# Badtech.org
> Tracking cybersecurity.
Public Ghost content for AI and LLM tooling. This file includes a bounded export of public pages first, then recent public posts.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).
## Pages
### About Badtech.org
URL: https://badtech.org/about/
Last updated: 2026-08-01T00:14:41.000Z
Badtech Radar is an independent, AI-assisted project tracking cybersecurity vulnerabilities, breaches, ransomware, and the technology decisions behind them.

Automated tools help discover, organize, and summarize potential stories. Articles are selected, reviewed, and edited by Adam Field before publication.
## Posts
### Active exploitation hits SonicWall SMA1000 vulnerability chain with unauthenticated RCE path
URL: https://badtech.org/active-exploitation-hits-sonicwall-sma1000-vulnerability-chain-with-unauthenticated-rce-path/
Last updated: 2026-09-05T00:50:19.000Z
Active exploitation is targeting SonicWall SMA1000 appliances through CVE-2026-83548 and CVE-2026-83549, a pre-authentication SSRF flaw and a post-authentication OS command-injection flaw that can be chained to reach unauthenticated remote code execution. Affected models are SMA 6210, SMA 7210 and SMA 8200v on 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier; fixed builds are 12.4.3-03526 and 12.5.0-02952 or later.

These are SonicWall Secure Mobile Access appliances used for enterprise remote access. SonicWall SMA 100 appliances and SSL-VPN functionality on SonicWall firewalls are outside this advisory’s scope.

For exposed affected systems, the supplied guidance is to identify internet-facing appliances, preserve relevant logs, apply the fixed builds, and investigate for compromise rather than treating patching as sufficient closure. If compromise is confirmed or indicators are found, response guidance includes re-imaging physical appliances or redeploying virtual ones, changing user and administrator passwords, and resetting TOTP tokens.

## Sources

- [Center for Internet Security / MS-ISAC: Multiple Vulnerabilities in SonicWall SMA1000 Series Appliances Could Allow for Remote Code Execution](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution%5F2026-087?ref=badtech.org)
- [Field Effect: Active exploitation of SonicWall SMA1000 zero-day vulnerabilities](https://fieldeffect.com/blog/active-exploitation-sonicwall-sma1000?ref=badtech.org)
- [IONIX: CVE-2026-83548 – Pre-Auth SSRF (Chained to RCE)](https://www.ionix.io/threat-center/cve-2026-83548?ref=badtech.org)
- [Security.io: SonicWall SMA 1000 zero-days demand compromise checks, not patch-only closure](https://www.security.io/articles/2026/09/03/sonicwall-sma1000-zero-days?ref=badtech.org)
- [Techleet Solutions: SonicWall SMA1000 Zero-Days Exploited](https://techleetsolutions.com/news/posts/2026-09-03-sonicwall-sma1000-zero-days-exploited?ref=badtech.org)
### Aurora ransomware operator used Cursor Agent in 10 intrusions and targeted ESXi hosts
URL: https://badtech.org/aurora-ransomware-operator-used-cursor-agent-in-10-intrusions-and-targeted-esxi-hosts/
Last updated: 2026-08-31T14:54:27.000Z
Gambit Security says an Aurora ransomware operator used Cursor Agent inside 10 victim networks and paired it with tooling to find and encrypt VMware ESXi environments.

According to Gambit Security, the operator used Cursor Agent, running Claude Sonnet, during hands-on activity across 10 organizations between April 8 and May 21, 2026\. Gambit said the sessions started with credentials or an existing route into the network, then used the agent for internal scanning, VPN or proxy setup, privilege enumeration, NTLM relay attempts and certificate attacks. Gambit also reported that many agent commands failed on the first try and were sometimes retried with refined prompts or scripts.

