60
60
Auth bypass CVE-2025
60
60
60
60
CISA adds recently disclosed Apple flaws to its Known Exploited Vulnerabilities catalog
60
60
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
QUIRSO observed active exploitation of CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in VMware vCenter allowing arbitrary code execution, patched by Broadcom in late July. Attack chains deploy a malicious cron job running the open-source reverse_ssh tool for persistence, with compromised systems phoning home starting August 3, five days after disclosure. Forensics show 361 unique victim IPs in 47 countries, mostly Germany, the U.S., Turkey, Iran, and France, with the actor suspected to be an APT. Separately, Defused Cyber reports rising scanning indicative of exploitation of related CVE-2026-59309, an unauthenticated auth bypass in vmdir.
88
60
60
60
60
45
60
U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog
60
60
60
Week in review: Attackers exploiting VMware RCE, Microsoft fixes actively exploited zero-day
60
60
60
60
CISA: Critical VMware RCE flaw now exploited by ransomware gangs
CISA warns ransomware gangs now exploit critical VMware vCenter syslog RCE CVE-2026-59310, already KEV-listed after APT compromises across 47 countries.
Broadcom patched critical directory traversal flaw CVE-2026-59310 in the vCenter Syslog server on July 29, warning of unauthenticated remote code execution. QUIRSO subsequently found 361 compromised IPs across 47 countries after a suspected APT deployed a reverse SSH tool for persistence and remote access. CISA added the flaw to its KEV catalog with a three-day patch deadline for federal agencies, and over the weekend updated it to flag active abuse by ransomware gangs. Shadowserver tracks over 450 exposed vCenter servers, and CISA has tagged 26 VMware vulnerabilities as exploited in the wild over five years, nine abused by ransomware.
90
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
60
60
60
60
45
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
CISA adds actively exploited flaws in Microsoft IKE, SharePoint, VMware vCenter, and macOS Screen Sharing to KEV catalog, due August 21.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8), CVE-2026-55040 (SharePoint JWT authentication bypass, CVSS 9.1), CVE-2026-59310 (VMware vCenter Syslog path traversal, CVSS 9.8), and CVE-2026-65400 (macOS Screen Sharing improper authentication). The SharePoint flaw combines four weaknesses including alg:none JWT forging to impersonate any user, with Defused researchers observing attackers using Rapid7's PoC against honeypots. The Dutch NCSC confirmed active exploitation of the macOS Screen Sharing flaw on August 15, 2026. Federal agencies must patch by August 21, 2026.
80
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.
72
60
60
60
Week in review: 10 cybersecurity frameworks you need to know, exploited Chrome zero-day fixed
60
60
60
Cisco Warns of Critical Flaw Affecting On
60