Jun 25, 2024
2 new incidents, 0 with updates.
Started
- ClosedHighPatched
polyfill.io CDN turned malicious on 100k+ sites
The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.
polyfill.io CDNClosed Jun 27, 2024
- ClosedMediumPatched
VMware ESXi Authentication Bypass
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.
VMware ESXiClosed Jul 30, 2024
