virtualization

Docker fixes critical auth bypass flaw, again (CVE-2024-41110)

July 25, 2024

A critical-severity Docker Engine vulnerability (CVE-2024-41110) may be exploited by attackers to bypass authorization plugins (AuthZ) via specially crafted API request, …

Microsoft releases tool to speed up recovery of systems borked by CrowdStrike update

July 22, 2024

By now, most people are aware of – or have been personally affected by – the largest IT outage the world have ever witnessed, courtesy of a defective update for …

Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)

July 9, 2024

For July 2024 Patch Tuesday, Microsoft has released security updates and patches that fix 142 CVEs, including two exploited zero-days (CVE-2024-38080, CVE-2024-38112) in …

Critical RCE flaws in vCenter Server fixed (CVE-2024-37079, CVE-2024-37080)

June 18, 2024

VMware by Broadcom has fixed two critical vulnerabilities (CVE-2024-37079, CVE-2024-37080) affecting VMware vCenter Server and products that contain it: vSphere and Cloud …

VMware pushes admins to uninstall vulnerable, deprecated vSphere plugin (CVE-2024-22245, CVE-2024-22250)

February 21, 2024

VMware Enhanced Authentication Plug-in (EAP), a plugin for VMware vSphere, has two vulnerabilities (CVE-2024-22245, CVE-2024-22250) that could be exploited by attackers to …

Exploit writers invited to probe Chrome’s V8 engine, Google Cloud’s KVM

October 9, 2023

Google is asking bug hunters and exploit writers to develop 0-day and n-day exploits in Chrome’s V8 JavaScript engine and Google Cloud’s Kernel-based Virtual …

VMware fixes critical flaws in virtualization software (CVE-2023-20869, CVE-2023-20870)

April 26, 2023

VMware has fixed one critical (CVE-2023-20869) and three important flaws (CVE-2023-20870, CVE-2023-20871, CVE-2023-20872) in its VMware Workstation and Fusion virtual user …

CISA releases ESXiArgs ransomware recovery script

February 8, 2023

According to the latest data, the number of ESXiArgs ransomware victims has surpassed 3,800, and CISA has published a recovery script for victim organizations. Fixing the mess …

Thousands of unpatched VMware ESXi servers hit by ransomware via old bug (CVE-2021-21974)

February 6, 2023

Late last week, unknown attackers launched a widespread ransomware attack hitting VMware ESXi hypervisors via CVE-2021-21974, an easily exploitable vulnerability that allows …

Attackers use novel technique, malware to compromise hypervisors and virtual machines

September 30, 2022

Unknown attackers wielding novel specialized malware have managed to compromise VMware ESXi hypervisors and guest Linux and Windows virtual machines, Mandiant threat analysts …

Google announces threat detection for virtual machines in its cloud

February 7, 2022

Google is adding a new defensive layer to protect enterprise workloads running in Google Cloud. It’s called Virtual Machine Threat Detection (VMTD), and will help select …

Vulnerabilities in Eltima SDK affect popular cloud desktop and USB sharing services

December 10, 2021

SentinelOne researchers have unearthed a number of privilege escalation vulnerabilities in Eltima SDK, a library used by many cloud desktop and USB sharing services like …