⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

This week's security landscape was dominated by active exploitation of critical vulnerabilities, including a severe directory traversal flaw in VMware vCenter identified as CVE-2026-59310. A suspected China-linked APT group leveraged this bug to deploy backdoors and Babuk-derived ransomware, which researchers assess served primarily as a distraction for forensic evasion rather than the final objective.

Concurrently, North Korea’s Lazarus Group targeted defense and aerospace sectors across Europe, South America, and Asia using a zero-day privilege escalation vulnerability in Microsoft Windows, tracked as CVE-2026-68820. The actor delivered new malware strains, ForestTiger and Troy, under the guise of their long-running “Dream Job” social engineering campaign. Additional notable developments include the release of patches for a critical SQL injection issue in GeoServer (fixed in versions 3.0.1, 2.28.5, and 2.27.6), the discovery of GhostSplice, an attack technique that fragments malicious prompts to evade AI coding assistant guardrails, and the emergence of Amnesia Stealer, a macOS tool capable of live-controlling victim browsers via the Chrome DevTools Protocol.