Gambit said a custom NetExec module, esxi\_finder.py, searched for ESXi hypervisors and vCenter servers by learning internal ranges, scanning ports 443 and 902, checking TLS certificates and fingerprinting product builds through web and SDK paths. ESXi is VMware’s hypervisor, and vCenter is its centralized management server. Gambit also documented a Linux Aurora encryptor with an ESXi mode that stopped running virtual machines, encrypted virtual-machine files and skipped system volumes so the host remained bootable. The report said the encryptor also wrote the ransom note into the host SSH banner.

## Sources

- [Gambit Security: Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation](https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation?ref=badtech.org)
- [Infosecurity Magazine: Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations](https://www.infosecurity-magazine.com/news/abuse-cursor-agent-ransomware?ref=badtech.org)
- [Being Guru: Ransomware Crew Used Cursor AI Agent to Attack Networks](https://beingguru.com/ransomware-crew-used-cursors-ai-agent-to-attack-company-networks?ref=badtech.org)
- [NetNewsLedger: Exposed Aurora ransomware server reveals AI-assisted attacks, stolen credentials and crypto laundering](https://www.netnewsledger.com/2026/08/27/exposed-aurora-ransomware-server-reveals-ai-assisted-attacks-stolen-credentials-and-crypto-laundering?ref=badtech.org)
### Microsoft Azure urges network-based compensating controls as patch windows shrink
URL: https://badtech.org/microsoft-azure-urges-network-based-compensating-controls-as-patch-windows-shrink/
Last updated: 2026-08-25T23:25:23.000Z
Microsoft Azure says patch validation and deployment timelines no longer match current exploitation speed and is urging enterprises to add adaptive, network-based compensating controls during remediation.

In a Microsoft Azure Blog post, Microsoft argues the usual sequence of disclosure, exposure assessment, testing and patch rollout is increasingly out of step with attacker timelines. Microsoft says organizations may need days or weeks to validate and deploy fixes, while exploitation can emerge within hours. Help Net Security separately reported Rapid7’s assessment that the gap between patch release and weaponization has approached zero.

Microsoft describes the interval between vulnerability awareness and full remediation as a key exposure window, especially for critical or hard-to-disrupt systems. Its proposed response is to use compensating controls before patching is complete, including network-enforced restrictions, segmentation, access limits and other measures to reduce blast radius. Microsoft says these controls should complement, not replace, patch management.

## Operational significance

Security teams should prioritize reachable and internet-facing assets rather than relying on severity ratings or ticket closure alone as evidence of reduced exposure. Microsoft frames the network as a control plane that can sit across hybrid and multicloud environments, observe communication paths and enforce protections without changing applications, but the supplied sources do not identify a specific new Azure product or provide implementation metrics.

## Sources

- [Microsoft Azure Blog: The patch window is collapsing: Why security needs a new control plane](https://azure.microsoft.com/en-us/blog/the-patch-window-is-collapsing-why-security-needs-a-new-control-plane?ref=badtech.org)
- [Help Net Security: 8,539 reasons to rethink how vulnerabilities get patched](https://www.helpnetsecurity.com/2026/08/20/rapid7-vulnerability-patch-cycles-report?ref=badtech.org)
### Oracle August 2026 CPU ships 943 patches, including critical unauthenticated flaws in Fusion Middlew
URL: https://badtech.org/oracle-august-2026-cpu-ships-943-patches-including-critical-unauthenticated-flaws-in-fusion-middlew/
Last updated: 2026-08-19T23:29:15.000Z
Oracle released its August 2026 Critical Security Patch Update on August 18 with 943 new patches across its enterprise software portfolio, including 262 for Fusion Middleware, 120 for E-Business Suite, and 66 for Commerce. Covered products include WebLogic Server, PeopleSoft Enterprise PeopleTools, Oracle Internet Directory, Oracle Identity Manager, WebCenter, BI Publisher, Payments, Helidon, Hyperion, and Siebel Applications.

In Fusion Middleware, Oracle lists remotely exploitable unauthenticated flaws, including CVSS 10.0 issues in Oracle Internet Directory and CVSS 9.8 issues affecting WebLogic Server and other components. Oracle says customers should apply updates as soon as possible; temporary measures such as blocking required network protocols or removing unnecessary privileges may reduce risk but can impair functionality and are not long-term fixes.

