Cloud Attackers Exploit Max-Critical Aviatrix RCE Flaw

Multiple threat actors are actively exploiting CVE-2024-50603, a maximum-severity (CVSS 10) unauthenticated RCE in Aviatrix Controller, to deploy XMRig cryptomining malware and the Sliver backdoor; proof-of-concept code and automated scanners have driven opportunistic attacks across cloud environments, and Aviatrix has released patches and mitigation guidance.