Over 24,000 exposed server BMCs leak password hash via decades-old flaw
2026-07-28T13:23:21Z•66df9fded65c4e735d511c1c30215eb70b73b6d29a0de1f07e274807542888f1
Active Directory Certificate ServicesBMCClickFixDDoSFastJsonVeloCloud Orchestratoractive exploitationbotnetcommand injectioncryptominingdata breachenterprise securityin-memory malwareinternet-exposed servicesmalvertisingpassword hash leakagephishingransomwareremote code executionsextortionshadow AIsupply-chain attackzero-day
What happened
BleepingComputer security feed covering active exploitation of zero-days, exposed BMC password-hash leakage, botnet activity, ransomware and data breaches, supply-chain and social-engineering attacks, malicious browser-based malware delivery, and emerging shadow-AI governance risks. The highest-priority items are actively exploited FastJson and VeloCloud Orchestrator vulnerabilities, plus the large-scale exposure of internet-facing server management interfaces.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 66df9fded65c4e735d511c1c30215eb70b73b6d29a0de1f07e274807542888f1
- Enrichment time
- 2026-07-28T13:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.