Category: News

Broadcom has patched two vulnerabilities in VMware Workstation and Fusion that could let an attacker with administrative privileges inside a virtual machine escape the VM and execute code on the underlying host system, a scenario that undermines the isolation virtualization is meant to provide.

Two Distinct Escape Paths

The more severe issue, tracked as CVE-2026-59346 and carrying a CVSS score of 9.3, is an integer-overflow flaw in how the software handles the VMXNET3 virtual network adapter. According to Broadcom’s advisory, a malicious actor with local administrative privileges on a virtual machine configured with a VMXNET3 adapter can exploit the bug to execute code on the host.

The second flaw, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in the Host-Guest File System (HGFS), the VMware component that lets a guest VM access files and folders on the physical host. Exploiting it allows code execution as the host’s VMX process, though Broadcom notes the exploitation conditions differ from the first bug.

Patches Available, No Known Exploitation Yet

Both vulnerabilities are fixed in VMware Fusion Pro 26H1u1, released September 3, 2026, and the corresponding Workstation update, detailed in advisory VMSA-2026-0007. CVE-2026-59346 was reported by researchers h4urek, cameudis and Stan S working with Trend’s Zero Day Initiative; CVE-2026-59347 was credited to Yeonghyeon Choi and Tianchu Chen of Tencent’s Xuanwu Lab. As of September 4, Belgium’s national cybersecurity center said it had no indication either flaw was being actively exploited, though it urged administrators to patch immediately given the risk of lateral movement, data exfiltration and host compromise if exploitation conditions are met.

The disclosures follow reports last month that threat actors, including a suspected China-nexus group, were already exploiting separate flaws in VMware vCenter, underscoring sustained attacker interest in Broadcom’s virtualization stack.

Malone Lam, the alleged ringleader of a network accused of stealing more than $240 million in Bitcoin from a single victim through a social-engineering scheme, has a plea agreement hearing scheduled this week, according to the Associated Press.

A Social-Engineering Heist Followed by a Spending Spree

Prosecutors say the theft targeted a Washington, D.C., resident identified in court filings as “Victim 7,” who received a phone call in August 2024 from someone posing as a Google representative warning of attempts to breach his account, followed by a second call from someone claiming to represent the Gemini crypto exchange who warned of a malware attack on his crypto wallet. Prosecutors say the network Lam allegedly organized used that fabricated scenario to gain the victim’s trust and ultimately extract control of his cryptocurrency holdings.

According to the Associated Press, Lam and his associates celebrated the heist with a monthlong spending spree that included fleets of sports cars, private jet flights, hired security guards and rented mansions in Miami and the Hamptons; Lam alone reportedly spent more than $569,000 in a single evening at a Los Angeles nightclub. FBI agents arrested Lam, an eighth-grade dropout from Singapore, after the spree, on charges of organizing the social-engineering attack. Charges have been filed against Lam and 17 others in connection with the case.

Part of a Broader Enforcement Push

The case is emblematic of a rapidly growing category of cybercrime: complaints of cryptocurrency investment fraud to the FBI rose by nearly 50% in 2025. Cybersecurity researcher Allison Nixon, who tracks an underground subculture of young hackers known as The Com, has called for significantly more law enforcement resources to be devoted to pursuing these networks, warning that the scale of money involved will otherwise continue to draw in new participants. A conviction for Lam would mark a significant milestone for investigators working to build cases against the loosely organized networks behind this style of large-scale crypto theft.

Alleged “white-hat” hackers have returned 3,400 Bitcoin, worth roughly $262.6 million, of the approximately 4,000 Bitcoin they drained from the federation wallet of Liquid Network, a Bitcoin sidechain developed by Blockstream.

A Weekend Heist That Froze the Network

Liquid disclosed the incident on a Sunday, disabling its nodes and suspending all transactions in response. The stolen funds came from Liquid’s federation wallet, which held approximately 4,200 Bitcoin before the attack. Liquid said the funds were withdrawn via the SideSwap Peg-out Authorization Key, but that the key itself, along with other keys in the system, was not compromised — leaving the precise mechanism of the theft unclear. The company said exchanges had been notified and had paused or would pause LBTC deposits and withdrawals, while other assets on the network, including USDT, DePix and real-world assets, were unaffected.

