decrypted · 19 august 2026 · ransomware and cybercrime · vulnerabilities and patching · supply chain

The VMware vCenter flaw NHS escalated to high risk, now wearing a ransomware payload

This week's most dangerous vulnerability isn't the one everyone's still patching from Patch Tuesday. It's a VMware vCenter bug that Broadcom fixed quietly on 29 July, that NHS England's own cyber operations centre escalated to High severity twelve days ago, and that researchers this week tied to a ransomware crew. CISA added it to its exploited-vulnerabilities list on 18 August. The gap between "patched" and "actively delivering ransomware" was three weeks, and most of that gap was spent waiting for someone to notice.

A filing clerk that never checked the label

CVE-2026-59310 sits in vCenter's Syslog server, the component that receives log messages from every host in a virtual estate and writes them to disk. The flaw is a directory traversal: send it a log entry with a filename like "../../../etc/whatever" and, instead of rejecting the traversal, it writes the file wherever the label says. No authentication, no user interaction, arbitrary code execution as root. Think of a filing clerk who takes any folder handed to them and files it exactly where the label says, including into the drawer marked "system", without ever checking whether the label makes sense.

Broadcom rated it 9.8 out of 10 and published no workaround, so patching was the only option. That didn't stop the clock: researchers traced the first attacker traffic to 3 August, five days after disclosure, and by 5 August roughly 95% of the 361 victim IP addresses eventually identified, across 47 countries, had already appeared. This week, reporting attributed a portion of that activity, with moderate confidence, to a Chinese-speaking threat actor deploying a Babuk-derived ransomware strain that appends the extension ".babyk", alongside a custom backdoor and tooling built to erase its own tracks from compromised hosts.

What NHS England already knew

NHS England's National Cyber Security Operations Centre escalated its advisory on this flaw to High severity on 12 August, stating that "security researchers have observed exploitation of CVE-2026-59310 ... the NCSC assesses further exploitation as likely." That assessment has now been borne out. vCenter underpins a large share of UK healthcare and enterprise virtual infrastructure precisely because it's the management layer everything else depends on, which is exactly why it should never be one unauthenticated request away from code execution as root. The Secure by Design lesson isn't just "patch within days, not weeks", though that's true. It's that a component with root-equivalent power over an entire virtual estate has no business accepting untrusted network input in the first place, let alone building filesystem paths out of it. Segmenting management networks away from everything else isn't a nice-to-have for vCenter; it's the only thing standing between a directory traversal bug and a ransom note.

Also this week

Medusa's tally passes 500. The FBI, CISA and the US Department of Health and Human Services updated their joint advisory on the Medusa ransomware-as-a-service operation this week, putting its confirmed critical-infrastructure victim count above 500 since 2021, with healthcare disproportionately represented. The advisory's headline technique is one this post keeps returning to: Medusa affiliates weaponise newly disclosed vulnerabilities within 24 hours, and have used some up to a week before public disclosure. Medusa's leak site has already carried UK names, including Gateshead Council, hit for a $600,000 demand in January, and the care provider HCRG, hit for $2 million a month later. The agencies' top recommendation is the one above: patch fast, and segment harder.

An RMM tool's incomplete fix still reached managed customers. N-able shipped a fix for an authentication bypass in its N-central remote monitoring platform, then had to ship a second one after attackers used the first flaw's cousin to take over admin accounts and pivot into managed endpoints via the platform's own remote-control feature, persisting through Cloudflare tunnels even after credentials were revoked. N-central sits behind a lot of UK managed service providers; a hole in the tool is a hole in every customer it watches over.

AI coding agents leaked CI secrets through a GitHub issue. Researchers presenting at Black Hat showed that Gemini CLI and Claude Code could both be steered, via nothing more than an issue opened by an unprivileged account, into running commands on CI infrastructure and leaking secrets. Both vendors have shipped fixes (Gemini CLI 0.39.1, Claude Code 2.1.163); OpenAI's Codex remains unpatched, with the vendor maintaining its sandbox behaved as documented. The bugs lived not in the model but in the "harness", the code meant to enforce what the model is allowed to do. Any UK team that has wired these tools into a build pipeline should treat that as this week's patch too.

Sources

Working through what any of this means for your own systems? Get in touch.

The VMware vCenter flaw NHS escalated to high risk, now wearing a ransomware payload

A filing clerk that never checked the label

What NHS England already knew

Also this week

Sources

More like this