Zaifliklar
Xitoylik xakerlar ESXi jurnalga yozish kamchiligini nol kun zaifligi sifatida jimgina ishlatgan
CVE-2026-41709 ma'muriy huquqlarga ega hujumchilarga operatsiyalarni jurnalga yozmasdan bajarishga imkon beradi.
Muallif
Ionut Arghire
| 29-oktabr, 2026 (ET bo'yicha 4:01)
AQSh kiberxavfsizlik agentligi CISA chorshanba kuni xakerlar VMware ESXi zaifligini hujumlarda ishlatayotganini ogohlantirdi.
CVE-2026-41709 sifatida kuzatilgan zaiflik past darajadagi jurnalga yozish yetarli emasligi muammosi sifatida tavsiflanadi. U ma'mur sifatida tizimga kirgan hujumchilarga ba'zi operatsiyalarni jurnalga yozmasdan bajarishga imkon beradi.
Xavfsizlik nuqsoni 29-iyulda VMware vCenter, ESXi, Workstation va Fusion'dagi uchta muhim va bitta yuqori darajadagi xato bilan birga e'lon qilingan.
VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 va ESXi80U3j-25429389 va undan yangi versiyalarda tegishli tuzatishlar mavjud.
CISA CVE-2026-41709 ni Ma'lum Ishlatilgan Zaifliklar (KEV) katalogiga qo'shib, federal agentliklarni uni keyingi ikki hafta ichida tuzatishga chaqirdi.
CISA kuzatilgan ishlatish haqida tafsilotlar bermadi, ammo CrowdStrike chorshanba kuni Xitoy bilan bog'liq Warp Panda tahdid aktori CVE-2026-41709 ni AQSh tashkilotlari, jumladan yuridik firmalar, hujumlarida nol kun zaifligi sifatida ishlatganini xabar qildi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
CrowdStrike ma'lumotiga ko'ra, Warp Panda odatda internetga ochiq chekka qurilmalar orqali dastlabki kirishni oladi va VMware vCenter'ga o'tadi, u yerda 2025-yil davomida BrickStorm, TetanusStorm, SharpStorm, DualGauge va GuestConduit kabi zararli dasturlarni joylashtirgan.
Ushbu hujumlarning bir nechtasida va 2026-yil boshigacha, guruh CVE-2026-41709 dan audit izini sezilarli darajada kamaytirish uchun foydalangan.
Broadcom'ning 29-iyuldagi maslahatlarida tasvirlangan kamida yana ikkita xavfsizlik nuqsoni yovvoyi tabiatda nishonga olingan, ya'ni CVE-2026-59309 (muhim darajadagi autentifikatsiya chetlab o'tish) va CVE-2026-59310 (muhim katalog o'tish muammosi, ixtiyoriy kod bajarilishiga olib keladi).
Avgust o'rtalarida kiberxavfsizlik kompaniyasi Quirso APT CVE-2026-59310 ni taxminan 360 ta veb orqali kirish mumkin bo'lgan VMware vCenter serverlarini buzish va SSH teskari qobiqni joylashtirish uchun ishlatayotganini aytdi.
Keyinchalik Quirso faoliyatni Xitoy bilan bog'liq tahdid aktoriga bog'ladi va CVE-2026-59309 ham ishlatilganini, ehtimol CVE-2026-59310 dan oldin, ehtimol boshqa tahdid aktori tomonidan ishlatilganini ogohlantirdi.
CVE-2026-59310 ning ommaviy nishonga olinishi sentabr boshida e'lon qilindi.