IONIX separately describes CVE-2026-60821 as an unauthenticated remote-code-execution flaw in the Business Interlink component of PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63\. Oracle’s advisory also lists PeopleTools 8.61 through 8.63 among covered products.

## Operational significance

Organizations should inventory affected Oracle deployments, prioritize internet-reachable Fusion Middleware and PeopleSoft systems, and apply product-specific patches and installation guidance. For exposed PeopleSoft PeopleTools systems, IONIX recommends prioritizing the fix for CVE-2026-60821 and restricting direct internet access until patching is complete.

## Sources

- [Oracle: Oracle Critical Security Patch Update Advisory - August 2026](https://www.oracle.com/security-alerts/cspuaug2026.html?ref=badtech.org)
- [IONIX: CVE-2026-60821 – Unauthenticated Remote Code Execution / Full ...](https://www.ionix.io/threat-center/cve-2026-60821?ref=badtech.org)
### Microsoft August Patch Tuesday includes exploited Windows privilege-escalation flaw and two publicly
URL: https://badtech.org/microsoft-august-patch-tuesday-includes-exploited-windows-privilege-escalation-flaw-and-two-publicly/
Last updated: 2026-08-12T22:47:24.000Z
Microsoft’s August 11 Patch Tuesday addressed hundreds of vulnerabilities across Windows, Office, Azure, Exchange Server, SharePoint, .NET, Teams, and other products. Qualys ThreatPROTECT and CyberHub Podcast counted 421 fixes, while other supplied coverage reported lower totals, with the difference attributed to counting method or update scope.

The most urgent issue in the supplied coverage is CVE-2026-68820, a use-after-free elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock (afd.sys), a core Windows networking driver. The flaw can let a locally authenticated attacker win a race condition and gain SYSTEM privileges, and it was reported as actively exploited in the wild.

TechGig, Mallory.ai, and CyberHub coverage also identified two publicly disclosed Windows flaws in the release: CVE-2026-62832 in the Windows User Profile Service and CVE-2026-72971 in the Windows Container Isolation FS Filter Driver. Separate reporting also highlighted remote-code-execution fixes affecting Windows DNS Server, Windows Deployment Services TFTP Server, Microsoft QUIC, and HPC Pack where those services are deployed.

## Sources

- [Qualys ThreatPROTECT: Microsoft Patch Tuesday, August 2026 Security Update Review](https://threatprotect.qualys.com/2026/08/12/microsoft-patch-tuesday-august-2026-security-update-review?ref=badtech.org)
- [Security Affairs: Microsoft Patch Tuesday for August 2026 Fixed a Zero-Day and Wormable RCE](https://securityaffairs.com/197048/security/microsoft-patch-tuesday-for-august-2026-fixed-a-zero-day-and-wormable-rce.html?ref=badtech.org)
- [TechGig: Microsoft August 2026 Patch Tuesday Fixes 400 Flaws, 3 Zero-Days](https://techgig.com/amp/news/cybersecurity/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/133167998?ref=badtech.org)
- [Mallory.ai: Microsoft Fixes 420 Flaws Including Exploited Windows Privilege Escalation Bugs](https://mallory.ai/stories/019ff53d-ec1f-740e-9985-fcaefe8c92ff?ref=badtech.org)
- [CyberHub Podcast: Cisco VPNs Under Active Attack, Microsoft Drops 421 Patches ...](https://www.cyberhubpodcast.com/p/cisco-vpns-under-active-attack-microsoft?ref=badtech.org)
### Cisco patches critical Catalyst SD-WAN, IOS XE and Secure Firewall Management Center flaws
URL: https://badtech.org/cisco-patches-critical-catalyst-sd-wan-ios-xe-and-secure-firewall-management-center-flaws/
Last updated: 2026-08-06T20:09:37.000Z
SecurityWeek reported that Cisco released fixes for roughly two dozen vulnerabilities across its products, including critical issues in Catalyst SD-WAN, IOS XE and Secure Firewall Management Center.

