Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
2026-10-29T20:51:42Z•37f4b901fa0dae75012674adccdea346cdaa69e0a9c0eab11424fbf630ab2367
CVE-2026-101767CVE-2026-41709AI securityChinese state-sponsored activityDHSGitHub malware distributionOktaOracle E-Business SuiteSOHO and IoT compromiseSQL injectionTLS certificate managementVMware ESXVolt Typhoonactive exploitationbrowser sandbox escapecryptominerdata breachfake ChatGPT applicationsfake Claude applicationsrelay networkremote code executionzero-day
What happened
Help Net Security reports active exploitation and emerging threats, including Chinese state-linked actors using a VMware ESX logging zero-day, Volt Typhoon relay infrastructure, exploitation of Oracle E-Business Suite CVE-2026-101767, malware distributed through fake ChatGPT and Claude applications, and vulnerabilities in embedded browsers used by AI coding assistants. The most immediately actionable item is exploitation of the unauthenticated Oracle EBS SQL injection vulnerability, reported with a CVSS score of 9.8.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 37f4b901fa0dae75012674adccdea346cdaa69e0a9c0eab11424fbf630ab2367
- Enrichment time
- 2026-10-29T20:51:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.