🧰 VMware ESXi

The items that name it 8

• Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  article2026-10-29It is written here as VMware ESXi (CVE-2026-41709; fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and newer).

  CVE-2026-41709; fixed in ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 and newer

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  article2026-09-17

  Ransomware targeting ESXi environments was found linked to The Gentlemen.

• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22

  Hypervisor pivoted to by UNC3886 after compromising FortiGate/FortiManager

• nikaiw/VMkatz
  repo2026-05-22

  hypervisor targeted for deployment and VMFS/VM file access

• 0xor0ne Awesome List
  repo2026-05-12
• The Evolving Linux Threat Landscape
  article2026-03-03

  Hypervisor targeted by ransomware groups (Lockbit 5.0, Akira, Qilin) to encrypt server fleets

• ESXi Exploitation in the Wild
  writeup2026-01-07

  Exploit toolkit contains hardcoded offset table for 155 ESXi builds spanning versions 5.1 through 8.0; ESXi 6.x and earlier are end-of-life and unpatched

• Hardening the Hypervisor | Huntress
  article2025-12-08

  Bare-metal (Type 1) hypervisor targeted by ransomware for mass VM encryption; affected by CVE-2024-37085 and SLP-based exploitation