Every week brings another stack of threats: some attackers look for the fastest path to access, while others revive an older issue and use it in a fresh way. In this weekly recap, the focus is mainly on abuse that’s already happening in the real world—on vulnerabilities that punish patch backlogs—and on new techniques attackers use to talk their way past defenses.
We’ll walk through the key points, with extra attention on the VMware vCenter vulnerability making the news due to signs of active exploitation.
VMware vCenter vulnerability: directory traversal with serious impact
A central topic this week is the VMware vCenter vulnerability, which was patched recently. We’re dealing with a directory traversal flaw (CVE-2026-59310) with a high severity score (CVSS 9.8). Vulnerabilities like this can help an attacker reach beyond the intended directories and—through further steps—execute arbitrary code.
According to reporting, a connection has been made to a suspected China-linked APT. In at least one compromised environment, the abuse led to placing a backdoor and a reverse SSH binary component. Ultimately, Babuk-derived ransomware was also observed.
Notably, the analysis doesn’t simply say: “ransomware was the goal.” Instead, the researchers describe a scenario where ransomware may function as distraction, intended to hinder follow-up investigation by encrypting evidence. In that view, the ransomware portion isn’t necessarily the primary objective, but part of a broader intrusion.
What to take away from this (beyond the vendor)
Aside from VMware, the same patterns show up in cases like this: access is already present, defenses are checked too late, and “small openings” grow into larger problems. Since the attack can also facilitate code execution, it’s even more important for teams to tie patch management to verification.
- Patch immediately: focus your urgency on systems directly connected to vCenter servers and management services.
- Check for compromise: don’t look only at logins—also review backdoor-like network patterns and suspicious outbound SSH activity.
- Connect threat intelligence to your environment: verify whether your setup contains indicators that match earlier stages of intrusion.
If you want to go deeper into how attacks can escalate through already-existing access and misuse of technical details, this is also relevant:
