Broadcom published VMSA-2026-0006 on July 29 addressing five vulnerabilities across VMware ESXi, vCenter, Workstation, and Fusion. Three carry critical severity ratings. CVE-2026-59309, CVSS 9.8, is an authentication bypass in the VMware Directory Service used by vCenter Server. An attacker with network access to vCenter can bypass authentication and gain unauthorized access to the management platform with no credentials, no prior session, and no user interaction required. CVE-2026-59310, also CVSS 9.8, is a directory traversal vulnerability in vCenter that allows a separate unauthenticated code execution path for attackers with network access. CVE-2026-47876, CVSS 9.3, is an out-of-bounds write in ESXi's implementation of the VMXNET3 virtual network adapter. An attacker with local administrative privileges on a guest virtual machine can exploit it to execute arbitrary code on the underlying ESXi host, constituting a full VM escape. Broadcom explicitly states that there are no workarounds for CVE-2026-59309 or CVE-2026-59310 and recommends treating remediation as an emergency change. Fixed versions are vCenter Server 9.1.0.0300, 9.0.2.0100, and 8.0 U3k, and ESXi versions ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, and ESXi 8.0 U3k. VMware Cloud Foundation 5.x customers must follow the asynchronous patching process. No exploitation has been confirmed in the wild as of today, but vCenter has appeared on CISA KEV ten times previously, establishing a clear pattern of attacker interest in this product category. A fifth vulnerability in the advisory, CVE-2026-41709, allows an ESXi administrator to conduct certain operations without those actions being logged, rated low severity.

Between Sunday July 26 and Monday July 27, attackers hit operational technology systems at more than 30 Minnesota community water and wastewater utilities in what Minnesota IT Services described as a coordinated cyberattack. Four cities publicly confirmed the incident. In Braham, population approximately 1,700, the water plant went entirely offline after computerized operating controls were disrupted. Crews restored operations within roughly two hours. Plymouth, population approximately 80,000, reported cellular communication failures at two water towers and multiple wastewater lift stations and disconnected affected cellular-connected equipment to halt the spread. South St. Paul and Maple Plain maintained water service after automated utility controls were affected, with Maple Plain declaring a local state of emergency to support its response. By July 28, Minnesota IT Services confirmed the total affected count exceeded 30 communities. Minnesota officials described the attack as sharing characteristics with other coordinated cyberattacks on critical infrastructure that federal partners have observed. No specific access method, vulnerability, or industrial control system family has been publicly identified as the attack vector. CISA, the FBI, the EPA, the Minnesota Department of Public Safety, the Minnesota Department of Health, and the Minnesota Pollution Control Agency are all participating in the investigation and response. Water quality was not affected at any reported utility, and no communities have been asked to change their water use as of today.

Mozilla shipped Firefox 151.0.3 on July 28 to patch CVE-2026-10702, a use-after-free vulnerability in the Firefox just-in-time JavaScript compiler discovered and reported by Eten Zou, CEO of Nebula Security. The flaw allows arbitrary code execution inside the browser's renderer process when a user visits a page serving a crafted exploit. No user settings are required, no click is needed beyond the initial navigation, and no browser extensions are involved. The renderer process is sandboxed, meaning code execution stays within the renderer without automatically escaping to the operating system. However, renderer-level code execution is the standard precursor to sandbox escape chains in browser exploitation: the attacker controls the renderer's memory and can attempt to reach the OS through a subsequent privilege escalation. Nebula Security confirmed the same flaw was used to compromise Tor Browser, which is based on Firefox ESR. Tor Browser users are at elevated risk because the anonymity guarantees of Tor depend on the browser not leaking information or executing attacker code, and a renderer compromise can be used to fingerprint or deanonymize a user even without a full OS-level escape. Firefox ESR 128.23 and 115.36 are also patched. Mozilla confirmed in-the-wild exploitation before the patch was published. Chrome and Safari users are not affected by this specific flaw.