Malicious actors are exploiting vulnerabilities in older Linux kernel versions and VMware ESX. They use them to cover their tracks or escalate their privileges after breaking in.
The U.S. cybersecurity agency CISA has confirmed the observed attacks by adding the flaws to its “Known-Exploited-Vulnerabilities” catalog. One affects Broadcom’s VMware ESX. It came to light at the end of July this year and affects the virtualization software’s logging. Admins can perform certain operations without them being logged (CVE-2026-41709, CVSS 2.7, “low” risk). The low-risk rating seems too mild in light of the attacks — Broadcom is still standing by it. Cybersecurity firm CrowdStrike said in its report on the 2026 threat landscape for the legal sector, published Wednesday, that attackers from the “Warp Panda” group, which has ties to China, targeted U.S. companies in the legal sector. They planted various types of malware in the victims’ VMware…