⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.
- Suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, deploying a backdoor, reverse SSH and Babuk-derived ransomware.
- NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 to deploy Monero miners on exposed systems.
- Lazarus Group exploited Windows zero-day CVE-2026-68820 in Operation Dream Job, delivering ForestTiger and Troy backdoors.
- GeoServer patched a critical SQL injection leading to RCE; hundreds of exploitation attempts were observed within hours.
- New macOS Amnesia Stealer uses ClickFix attacks, steals data from 16 browsers and enables CDP-based live browser control.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1566.002 Spearphishing LinkT1204.002 Malicious File
- Threat actors
- Lazarus Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59310 | Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog | 9.8 | 3% | KEVRansomwarePoC ×2 | KEV |
| CVE-2026-65400 | Authentication Bypass in Apple macOS Screen Sharing | 9.8 | 2% | KEV | KEV |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
13 min read at thehackernews.com
This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.