BRICKSTORM

VMware, now under Broadcom, has released emergency security updates to address five vulnerabilities in vCenter, ESX, Workstation, and Fusion, including three critical flaws. CVE-2026-59309 and CVE-2026-59310 are critical authentication bypass and arbitrary code execution vulnerabilities in vCenter that can be exploited by unauthenticated attackers with network access. CVE-2026-47876 is a critical VM escape vulnerability in the VMXNET3 virtual network adapter, allowing a guest VM attacker with local admin privileges to execute code on the host. While there is no evidence of active exploitation, VMware servers are high-value targets for ransomware and advanced threat actors, and these flaws could enable broad lateral movement and persistence if left unpatched.

Over 266,000 F5 BIG-IP instances are exposed online following a breach of F5's network by suspected China-nexus threat actor UNC5291, which stole source code and information on undisclosed vulnerabilities. F5 has released patches for 44 vulnerabilities and urged immediate customer action, while CISA issued an emergency directive for federal agencies to patch or disconnect exposed systems. The attackers used the Go-based Brickstorm malware and had access to F5's network for at least a year. Threat actors are targeting these devices to breach networks, steal credentials, and establish persistence.