🚀 Medial Secures Investment on Shark Tank India - Fueling the Future of Professional Social Networking. 🔥

Startup Showcase

Premium Content

Try our Valuation Calculator →

News on Medial

VMware sandbox escape bugs are so critical, patches are released for end-of-life products

Arstechnica

Arstechnica · 1y ago

VMware sandbox escape bugs are so critical, patches are released for end-of-life products

VMware has issued a warning to customers to promptly patch critical vulnerabilities in its ESXi, Workstation, Fusion, and Cloud Foundation products. The vulnerabilities, including two with high severity ratings, expose a gap in the virtual machine sandbox protection, allowing hackers to escape and access sensitive data. VMware has classified the situation as an emergency change requiring immediate action. The company has provided detailed instructions on mitigating the risks, including removing USB controllers as a temporary solution. Although there is no evidence of active exploitation, VMware urges customers to ensure their systems are up to date.

Related News

VMware reveals patches for a host of security flaws, so update now

Techradar

Techradar · 1y ago

VMware reveals patches for a host of security flaws, so update now

VMware has released patches for four high-severity vulnerabilities affecting its ESXi, Workstation, and Fusion products. The flaws include use-after-free vulnerabilities in the XHCI USB controller, an out-of-bounds write flaw in ESXi, and an information disclosure vulnerability in UHCI USB controller. Exploitation of these vulnerabilities could lead to remote code execution. VMware advises users to update their products to the recommended versions or remove USB controllers from virtual machines as a temporary workaround.

Critical vulnerabilities in Exim threaten over 250k email servers worldwide

Arstechnica

Arstechnica · 2y ago

Critical vulnerabilities in Exim threaten over 250k email servers worldwide

Critical vulnerabilities have been discovered in Exim, the mail transfer agent used by approximately 253,000 servers worldwide. Zero Day Initiative reported the vulnerabilities, which allow remote execution of malicious code. The bugs have severity ratings ranging from 7.5 to 9.8 out of 10. Exim has released patches for three of the vulnerabilities in a private repository, but the status of patches for the remaining three is unknown. The vulnerabilities were not transparently disclosed, leading to criticism of both Exim and ZDI. Hackers have previously exploited Exim vulnerabilities to compromise networks.

Threat posed by new VMware hyperjacking vulnerabilities is hard to overstate

Arstechnica

Arstechnica · 8m ago

Threat posed by new VMware hyperjacking vulnerabilities is hard to overstate

VMware has patched three critical vulnerabilities affecting its ESXi, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform. These vulnerabilities allow attackers to escape from a virtual machine to the hypervisor, potentially compromising all VMs on that hypervisor. With severity ratings up to 9.3, these vulnerabilities, already exploited in the wild, pose significant security threats. Organizations using affected products should investigate and secure their environments promptly to mitigate these risks.

CERT-IN issues urgent warning for Google Chrome users: How to stay safe online

Livemint

Livemint · 1y ago

CERT-IN issues urgent warning for Google Chrome users: How to stay safe online

The Indian Computer Emergency Response Team (CERT-IN) has warned Google Chrome users about critical vulnerabilities that could allow remote attackers to gain unauthorized access to their systems. The flaws, known as CIVN-2024-0282, affect versions of Chrome prior to 128.0.6613.119/.120 for Windows and macOS, and versions prior to 128.0.6613.119 for Linux. The vulnerabilities, labeled as CVE-2024-8362 and CVE-2024-7970, are "use after free" bugs in the Web Audio component of Chrome, which could lead to unauthorized execution of commands by cybercriminals. Google has released patches to address these vulnerabilities, and users are advised to update their browsers immediately.

VMware admits sweeping Broadcom changes are worrying customers

Arstechnica

Arstechnica · 1y ago

VMware admits sweeping Broadcom changes are worrying customers

Broadcom's changes to VMware since acquiring the company are causing concerns among customers and partners. VMware is facing challenges as customers evaluate how to maximize value from their products and deal with the shift from perpetual license sales to a subscription-based model. Broadcom's decision to discontinue certain VMware products and end the VMware partner program is also causing confusion and potential infrastructure changes for smaller businesses. While Broadcom defends the changes as necessary, the implications of these decisions remain to be seen.

