HeadFlash Security

vCenter zero-day chain lets attackers forge admin logins without a password

Sep 23, 2026 4:33

Two CVSS 9.8 vCenter flaws, one exploited in the wild, plus 474 still-valid leaked GitHub App keys and a Gemini-powered malware implant.

Sources:

vCenter pre-auth RCE: CVE-2026-59309/59310 | Mobeta

GitHub App Private Keys: 474 Leaked Keys Still Work

New ClosedQuorum Windows malware uses AI for attack decisions

Stolen passwords are exposing America’s water providers to hackers

D-Link warns…