What Changed
Attackers are exploiting CVE-2026-59310, a critical directory traversal flaw in VMware vCenter Server’s Syslog configuration that allows remote code execution. Broadcom disclosed and fixed it on July 29. Fixed releases are 9.1.0.0300, 9.0.2.0100, and 8.0 Update 3k or Update 2f.
Security firm QUIRSO says exploitation connections began on August 3. It saw 151 new IP addresses on August 4 and 343 by August 5. By August 7 it had counted 361 attacking IPs in 47 countries, with more than half in Germany, the U.S., Turkey, Iran and France.
What Attackers Deploy
After exploitation, attackers install reverse_ssh, a tool that gives them an interactive SSH session tunneled out from the compromised server. QUIRSO released a YARA rule to detect it. The firm suspects an advanced threat actor and is withholding other indicators for now.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
vCenter controls an organization’s virtual machines, so an attacker on vCenter can reach almost everything running on the hypervisors it manages. Ransomware groups and espionage actors have both targeted VMware management infrastructure because of this reach. A reverse SSH tunnel also gets around inbound firewall rules, so the access can outlive a patch.
What To Verify First
- Confirm every vCenter instance runs a fixed build, and check for any exposed to the internet.
- Treat vCenter instances left unpatched after July 29 as possibly compromised, and run QUIRSO’s YARA rule against them.
- Look for unexpected outbound SSH or long-lived connections from vCenter appliances.
- Review Syslog configuration changes and new files on the appliance.
What Teams May Be Underestimating
Patching closes the hole but does not remove a backdoor that was already installed. With hundreds of IPs scanning within days, any delay since disclosure deserves a compromise check, not just an update.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
