BRICKSTORM

Mentions · 7d4
Mentions · 30d5
All mentions5
First seenOct 16, 2026
Last mentioned1d ago

Timeline

5 articles · newest first

Warp Panda used VMware ESX zero-day; firewalls rooted and crashed

CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.

Help Net SecurityOct 29, 16:25 UTC · 1d agoExploit / PoCExploited9 sourcesCVE-2026-41709 CVE-2026-46300 CVE-2026-109618+23 · 2 reads

WARP PANDA used VMware ESXi zero-day against US law firms

CVE-2026-41709 bypasses ESXi command logging; CrowdStrike does not say it gave initial access.

GBHackersupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 12:30 UTC · 1d agoThreat actorExploited9 sourcesCVE-2026-417091

Warp Panda used low-severity ESXi flaw CVE-2026-41709 as a zero-day

CISA added the logging bug to KEV and gave US federal agencies two weeks to install the patched ESXi builds.

SecurityWeekupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 08:01 UTC · 1d agoExploit / PoCExploited9 sourcesCVE-2026-41709 CVE-2026-59309 CVE-2026-593101

CISA lists VMware ESX logging flaw exploited by Warp Panda

CVE-2026-41709 lets an admin skip some logs; federal agencies must patch by November 11, 2026.

The Hacker Newsupdated Oct 29, 16:25 UTC · 1d agofirst Oct 29, 06:22 UTC · 1d agoExploit / PoCExploited9 sourcesCVE-2026-417092

Prolific Chinese espionage group exploits BeyondTrust zero-day

China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.

CyberScoopOct 16, 17:09 UTC · 14d agoExploit / PoCExploitedCVE-2026-1027642 · 1 read

Related CVEs

by mentions

CVE-2026-41709<1%2.7
Insufficient logging in VMware ESX for admin operations
published Jul 30, 2026Broadcom VMware ESXKEV
CVE-2026-593103%9.8
Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
published Jul 30, 2026Broadcom (VMware) vCenter ServerKEVRansomwarePoC ×2
CVE-2026-10276419%9.3
Message-origin spoofing enables file ops on BeyondTrust Remote Support
published 15d agoBeyondTrust Remote SupportKEVPoC ×2
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 9d agophpKEVPoC ×25
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 9d agophpKEVPoC ×15
CVE-2026-76418<1%8.6
Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth
published 2d agoCisco Secure Firewall Adaptive Security Appliance (ASA) SoftwareKEV
CVE-2026-4630016%7.8
Shared-frag marker loss in Linux kernel skb coalescing (LPE)
published May 23, 2026linux kernelKEVPoC
CVE-2026-593098%9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
published Jul 30, 2026vmware vcenter server

Appears with

CrowdStrikeorganization · 4
Warp Pandathreat actor · 4
CISAorganization · 3
VMware vCenterproduct · 3
Broadcomvendor · 3
SharpStormmalware · 3
Armory Castlethreat actor · 2
VMware ESXproduct · 2
Mandiantorganization · 2
VMwarevendor · 2
VMware ESXiproduct · 2
Citrix NetScalerproduct · 1
Palo Alto Networksvendor · 1
TetanusStormmalware · 1
Citrixvendor · 1
Google Threat Intelligence Grouporganization · 1

Entities are extracted by the model from each article. First seen Oct 16, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.