WhatsApp patches exploit allowing hackers to target Apple users - The Economic Times

Economic Times

Economic Times · 2m ago

WhatsApp patches exploit allowing hackers to target Apple users - The Economic Times

WhatsApp addressed a security flaw enabling targeted attacks on Apple devices by linking bugs in iOS and iPadOS. In a 90-day campaign, under 200 users were affected. Both WhatsApp and Apple released patches, urging users to update their apps to mitigate risks. The identity of the attackers remains unclear, but WhatsApp has notified those impacted. Amnesty's Security Lab noted other apps might also be affected. Apple confirmed the vulnerability and issued corrective patches.

AT&T sues Broadcom for refusing to renew perpetual license support

Arstechnica

Arstechnica · 1y ago

AT&T sues Broadcom for refusing to renew perpetual license support

AT&T has filed a lawsuit against Broadcom, accusing the company of retroactively changing existing VMware contracts. The lawsuit alleges that Broadcom is preventing AT&T from renewing support services for previously purchased perpetual VMware software licenses unless certain conditions are met. AT&T claims that support services are critical for software errors, security patches, upgrades, and maintenance. The lawsuit seeks a one-year renewal for support services and aims to prevent Broadcom from cutting off support. Broadcom denies the allegations and argues that AT&T is not eligible for a renewal. The case could have implications for AT&T's provision of services to first responders and the Office of the President.

Broadcom says “many” VMware perpetual licenses got support extensions

Arstechnica

Arstechnica · 1y ago

Broadcom says “many” VMware perpetual licenses got support extensions

Broadcom CEO Hock Tan has announced support extensions for some VMware perpetual license holders in an effort to address concerns over the company's recent business model changes. The extensions come after Broadcom's decision to end perpetual license sales for VMware and prioritize subscriptions. Tan also revealed plans to provide free access to zero-day security patches for supported versions of vSphere. These moves follow questioning by EU antitrust regulators over alleged changes to VMware's licensing and support conditions. Meanwhile, VMware channel partners and customers have voiced concerns over Broadcom's focus on larger businesses and increased pricing.

Apple patches 0-day exploited in “extremely sophisticated attack”

Arstechnica

Arstechnica · 8m ago

Apple patches 0-day exploited in “extremely sophisticated attack”

Apple has patched a critical zero-day vulnerability in Webkit affecting iPhones and iPads, potentially exploited in a sophisticated attack targeting specific individuals. This vulnerability allowed malicious web content to escape the security sandbox. It impacts several iPhone and iPad models, requiring users to update to iOS and iPadOS 18.3.2. While there’s no indication of widespread exploitation, targets of entities like law enforcement or nation-state spies should update immediately for security.

Gift For Fintechs: RBI Updates Regulatory Sandbox Framework, Extends Cohort Timelines

Inc42 · 1y ago

Gift For Fintechs: RBI Updates Regulatory Sandbox Framework, Extends Cohort Timelines

The Reserve Bank of India (RBI) has released an updated framework for enabling regulatory sandbox (RS) to support fintech startups. The sandbox allows these entities to test their products or services in a controlled and regulated environment without full compliance with standard regulatory norms. The framework has been revised based on feedback from fintechs, banking partners, and other stakeholders. The new rules include a revised timeline for the sandbox process and the introduction of a phase called "formulation of test design and integration." The rules also mandate compliance with data protection regulations and require entities to ensure safeguards against personal data breaches.

Trackers

Active Indian VC’s

OG Capital Email

With a hands-on approach, OG Capital aims to invest in over 20 promising...

Accel Partners Email

Early and growth-stage investments in disruptive technology companies with...

Early-stage venture capital firm investing in technology startups in India. Focus on...

Access All Trackers

Startup Showcase Winners

Sept 2025

Your Health, Simplified with Smart Care

An ecosystem for curated creative partnerships

Your Health our Priority.

Enter Ongoing Startup Showcase

Top Users

Trending News on Medial

Verizon is laying off over 13,000 ...

Taiwan approves Nvidia subsidiary ...

Italy closes Google probe over un ...

Download the medial app to read full posts, comements and news.