A Conditional Return

The theft was claimed by attackers describing themselves as white-hat hackers, who said in a public blockchain message that they would return most of the stolen funds once Liquid fixed the underlying vulnerability: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

On Monday, the attackers followed through by returning 3,400 Bitcoin. Former Blockstream executive Samson Mow said approximately 598 Bitcoin, worth about $47 million, remained outstanding as Blockstream continued communicating with the hackers. Mow said the network would stay paused while Blockstream and federation members complete additional fixes and security improvements, resolve a resulting chain split, and prepare for a safe restart, adding that Liquid wallets and services would remain affected in the meantime.

SAP has patched a maximum-severity vulnerability in its Extended Passport (EPP) Processing component that could let an unauthenticated attacker take control of a wide range of SAP systems before a user even logs in, according to application security firm Onapsis.

A Flaw Reached Before Security Checks Apply

The vulnerability, tracked as CVE-2026-44756 and rated a maximum CVSS score of 10, stems from missing boundary validation during the deserialization of EPP data, which is used for tracing across multiple SAP applications. Onapsis, which dubbed the flaw OVERPASS, says it is triggered as soon as a new user session opens, meaning it executes before any of SAP’s access controls, including user locks, roles, authorization objects and logon policies, ever get a chance to evaluate the connection. “None of them is in the attacker’s way,” Onapsis said.

The flaw resides in SAP’s kernel code and can be reached through at least three separate paths: standard web requests, the SAP GUI protocol, and Remote Function Call connections. Because the vulnerable code runs under the operating-system account that owns the SAP installation, Onapsis says successful exploitation is equivalent to gaining full control of the SAP system, allowing an attacker to run arbitrary system commands, recover database credentials and password hashes, read the live sessions of logged-in users, and modify data, configurations and SAP binaries.

Broad Product Exposure, No Known Exploitation Yet

The vulnerable kernel code underlies a wide range of SAP products, including S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager. Neither Onapsis nor SAP has reported evidence that the flaw has been exploited in the wild.

SAP released the fix as part of 20 new and updated security notes issued on its September 2026 Patch Day. Three other critical vulnerabilities were resolved in the same release: CVE-2026-58240, a missing authentication check in NetWeaver; CVE-2026-76969, a credential disclosure issue in multitenant applications using the Cloud Application Programming Model; and CVE-2026-66768, an improper access control flaw in NetWeaver. SAP customers running any of the affected products are advised to apply the September patches as a priority given the pre-authentication nature of the OVERPASS flaw.

Stadtwerke Landsberg, a German municipal utility providing electricity, water, wastewater and district heating, had its central IT network encrypted in a ransomware attack that began September 1, 2026, The Record (Recorded Future News) reported.

The utility said it isolated its operational technology (OT) systems from the compromised IT network to keep essential services running, and warned that customer personal data — including names, addresses and bank details — may have been accessed. As of the report, no ransomware group had claimed responsibility.

Why it matters: The incident is a textbook example of the IT/OT segmentation strategy that critical-infrastructure operators are increasingly relying on: rather than preventing every IT compromise, the goal becomes containing it before it reaches the operational systems that actually control power, water and heat delivery.

Source: The Record (Recorded Future News), September 8, 2026.

CISA published advisory ICSA-26-251-01 disclosing CVE-2026-85083, a hard-coded bootloader credential affecting CareCam Pro IP cameras built on the ANJIA AJL33PC0801 platform, with a CVSS score of 6.8 (v3) / 7.0 (v4).

According to the advisory, an attacker with physical access to an affected camera could use the hard-coded credential to gain full control of the device. CISA noted that CareCam, a China-headquartered manufacturer, has not responded to the agency’s coordination attempts regarding the vulnerability.

Why it matters: Hard-coded credentials remain one of the most persistent and hardest-to-remediate vulnerability classes in commodity IP camera hardware, since fixing them typically requires a firmware update the vendor may never ship — especially when, as here, the manufacturer is unresponsive to coordinated disclosure. Physical security teams relying on unbranded or white-label camera hardware should treat CISA’s advisory list as a standing procurement-risk check, not a one-time read.

Source: CISA ICS Advisory ICSA-26-251-01, September 8, 2026.