https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving VMware.Sun, 26 Jul 2026 22:32:51 GMThttps://thehackernews.com/2026/07/daxin-resurfaces-in-taiwan-alongside.htmlcst-2674A China-linked threat actor has redeployed Daxin, a kernel-mode rootkit inactive for over four years, in a Taiwan manufacturing company alongside a new backdoor named Stupig. Daxin was previously documented by Symantec in March 2022 as a tool used in targeted attacks.Thu, 16 Jul 2026 11:17:23 GMThttps://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.htmlcst-2594Mozilla released Firefox updates to patch two critical vulnerabilities in the JavaScript/WebAssembly and DOM/Navigation components with known public exploit code. Chrome, Adobe, and VMware also issued updates for multiple critical security flaws, though details on those vendors' patches are not provided in this incomplete summary.Wed, 15 Jul 2026 13:18:53 GMThttps://securityweek.com/7-severe-vulnerabilities-patched-in-vmware-avi-load-balancercst-2498VMware patched seven severe vulnerabilities in Avi Load Balancer that could enable authentication bypass, remote code execution, privilege escalation, and directory traversal. The specific CVE numbers, affected versions, and remediation details were not provided in the available information.Tue, 14 Jul 2026 13:55:41 GMThttps://thezdi.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwncst-392Pwn2Own Berlin 2026 concluded on Day Three with security researchers demonstrating 47 unique zero-day vulnerabilities across the three-day competition. DEVCORE won the Master of Pwn title with 50.5 points and $505,000, followed by STARLabs SG and Out Of Bounds, with a total of $1,298,250 awarded for all disclosed vulnerabilities.Sat, 16 May 2026 10:38:50 GMThttps://recordedfuture.com/blog/march-2026-cve-landscapecst-1981Insikt Group identified 31 high-impact vulnerabilities actively exploited in March 2026, with 29 rated as very critical. The affected products span major vendors including Cisco, Microsoft, Google, ConnectWise, Citrix, and others, with Microsoft and Apple accounting for approximately 32% of the total. Notable findings include the Interlock ransomware group exploiting a Cisco Firewall Management Center zero-day, the continued exploitation of a nine-year-old Hikvision vulnerability, and public proof-of-concept exploits available for 10 of the 31 vulnerabilities.Mon, 13 Apr 2026 00:00:00 GMThttps://cloud.google.com/blog/topics/threat-intelligence/vsphere-brickstorm-defender-guidecst-317Google Threat Intelligence Group published research on BRICKSTORM malware targeting VMware vSphere environments, with a focus on hardening strategies to defend virtualized infrastructure. Threat actors exploit weak security architecture, identity design, and limited visibility at the virtualization control plane to establish persistence beneath the guest operating system where traditional security tools are ineffective. Mandiant released a vCenter Hardening Script to help organizations enforce security configurations at the Photon Linux layer and transform the virtualization layer into a hardened environment.Thu, 02 Apr 2026 14:00:00 GMThttps://thezdi.com/blog/2026/3/11/announcing-pwn2own-berlin-for-2026cst-397Pwn2Own Berlin 2026 will take place May 14-16 with over $1 million in prizes across 31 targets in 10 categories, including newly expanded artificial intelligence categories and increased rewards for Firecracker vulnerabilities. AWS has joined as a co-sponsor, and the competition returns to OffensiveCon after a successful 2025 inaugural event. Registration closes May 7, and the winner will be crowned Master of Pwn with prizes including ZDI reward points, a trophy, and a jacket.Thu, 12 Mar 2026 16:25:15 GMThttps://huntress.com/blog/esxi-vm-escape-exploitcst-768Huntress has documented an active multi-stage attack that exploits vulnerabilities to escape guest virtual machines and compromise VMware ESXi hypervisors, leveraging VSOCK communication channels to conceal the exploitation chain. The attack involves potential zero-day exploits that allow attackers to move from guest systems to the underlying hypervisor infrastructure.Wed, 07 Jan 2026 14:00:00 GMThttps://halcyon.ai/blog/bert-ransomwares-first-moves-kill-the-vms-kill-the-backupscst-2064BERT ransomware's initial attacks focus on compromising ESXi hosts to simultaneously disable multiple virtual machines and backup systems, amplifying the impact across an organization's infrastructure. This attack pattern exploits the centralized nature of virtualization environments to maximize damage and operational disruption from a single point of compromise.Tue, 08 Jul 2025 15:49:59 GMThttps://wiz.io/blog/ransomware-attacks-targeting-vmware-esxi-servers-everything-you-need-to-knowcst-1751Recent attacks are exploiting CVE-2021-21974, a known vulnerability in VMware ESXi servers, to deploy ransomware. Security teams are being urged to apply patches and monitor for signs of compromise on affected systems.Tue, 07 Feb 2023 12:26:52 GMThttps://wiz.io/blog/wiz-introduces-vmware-vsphere-support-to-provide-a-unified-hybrid-cloud-securitycst-1780Wiz has added VMware vSphere integration to its cloud security platform, enabling coverage of both on-premises and cloud environments. The integration is agent-less, allowing unified security monitoring across hybrid infrastructure without requiring additional software deployment.Mon, 07 Nov 2022 13:56:14 GMThttps://huntress.com/blog/threat-recap-process-insights-trial-by-firecst-1153Huntress Managed EDR detected and helped respond to follow-on attacks targeting VMware Horizon servers in real time. The case study demonstrates how the platform identified and mitigated post-compromise activity on affected systems.Tue, 25 Jan 2022 00:00:00 GMThttps://huntress.com/blog/cybersecurity-advisory-vmware-horizon-servers-actively-being-hit-with-cobalt-strikecst-1156Huntress has identified active attacks targeting VMware Horizon servers with Cobalt Strike malware. The attackers are leveraging the remote access capabilities of Horizon to deliver post-exploitation tools and maintain persistence.Sat, 15 Jan 2022 00:00:00 GMT