Bog'liq: Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
Bog'liq: GoAhead veb-serverida yuzlab million qurilmalarda ishlatiladigan TLS kamchiliklari topildi
Bog'liq: Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib xavfsizlik devorlarini buzishdi
Bog'liq: EPICS tadqiqot muassasasi nazorat dasturida uzoq yashiringan kamchiliklar tuzatildi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
Eng so'nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghire'dan ko'proq
- Xakerlar yangi Oracle EBS zaifligini tekshirishni boshladi
- Sotuvchi kalitining sizib chiqishi 238 000 Denver Health Plan a'zolarining ma'lumotlarini xavf ostiga qo'ydi
- HPE tarmoq mahsulotlaridagi o'nlab muhim kamchiliklarni tuzatdi
- Tushunarsiz DreamHost hodisasi elektron pochta, FTP parollarini qayta o'rnatishga majbur qildi
- O'lik Popcorn Time yangilovchisi millionlab kompyuterlarni egallash xavfiga duchor qildi
- Genesys xakerligi ichki tizimlardan mijoz ma'lumotlarini fosh qildi
- 953 ta onlayn do'kon uzoq davom etgan zararli dastur kampaniyasida zararlangan
- Golland politsiyasi NFC relay hujumlari orqali bank hisoblaridan 400 000 dollardan ortiq pulni o'g'irlagan ikki kishini hibsga oldi
So'nggi yangiliklar
- Ukraina Hive va Nefilim ransomware sherigi AQShda 70 oy qamoqqa hukm qilindi
- Upwind Security 3,8 milliard dollar baholash bilan 400 million dollar jalb qildi
- Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
- GoAhead veb-serverida yuzlab million qurilmalarda ishlatiladigan TLS kamchiliklari topildi
- Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib xavfsizlik devorlarini buzishdi
- EPICS tadqiqot muassasasi nazorat dasturida uzoq yashiringan kamchiliklar tuzatildi
- Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
- Infisical maxfiylikni boshqarish firmasi 40 million dollar jalb qilgandan so'ng 600 million dollar baholandi
Trendda
Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
HPE Patches Dozens of Critical Flaws in Networking Products
PHP2Shell Exploitation Moves From Probes to Working Shells
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
Kundalik axborot byulleteni
Eng so'nggi tahdidlar, tendensiyalar va texnologiya haqida xabardor bo'lish, shuningdek, soha mutaxassislarining chuqur fikrlarini olish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Agentik Pentesting for a Stronger CTEM Program
4-noyabr, 2026
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. Ushbu sessiyada agentik pentestingni o'rganing va CTEM dasturingizda doimiy ta'sirni tekshirish uchun amaliy asosga ega bo'ling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 Summit
10 va 11-noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Quantum eMotion Wayne Teeple'ni CTO etib tayinladi.
Guy Ellis NCC Group'ning CEO'si etib tayinlandi.
Noma Security Bobby Shoker'ni CFO va Alberto Rodrigues'ni CCO etib tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — yuboruvchi ishonmaydigan va qabul qiluvchi qabul qiladigan o'z-o'zini baholash. Nihoyat kompaniyalar o'rtasida ishonch uchun yaxshiroq asos paydo bo'ldi. (Sravish Sridhar)
Bu yaxshi: NetScaler nol kun zaifliklari bizga yangi normal haqida nima aytadi
Yaqinda Citrix NetScaler tuzatishlari chiqarilishi mumkinligi uchun tuzatish boshqaruv quvurlarini tayyor saqlang. (Tod Beardsley)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst shohdir
Kontekstual mudofaa xavfsizlik jamoalariga signallarni bog'lash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, yetuklikdir
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)
Vulnerabilities
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.
By
Ionut Arghire
| October 29, 2026 (4:01 AM ET)
*
The US cybersecurity agency CISA on Wednesday warned that hackers have been exploiting another VMware ESXi vulnerability in attacks.
Tracked as CVE-2026-41709, the exploited flaw is described as a low-severity insufficient logging issue. It allows attackers logged in as administrators to perform certain operations without being logged.
The security defect was disclosed on July 29 alongside three critical and one high-severity bug in VMware vCenter, ESXi, Workstation, and Fusion.
VMware ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, and ESXi80U3j-25429389 and newer releases contain the relevant patches.
CISA added CVE-2026-41709 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within the next two weeks.
CISA did not provide details on the observed exploitation, but CrowdStrike reported on Wednesday that the China-nexus threat actor Warp Panda had exploited CVE-2026-41709 as a zero-day in intrusions at US organizations, including law firms.
Advertisement. Scroll to continue reading.
According to CrowdStrike, Warp Panda typically gains initial access through internet-facing edge devices and pivots to VMware vCenter, where it deployed malware such as BrickStorm, TetanusStorm, SharpStorm, DualGauge and GuestConduit in intrusions throughout 2025.
In several of those attacks, and as late as early 2026, the group used CVE-2026-41709 to significantly reduce audit trail visibility.
At least two other security defects described in Broadcom’s July 29 advisories have been targeted in the wild, namely CVE-2026-59309 (a critical-severity authentication bypass) and CVE-2026-59310 (a critical directory traversal issue leading to arbitrary code execution).
In mid-August, cybersecurity company Quirso said an APT had been exploiting CVE-2026-59310 to compromise approximately 360 web-accessible VMware vCenter servers and deploy an SSH reverse shell.
Later, Quirso attributed the activity to a China-linked threat actor and warned that CVE-2026-59309 had been exploited as well, likely before CVE-2026-59310, potentially by a different threat actor.
Mass targeting of CVE-2026-59310 was flagged in early September.
Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Related:TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Related:China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Related:Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
- HPE Patches Dozens of Critical Flaws in Networking Products
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Genesys Hack Exposes Customer Data From Internal Systems
- 953 Online Stores Infected in Long-Lasting Malware Campaign
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Latest News
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- Upwind Security Raises$400 Million at$3.8 Billion Valuation
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
- Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
Trending
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
HPE Patches Dozens of Critical Flaws in Networking Products
PHP2Shell Exploitation Moves From Probes to Working Shells
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)