminder emails. Active exploitation began on September 4, 2026, with threat actors deploying Rust-based Linux backdoors and PHP web shells on compromised e-commerce storefronts worldwide. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog within 24 hours of disclosure, emphasizing the severity and widespread targeting of unpatched Magento installations. This incident highlights the critical security risks facing e-commerce platforms as attackers increasingly target template injection vulnerabilities in widely-deployed content management systems. With millions of online stores running vulnerable Magento versions and the rise of automated exploitation frameworks, organizations must prioritize rapid patching and comprehensive security monitoring for their web applications.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Computer Games1 month ago

Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight

In September 2026, Unit 42 researchers uncovered CL-CRI-1171, a sophisticated pay-per-install (PPI) malware distribution network that operated undetected for over two years. The cybercrime group leveraged YouTube gaming channels with hundreds of thousands of followers and SEO poisoning techniques to distribute multiple malware families including Insomnia RAT, ARKTunnel, and Docro Hijacker. The operation used OfferLoader, a custom Inno Setup-based loader, to deploy over 10,000 distinct payload combinations across corporate networks, critical infrastructure, and government entities while evading detection through clever gating mechanisms and unremarkable appearance. This campaign highlights the growing threat of commodity infrastructure being weaponized for large-scale malware distribution, particularly as threat actors increasingly target younger demographics through gaming platforms and use legitimate-seeming tools to bypass security scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Government Administration1 month ago

CIA's Operation Absolute Resolve Showcases Cyber Intelligence as Mission-Critical Capability

CIA Deputy Director Michael Ellis revealed that Operation Absolute Resolve, which led to the apprehension of Nicolás Maduro, was enabled by cyber intelligence operations conducted by the agency's Center for Cyber Intelligence. The mission demonstrated how the CIA has reorganized to place cyber operations at the center of intelligence collection, allowing U.S. special operations forces to locate and capture the target within four minutes of landing. The operation reportedly included cyberattacks that caused power outages during the mission, showcasing the integration of cyber capabilities with traditional field operations. This disclosure highlights the evolving role of cyber intelligence in modern military and intelligence operations, as nation-state actors increasingly rely on digital capabilities to support kinetic operations and achieve strategic objectives in contested environments.

Threat report

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Banking/Mortgage1 month ago

Russian National's $6.3M Bank Account Takeover Scheme Exposes Critical Security Gaps

In November 2023, Russian national Sergei Anatolyevich Filimonov orchestrated a sophisticated bank account takeover scheme that defrauded financial institutions of over $6.3 million. The operation involved creating spoofed banking domains, purchasing sponsored search links to redirect victims, and harvesting over 5,000 customer login credentials. The cybercriminals specifically targeted accounts with large balances, including those belonging to corporate employees in Georgia, and built infrastructure to bypass multi-factor authentication and other security controls. This case exemplifies the growing sophistication of financially motivated cybercriminals who combine social engineering, domain spoofing, and credential harvesting to target high-value accounts. The FBI's identification of $28 million in total attempted losses demonstrates the massive scale these operations can achieve.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering1 month ago

Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign

In 2024, Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI engaged in systematic distillation of U.S. frontier AI models according to a joint advisory from NSA, CISA, and FBI. The companies spent billions of tokens across millions of exchanges with models like Claude, ChatGPT, Google Gemini, and xAI's Grok to extract proprietary capabilities and strengthen their domestic AI systems. The attackers used sophisticated evasion techniques including distributed accounts, proxy networks, third-party aggregators, and gray market access to circumvent geographic restrictions and detection mechanisms. This incident highlights the growing threat of AI-enabled economic espionage as artificial intelligence becomes central to national competitiveness, with state-sponsored actors leveraging legitimate AI APIs for large-scale intellectual property theft through automated distillation campaigns.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT1 month ago

Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era

Microsoft released its largest-ever Patch Tuesday update in September 2026, addressing 974 vulnerabilities across its product suite, including two actively exploited zero-day vulnerabilities. The massive security update included CVE-2026-81963 affecting the Windows Update Stack and CVE-2026-85880 affecting Windows Advanced Local Procedure Call, both enabling privilege escalation attacks. Microsoft's use of AI-assisted vulnerability discovery has dramatically increased the volume of disclosed vulnerabilities, with over 100 rated as critical across Windows, Office, SQL Server, and developer tools. Despite the record-breaking number of vulnerabilities, security researchers noted that active exploitation rates have not increased proportionally. This incident highlights the growing challenge organizations face in vulnerability management as AI-driven discovery tools uncover more security flaws at an unprecedented pace. The massive patch volume reflects broader industry trends where automated security research is creating larger attack surfaces while simultaneously improving defensive capabilities through faster identification of potential weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Government Administration1 month ago

Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched

Microsoft released Windows 10 KB5122878 as part of the September 2026 extended security update program, addressing a record-breaking 966 vulnerabilities including two actively exploited zero-day flaws. This update targets Windows 10 Enterprise LTSC users and ESU program participants, bringing systems to build 19045.7725 with critical security patches, Secure Boot certificate improvements, and fixes for Remote Desktop audio redirection issues. The massive patch release underscores the ongoing security challenges facing legacy Windows environments as Microsoft phases out mainstream support. This update highlights the critical importance of extended security programs as organizations struggle to migrate from Windows 10 amid escalating cyber threats and the growing attack surface of unpatched legacy systems.

Low impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Financial Services1 month ago

PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure

In September 2026, security researchers discovered a sophisticated Linux rootkit campaign targeting F5 BIG-IP APM devices. Attackers exploited CVE-2025-53521, a critical remote code execution vulnerability, to deploy the 'PoisonedRefresh' rootkit that injects fileless web shells directly into memory. The malware intercepts PHP file operations, modifies scripts in memory without altering disk files, and creates password-protected backdoors while maintaining persistence across system upgrades. This advanced attack demonstrates the evolution of infrastructure targeting, as threat actors increasingly focus on critical network appliances that provide extensive access to organizational traffic and systems. With 795 vulnerable endpoints still exposed online, this incident highlights the urgent need for robust patch management and enhanced monitoring of network infrastructure devices.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Banking/Mortgage1 month ago

Slim Spider's Cloud-Native Attack on Brazilian Financial Infrastructure Exposes Critical Security Gaps

In March 2026, the Brazil-based threat actor Slim Spider executed a sophisticated multi-stage attack against a Brazilian financial institution, targeting cryptocurrency custody secrets and instant payment infrastructure. The attackers leveraged custom Bash scripts to steal temporary cloud credentials, enumerated secrets in cloud credential managers, and deployed backdoors mimicking legitimate infrastructure binaries. They successfully infiltrated managed Kubernetes clusters via Azure DevOps, deployed malicious pipelines, and created automated panels for bulk Pix payment fraud. The campaign resulted in the compromise of multiple Brazilian banks and fintech organizations, with devastating potential for cryptocurrency wallet theft and unauthorized financial transactions. This incident represents a critical shift in cybercrime tactics, as threat actors increasingly demonstrate sophisticated cloud-native attack capabilities specifically targeting high-value digital financial assets and instant payment systems across Latin America.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1...91 92 93 94 95...573

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover

Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection

Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs

StyleSmuggler Attack: How CVE-2026-75650 Exposes Critical E-Commerce Security Gaps

Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight

CIA's Operation Absolute Resolve Showcases Cyber Intelligence as Mission-Critical Capability

Russian National's $6.3M Bank Account Takeover Scheme Exposes Critical Security Gaps

Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign

Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era

Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched

PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure

Slim Spider's Cloud-Native Attack on Brazilian Financial Infrastructure Exposes Critical Security Gaps

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical Alby Hub Vulnerability Exposed Bitcoin Wallets to Complete Takeover

Massive Infostealer Campaign Exposes Thousands of AI Service Tokens, Bypassing MFA Protection

Critical Vulnerability in Lean Theorem Prover Enables Fabrication of Mathematical Proofs

StyleSmuggler Attack: How CVE-2026-75650 Exposes Critical E-Commerce Security Gaps

Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight

CIA's Operation Absolute Resolve Showcases Cyber Intelligence as Mission-Critical Capability

Russian National's $6.3M Bank Account Takeover Scheme Exposes Critical Security Gaps

Chinese AI Giants Caught in Massive U.S. Model Distillation Campaign

Microsoft's Record-Breaking Patch Tuesday: Managing 974 Vulnerabilities in the AI Era

Microsoft's Record-Breaking Windows 10 Security Update: 966 Vulnerabilities Patched

PoisonedRefresh Rootkit: Advanced Threat Targets F5 BIG-IP Infrastructure

Slim Spider's Cloud-Native Attack on Brazilian Financial Infrastructure Exposes Critical Security Gaps

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?