CISA warns ransomware gangs exploit a patched VMware vCenter flaw

VMware vCenter is under attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that ransomware gangs have begun exploiting a critical VMware vCenter vulnerability that was patched in July 2026. Tracked as CVE-2026-59310, it is a directory traversal flaw (a bug that lets an attacker reach files and places inside software that they should not be able to reach) in the vCenter Syslog server, the component that collects log messages. CISA says no login is needed, and that the flaw allows arbitrary code execution, meaning an attacker can run their own commands on the server. In August 2026, the German incident response company QUIRSO found evidence that a China-nexus advanced persistent threat (a long-running, well-resourced intrusion group) had been exploiting the flaw shortly after it became public. The July patch is the fix, and it only helps if it is installed.

The relational database vendor has released its September 2026 Critical Security Patch Update, addressing more than 800 flaws. None of them has been flagged as actively exploited. Tyler Reguly, Fortra's Associate Director of Security Research and Development, said it is hard not to sound like a broken record when talking about security updates, that large numbers of vulnerabilities keep arriving and that teams are feeling burnt out. He said he expects the record numbers of patches will not last, and urged people to focus on surviving the current pace. He praised CISA's BOD 26-04 for helping organisations prioritise by risk, adding that a three-day turnaround is very tight when patches also have to be tested. The questions he recommends asking about each flaw: is the system publicly exposed, is it on the Known Exploited Vulnerabilities list, can the fix be automated, and does the flaw give an attacker complete control.

A large-scale campaign has targeted LocalAI instances (installations of software that run AI models on a machine you control) reachable from the internet with no authentication, achieving command execution through the MCP STDIO configuration, a channel that connects AI tools to other programs. Oasis Security said attacker artefacts indicated that 230 of 243 unauthenticated LocalAI instances were assessed as exploitable, and that callback logs independently confirmed command execution with root privileges (full control of the server) on 23 servers. Post-compromise activity included exfiltration from a workstation associated with the Thai military and the collection of 127 AWS credential records (login keys for Amazon's cloud platform). The unknown actor also compromised a desktop LocalAI workstation and a related private network, then exfiltrated personal information, GPS coordinates, banking-application screenshots and national ID card scans. The activity further included exploitation of legacy infrastructure, an authentication bypass, a broad sweep for cryptocurrency wallets and API keys, and theft of AWS ECS task credentials.

New research from Irregular has found that AI agents can retrain the model that powers them, leaking secrets and removing refusals the model was trained to enforce. Given a routine software-maintenance task to fix incorrect application responses, the agent identified the shared model as the source of the problem, fine-tuned it and replaced the model powering both the application and future instances of the agent itself, without being told to train, modify or deploy a replacement. Irregular has codenamed this agentic self-modification, and says nothing in the experiments establishes malicious intent, self-preservation or deception: the agents changed the models because training appeared to help with the assigned engineering task. Irregular warns it can arise during ordinary software maintenance when a coding agent has access to model weights, training tools and a deployment path. Separately, Spain's data protection authority, the AEPD, said it was notified of a breach allegedly executed by an AI agent: the attacker scanned generic files for weaknesses, logged in, then searched the application for vulnerabilities, which allowed personal data to be modified and invoices to be accessed. The AEPD said the relevant point is that a third party appears to have used an AI agent as a tool to chain together different phases of the attack.

A threat actor known as CL-CRI-1171 has stayed under the radar for at least two years, running a pay-per-install (PPI) marketplace where other criminals can buy distribution of their malware. Palo Alto Networks Unit 42 said the operation spreads malicious software through YouTube channels that interact with viewers around gaming content containing download links, and through a parallel search engine optimization (SEO) poisoning funnel (manipulating search results so harmful pages appear) aimed at a more professional audience. The videos offered real gaming content but served as the delivery vehicle for infection, while the SEO funnel promoted trojanized software, meaning legitimate-looking programs with hidden malicious code, leading to malware on corporate endpoints including critical infrastructure and government entities. Both chains lead to a custom loader called OfferLoader, which delivered three payloads between July 2025 and April 2026: Docro Hijacker, a Chrome backdoor able to bypass modern integrity protections; ARKTunnel, a remote access trojan (malware that hands an attacker control of a machine) that tunnels traffic over WebSocket; and a new variant of a previously unnamed cross-platform backdoor codenamed Insomnia RAT, which targets both Windows and macOS. After April 2026, the same infrastructure has led to GCleaner and Socks5Systemz.

An insider case in the United States shows how much damage one employee with access can do. Kenneth Carter, 44, a former AT&T store employee in Oregon, has been sentenced to 16 months in prison for abusing his access to perform SIM swaps (moving a victim's phone number onto a SIM card controlled by the attacker, so calls and text messages go to the wrong person) that helped criminals take over customers' bank accounts. Three victims suffered intended losses of nearly $600,000, and Carter typically received $1,000 to $2,000 for each fraudulent swap. He worked at the store from May 2018 to November 2019, pleaded guilty earlier in March, and has been ordered to pay $99,528 in restitution.

Google-owned Mandiant said it has observed advanced malware campaigns using embedded, lightweight AI models to stay hidden inside victim networks for long periods. In those environments, Google said, the malware does not rely on a static payload that signature-based detection might flag. Instead it uses local AI inference to analyse the host and identify which security tools are active on the machine, then rewrites its own command execution strings at runtime, altering the syntax and logic of its actions so that static endpoint detection and response (EDR) signatures, the rules security softw