Act now:VMware vCenter CVE-2026-59310: Exploited Syslog RCE. Anyone running vCenter Server 8.0, 9.0 or 9.1, including the vCenter inside VMware Cloud Foundation, vSphere Foundation and Telco Cloud, below the fixed builds.
Act now:Cisco FMC CVE-2026-20316: Exploited Hard-Coded Password. Anyone running on-premises Cisco Secure Firewall Management Center (hardware or virtual), most urgently where its web interface is reachable from the internet or from broad internal networks.
Patch this week:Node.js July 2026 Security Releases: HTTP/2 and 11 CVEs. Anyone running Node.js 22.x, 24.x or 26.x, most urgently services that accept HTTP/2 connections directly from untrusted clients or run code under --permission.
Do you run any of these? Cisco Secure Firewall Management Center (FMC). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-01.
If you run vCenter and have not installed Broadcom's July 29 fix, patch today and hunt for persistence; this is unauthenticated root code execution with hundreds of victims and ransomware use.
Must act: Anyone running vCenter Server 8.0, 9.0 or 9.1, including the vCenter inside VMware Cloud Foundation, vSphere Foundation and Telco Cloud, below the fixed builds.
Can relax: Teams with no on-premises VMware vCenter, and vCenter instances already on 9.1.0.0300, 9.0.2.0100 or 8.0 U3k that were patched before August 3 and show no signs of compromise.
Find every vCenter appliance, including those inside VCF and Telco Cloud, and check its build with vpxd -v.
Upgrade to 9.1.0.0300, 9.0.2.0100 or 8.0 U3k; Broadcom lists no workaround.
Until patched, allow syslog (514/6514) only from your ESXi hosts and the management ports only from admin jump hosts.
If you run on-premises Cisco FMC and have not installed the July hot fix or a September hardening release, upgrade now and check for the published indicator; the login needs no guessing and CISA ties the bug to ransomware.
Must act: Anyone running on-premises Cisco Secure Firewall Management Center (hardware or virtual), most urgently where its web interface is reachable from the internet or from broad internal networks.
Can relax: Teams with no Cisco firewalls, and those using Cloud-Delivered FMC, Security Cloud Control or on-box Firewall Device Manager, which Cisco confirms are not affected.
List every on-premises FMC (appliance and virtual) and note its software version.
Run Cisco's indicator check in expert mode before upgrading: sudo zgrep "package_info.*license" /var/log/messages*
Upgrade to the fixed hardening release for your train (7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 or 10.1.0); move 7.3 systems to a fixed train.
Routine but real: upgrade every supported Node.js line this week, sooner if you terminate HTTP/2 in Node or rely on the Permission Model as a sandbox.
Must act: Anyone running Node.js 22.x, 24.x or 26.x, most urgently services that accept HTTP/2 connections directly from untrusted clients or run code under --permission.
Can relax: Services that only speak HTTP/1.1 behind a proxy and do not use --permission, node:sqlite or mTLS agents can roll the upgrade into their normal cycle.
Run node -v on every host, container and CI image that serves traffic.
Upgrade to 26.5.1, 24.18.1 or 22.23.2 or later (nvm install 24.18.1, your OS packages, or refreshed node:* images), then restart processes.
Rebuild and redeploy container images and single executable applications so they embed the fixed runtime.