Today’s Field Note

Two things are being exploited in the wild right now, and both reward speed. CVE-2026-59310, a critical RCE in the VMware vCenter Syslog Server, is being hit in a global campaign that drops a reverse SSH tool for persistence, which means patching alone will not evict an attacker who already landed. Separately, an unpatched GeoServer zero-day (SQL injection leading to RCE) is under active exploitation with no fix yet, so anything internet-facing running it is a live target. Add the Akira affiliate trick of rebooting into Safe Mode with Networking to kill EDR before they act, and the theme of the day is simple: assume the patch is late and the persistence is already in place.

Today’s Action

  • Patch VMware vCenter for CVE-2026-59310 now, then hunt for reverse SSH connections, new SSH keys, and unexpected outbound sessions from vCenter hosts. Patching is not enough if they are already in.
  • Inventory internet-facing GeoServer instances, restrict access, and monitor for SQLi and RCE indicators until a vendor fix ships. Consider taking exposed instances offline.
  • Configure EDR with tamper protection and Safe Mode monitoring, and alert on unexpected reboots into Safe Mode with Networking to counter the Akira technique.
  • For orgs touched by RingCentral or ShipMonk/Trezor breaches: force credential resets where relevant and warn users to expect targeted phishing using leaked names, addresses, and phone numbers.
  • Review third-party logistics and CRM vendors (Beacon’s leaked AWS key came from public JS build artifacts) and scan your own build outputs for exposed secrets.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

The patch is the start of the investigation, not the end of it.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.