CISA adds VMware ESX zero-day used to blind audit trails
On the radar
05 TOP STORIESThe Hacker News · 4 min read
CISA adds VMware ESX zero-day used to blind audit trails
CISA put CVE-2026-41709 in Broadcom VMware ESX on KEV, along with Linux kernel CVE-2026-46300, citing active exploitation. The Hacker News reports China-linked Warp Panda used the ESX bug to reduce audit trail visibility in attacks on the legal sector. Hypervisor compromise undermines the logging that guest-level tools rely on, so ESX hosts need patching and their logs need independent collection.
The Hacker News · 7 min read
KeyDrift malware steals encryption keys via patched Cisco SD-WAN flaw
Cisco Talos says attackers exploited a Catalyst SD-WAN flaw fixed in February to deploy KeyDrift, which steals traffic encryption keys. The exploited bug had a patch for months, so unpatched SD-WAN controllers are the exposure. Stolen keys can enable traffic decryption, so affected deployments should consider rotating keys after patching.
The Hacker News · 5 min read
PHP2Shell exploitation hits Palo Alto management interfaces and roots 25 servers
Threat actors are exploiting recently patched PHP2Shell flaws against internet-exposed Palo Alto Networks management interfaces. Separately, a suspected China-nexus actor used AI-assisted PHP2Shell exploitation plus a kernel privilege escalation to root 25 servers and breach a U.S. government-affiliated network. Management interfaces should not face the internet, and patching alone does not cover what was already compromised.
The Hacker News · 7 min read
Volt Typhoon hid four zero-day campaigns behind 'Silent Train' relay network
Lumen's Black Lotus Labs attributes Volt Typhoon's zero-day campaigns to Silent Train, a covert network of rotating chains of compromised SOHO and IoT devices. The network has been disrupted. Traffic from residential-grade devices is hard to block by reputation, so detection has to focus on behavior at the target.
The Verge · 2 min read
Google releases Gemini 4 Carbon to select defense partners only
Google announced Gemini 4 Carbon, a frontier model with gains in coding, agentic tasks and cybersecurity, but access is limited to select defense partners. The Register reports it undercuts Claude on price ahead of Anthropic's IPO. Gating a cyber-capable model to defenders is a distribution choice other labs may copy.
Go a little deeper
EXPLORE BY TOPIC- 37 articles
Cyber security
Exploitation of edge and management infrastructure dominated the day, with several cases of AI-assisted attacks. Data theft hit a US federal workforce and a Japanese ISP subsidiary, and patch-to-exploit gaps looked short.
Read 8 updates - 38 articles
Tech industry
Earnings put numbers on cloud and AI demand, and Apple's hardware event set a premium price ceiling. Regulators in Washington kept targeting Chinese gadgets and radio spectrum use.
Read 8 updates - 20 articles
AI
Agent behavior and cost were the main subjects. An agent security incident, spending controls and complaints about token use sit next to Google's gated frontier release and incremental product launches.
Read 8 updates - 17 articles
IT & infrastructure
Capacity strain from AI traffic showed up at GitHub, while the Linux 7.4 merge window produced file-system and SMB changes. Distro politics around LLM-written software and a Microsoft update bug rounded out the day.
Read 8 updates