For Catalyst SD-WAN, SecurityWeek and Secure ISS said Cisco identified CVE-2026-20303, CVE-2026-20304 and CVE-2026-20310 as critical vulnerabilities, and listed fixed releases 20.9.10, 20.12.8.1, 20.15.6, 20.18.4 and 26.1.2 by branch. The reporting also listed IOS XE fixes for CVE-2026-20272 and CVE-2026-20267, with fixed releases including 17.9.10, 17.12.8, 17.15.6, 17.18.4 or 17.18.4a, and 26.1.2.

SecurityWeek said Cisco also patched CVE-2026-20079 in Secure Firewall Management Center, described as a critical authentication-bypass flaw that could let a remote unauthenticated attacker execute scripts and commands and gain root privileges. The brief says no workarounds were available for the Catalyst SD-WAN and IOS XE hardening issues, and the reporting said Cisco was not aware of exploitation at disclosure time.

## Sources

- [SecurityWeek: Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities](https://www.securityweek.com/cisco-patches-critical-sd-wan-ios-xe-fmc-vulnerabilities?ref=badtech.org)
- [Secure ISS: Cisco Releases Critical Security Hardening Updates](https://www.secure-iss.com/newsroom/cisco-releases-critical-security-hardening-updates?ref=badtech.org)
### N-able N-central auth-bypass flaw is under active exploitation; customers told to verify 2026.3.1.7
URL: https://badtech.org/n-able-n-central-auth-bypass-flaw-is-under-active-exploitation-customers-told-to-verify-2026-3-1-7/
Last updated: 2026-08-04T01:55:28.000Z
N-able’s N-central RMM platform is under active exploitation through an authentication-bypass flaw, with Huntress reporting multiple affected organizations and observed follow-on activity including reconnaissance, process-list requests, and abuse of the Take Control remote-access feature on downstream hosts. N-central is a remote monitoring and management platform used to administer and remotely access systems across customer environments.

Huntress, CRN, and BleepingComputer reported that N-able released N-central 2026.3.1.7, also described as 2026.3 Hotfix 1, and urged customers to upgrade immediately. Later reporting indicates that stopping at the base 2026.3 release was not sufficient after expanded guidance.

Because N-central can execute scripts, jobs, software deployments, and remote-control sessions across managed environments, defenders should verify the actual deployed build, review administrator and configuration changes, and examine Take Control, server, identity, network, and endpoint logs for activity that predates remediation. The supplied reporting tracks the flaw as CVE-2026-18577, while sources disagree on a related earlier identifier.

## Sources

- [Huntress: Critical N-able N-central Vulnerability and Active Exploitation](https://www.huntress.com/blog/n-able-vulnerability-exploitation?ref=badtech.org)
- [CRN: N-able N-central Flaw Sees Exploitation: 5 Things To Know](https://www.crn.com/news/security/2026/n-able-n-central-flaw-sees-exploitation-5-things-to-know?ref=badtech.org)
- [BleepingComputer: N-able warns of N-central auth bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/n-able-warns-of-n-central-auth-bypass-flaw-exploited-in-attacks/amp?ref=badtech.org)
- [The Futurum Group: N-able's Security Vulnerability Exposes Critical Risks for Legacy Systems](https://futurumgroup.com/insights/n-ables-security-vulnerability-exposes-critical-risks-for-legacy-systems?ref=badtech.org)
### Water utility cyber incidents across at least seven U.S. states disrupted monitoring and control across at least seven U.S. states
URL: https://badtech.org/water-utility-cyber-incidents-across-at-least-seven-u-s-states-disrupted-monitoring-and-control-across-at-least-seven-u-s-states/
Last updated: 2026-08-01T00:47:59.000Z
CBS News, NBC News, and CNN Newsource via KEYT reported that the FBI and EPA said water and wastewater utilities in at least seven U.S. states experienced malicious cyber incidents, with some activity degrading operations. The reporting says the activity targeted internet-facing programmable logic controllers, or PLCs, which utilities use to monitor and control equipment such as pumps, valves, pressure and chemical processes.

