1 publisher · first seen Wed, 28 Oct 2026 05:42 UTC · updated Wed, 28 Oct 2026 05:42 UTC
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability in Broadcom VMware ESX, identified as CVE-2026-41709, to its Known Exploited Vulnerabilities catalog on October 29, 2026, after CrowdStrike reported it was exploited by the China-nexus threat actor Warp Panda. The flaw, with a CVSS score of 2.7, allows admin-level attackers to perform operations without logging, and has been used in attacks targeting the U.S. legal sector to reduce audit trail visibility. CISA also added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2, due to confirmed active exploitation.
Federal Civilian Executive Branch agencies must patch CVE-2026-41709 by November 11, 2026, while agencies have until October 29, 2026, to address the PHP flaws. Warp Panda has used zero-day exploits in edge devices and VMware environments to deploy malware such as BRICKSTORM and maintain persistent access, including by registering rogue multi-factor authentication devices. Evidence of PHP2Shell exploitation includes successful shell executions in honeypots and over 50,000 exploitation attempts from more than 600 IP addresses across 70 countries.
Content auto-generated. May contain inaccuracies.