ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “directory-traversal”

3 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 3Vulnerability 3Malware 1Ransomware 1Threat actor 1
SeverityAllcritical 4high 5medium 0low 0info 0

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker News · Aug 17, 2026Exploit / PoC in the wildCVE-2026-59310CVE-2026-65400CVE-2026-688201

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.

QUIRSO observed active exploitation of CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in VMware vCenter allowing arbitrary code execution, patched by Broadcom in late July. Attack chains deploy a malicious cron job running the open-source reverse_ssh tool for persistence, with compromised systems phoning home starting August 3, five days after disclosure. Forensics show 361 unique victim IPs in 47 countries, mostly Germany, the U.S., Turkey, Iran, and France, with the actor suspected to be an APT. Separately, Defused Cyber reports rising scanning indicative of exploitation of related CVE-2026-59309, an unauthenticated auth bypass in vmdir.

The Hacker News · Aug 12, 2026Exploit / PoC in the wildCVE-2026-59310CVE-2026-59309