Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
- ID
- 14782
- Status
- summarized
- Published
- 17 Aug 2026, 3:36 PM
- Fetched
- 17 Aug 2026, 8:47 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/suspected-china-nexus-actor-exploits.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 17 Aug 2026, 8:50 PM
- Tags
- Audience
- developers
What happened
A suspected China-nexus APT exploited CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, just five days after public disclosure, compromising 361 unique IPs across 47 countries. The attackers also leveraged CVE-2026-59309 (authentication bypass) to create admin accounts and deploy Babuk-derived ransomware. A patch was released by Broadcom on July 29, 2026.
Why it matters
If your team or hosting provider runs VMware vCenter Server Appliance, patch immediately to the July 29 2026 fix or you are a likely target—attackers moved from disclosure to mass exploitation within five days and are chaining two CVEs for full admin access. For most SaaS builders on cloud-native infrastructure, this is not directly actionable.
Discussion angle
Whether your infrastructure layer (on-prem vCenter vs. cloud-native) changes your exposure to nation-state ransomware campaigns, and how quickly your team can patch critical infra after disclosure.