vCenter zero-day chain lets attackers forge admin logins without a password
Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.
Sources:
vCenter pre-auth RCE: CVE-2026-59309/59310 | Mobeta
GitHub App Private Keys: 474 Leaked Keys Still Work
New ClosedQuorum Windows malware uses AI for attack decisions
Stolen passwords are exposing America’s water providers to hackers
D-Link warns of max severity zero-day bug in DIR-822A routers
📰 Read the full edition on the site
🤖 Episode produced with artificial intelligence. Synthetic voice.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.