Attackers Exploit Critical CVE-2026-59310 in VMware vCenter for Persistent Remote Access
Attackers are actively exploiting the critical vulnerability CVE-2026-59310 in Broadcom VMware vCenter Server to gain persistent remote access on internet-exposed systems. The flaw affects the Syslog server component and allows unauthenticated remote code execution via a path traversal technique that lets adversaries manipulate file paths and execute arbitrary commands on the appliance.
The vulnerability carries a CVSS 9.8 severity rating, indicating near-complete compromise potential with minimal attacker effort. Exploitation activity began shortly after disclosure, with the first observed incidents recorded on 3 August 2026. Once initial access is obtained, threat actors establish persistence by installing malicious cron tasks and deploying the reverse_ssh utility, which creates stable outbound connections that often bypass inbound-focused defenses.
According to telemetry shared by researchers, the campaign has already compromised 361 unique victim IP addresses spread across 47 countries. The highest concentrations of affected systems were found in Germany, the United States, Turkey, Iran, and France. Many of these instances were directly reachable from the internet, dramatically increasing the speed and scale of successful attacks.
Broadcom has published official fixes in security advisory VMSA-2026-0006.1. The update resolves both CVE-2026-59310 and the related CVE-2026-59309. No alternative mitigations are available, so organizations must apply the patches without delay. Additional recommended actions include confirming that vCenter is not exposed to the internet, enforcing network segmentation and access-control lists, and auditing appliances for unauthorized cron entries, reverse_ssh binaries, and anomalous outbound connections.
Security researchers also noted a concurrent rise in scanning activity targeting the same attack surface, although a direct link to the ongoing exploitation of CVE-2026-59310 has not yet been confirmed. The short window between disclosure and active exploitation underscores the urgency of applying updates to virtualized infrastructure.
Related articles
Cache Key Injection Flaw in Nginx Configurations Allows Access Bypass, Data Disclosure and Cached Denial of Service
Security researcher Alex Brumen from YesWeHack has detailed a Cache Key Injection attack vector that exploits poorly constructed cache keys in Nginx. The issue arises when administrators concatenate variable-length values without delimiters, such as $scheme$host$request_uri$http_accept, allowing different requests to produce identical cache keys. Attackers can poison the cache with 404 responses to deliver CPDoS, expose restricted pages like /admin by manipulating path components, or even achieve stored XSS by colliding HTTP and HTTPS responses. The technique can also bypass Cloudflare protection when the Authorization header routes requests directly to the vulnerable Nginx cache. Mitigation requires using explicit delimiters or structured encoding in cache keys, validating the Host header, enforcing HTTPS redirects, and avoiding caching of authenticated requests.
Click2Shell Flaw in WordPress Core Enables Remote Code Execution via Single Malicious Link
Researchers at pwn.ai have disclosed Click2Shell, a vulnerability in the WordPress core that allows an attacker to install a malicious theme and achieve remote code execution simply by tricking an authenticated administrator into opening a crafted link. The isolated flaw carries a CVSS score of 7.1, but the full attack chain reaches 9.6. The issue stems from an interpretation mismatch between the WordPress.org theme directory and the administrator browser, causing the browser to automatically trigger the install button without any user confirmation or password prompt. Affected versions start from 6.0 and run up to but not including 7.1.1. The vulnerability has been fixed in WordPress 7.1.1 with backported patches released for all supported branches down to version 4.7. No exploitation in the wild had been observed at the time of disclosure, yet the low barrier of convincing an admin to click a link makes prompt patching essential.
CISA Adds Three Actively Exploited Linux Kernel Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added three vulnerabilities affecting the Linux Kernel to its Known Exploited Vulnerabilities catalog. The flaws, identified as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are confirmed to be under active exploitation in the wild. CISA is directing all federal agencies to apply patches immediately and to search for indicators of compromise. The vulnerabilities impact the kernel's kTLS TLS processing, the ebtables network bridge component, and the AF_ALG cryptographic interface. Each issue can lead to memory corruption or inconsistent internal state that attackers may leverage for privilege escalation or remote code execution.
Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A team deployed Keycloak for 25,000–30,000 users across a country using three isolated VMs instead of Kubernetes. They chose Embedded Infinispan with JGroups over an external cluster to reduce failure points and maintain session replication. PostgreSQL with Patroni handled shared storage and JDBC_PING discovery. Testing revealed that full datacenter outages triggered split-brain conditions and 5xx errors that the built-in healthcheck could not resolve. The engineers wrote a Python watcher script to detect multiple coordinators in the JGROUPS_PING table and restart affected containers. They reported the recovery bug to the Keycloak project, which was confirmed and fixed in a later release. The production cluster now survives single-DC loss without session loss.