Those outlets reported that more than 30 Minnesota community water systems were affected. Some utilities temporarily shifted to manual operations, and reported impacts included loss of monitoring or control; some accounts also described pressure-related disruption. The supplied reporting says no contamination of Minnesota water supplies had been reported.

CBS News and NBC News said CISA urged operators to remove publicly exposed PLCs and other OT from the internet, secure necessary external connections, strengthen passwords, and review access controls. CBS News and CNN Newsource via KEYT also reported that U.S. investigators were examining possible Iranian involvement, but no formal attribution had been made.

## Sources

- [CBS News: U.S. investigating if Iran was behind cyberattack on water systems in 7 states, including Minnesota](https://www.cbsnews.com/news/us-investigating-iran-cyberattack-minnesota-water-systems?ref=badtech.org)
- [NBC News: Hackers targeted municipal water systems in 7 states this week, FBI says](https://www.nbcnews.com/tech/security/hackers-targeted-municipal-water-systems-7-states-week-fbi-says-rcna590210?ref=badtech.org)
- [CNN Newsource via KEYT: Sweeping cyberattack on water systems in multiple states has US officials on edge](https://keyt.com/politics/cnn-us-politics/2026/07/31/sweeping-cyberattack-on-water-systems-in-multiple-states-has-us-officials-on-edge?ref=badtech.org)
- [TMJ4 / Scripps Media: Cybersecurity expert explains cyber threats facing Wisconsin water systems](https://www.tmj4.com/news/local-news/in-your-community/milwaukee-county/cybersecurity-expert-explains-cyber-threats-facing-wisconsin-water-systems?ref=badtech.org)
### Broadcom patches critical VMware vCenter and ESXi flaws including auth bypass, RCE, and VM escape
URL: https://badtech.org/broadcom-patches-critical-vmware-vcenter-and-esxi-flaws-including-auth-bypass-rce-and-vm-escape/
Last updated: 2026-07-31T01:06:59.000Z
Security Affairs, Mallory.ai, and Field Effect reported that Broadcom released patches on July 29 for five VMware vulnerabilities affecting ESXi, vCenter, Workstation, and Fusion, including three rated critical.

They said the most severe issue, CVE-2026-59309, is a critical vCenter authentication bypass rated CVSS 9.8, and that Broadcom also fixed CVE-2026-59310, a critical directory traversal flaw in the Syslog Server component that can lead to remote code execution over the network. vCenter is VMware’s centralized management platform for ESXi hosts and virtual machines.

The same reporting said Broadcom patched CVE-2026-47876, a critical flaw in the ESXi VMXNET3 virtual network adapter that could let an attacker with administrative privileges inside a guest VM execute code on the ESXi host. That creates a guest-to-host escalation path in shared infrastructure. Security Affairs and Mallory.ai said Broadcom was not aware of in-the-wild exploitation and urged customers to apply updates.

## Sources

- [Security Affairs: Broadcom Patches Critical ESXi Vulnerability Enabling Host Code Execution](https://securityaffairs.com/196231/security/broadcom-patches-critical-vmware-esxi-vulnerability-enabling-host-code-execution.html?ref=badtech.org)
- [Mallory.ai: Broadcom Patches Critical VMware vCenter RCE and ESXi ...](https://mallory.ai/stories/019fadc6-a54b-7cc9-8315-02e81f66169a?ref=badtech.org)
- [Field Effect: Broadcom Patches Critical Vulnerabilities Affecting Multiple VMware Products](https://fieldeffect.com/blog/broadcom-patches-critical-vcenter-vulnerabilities?ref=badtech.org)