--- title: Zimbra RCE hits active exploitation, DigitalOcean... description: CISA gave federal agencies three days to patch a critical Zimbra RCE now under active attack, with over 12,000 exposed servers still sitting on the internet.... canonical: https://daily.dev/posts/zimbra-rce-hits-active-exploitation-digitalocean-patches-two-hypervisor-flaws-without-downtime-4db5cspkp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zimbra RCE hits active exploitation, DigitalOcean patches two hypervisor flaws without downtime | daily.dev og:description: CISA gave federal agencies three days to patch a critical Zimbra RCE now under active attack, with over 12,000 exposed servers still sitting on the internet.... og:url: https://daily.dev/posts/zimbra-rce-hits-active-exploitation-digitalocean-patches-two-hypervisor-flaws-without-downtime-4db5cspkp og:image: https://api.daily.dev/og/posts/4DB5cspkp.png og:image:alt: Zimbra RCE hits active exploitation, DigitalOcean patches two hypervisor flaws without downtime og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zimbra RCE hits active exploitation, DigitalOcean patches two hypervisor flaws without downtime **[Security Digest](https://daily.dev/sources/security_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary CISA gave federal agencies three days to patch a critical Zimbra RCE now under active attack, with over 12,000 exposed servers still sitting on the internet. DigitalOcean quietly pulled off two fleet-wide hypervisor patches back to back, including a same-day AMD Zen speculative-execution fix, with zero customer impact. A new paper shows encrypted reasoning traces from stateless LLM APIs can be extracted and transcribed by jailbreaking a weaker model, exposing hidden chain-of-thought. Elsewhere, an unpatched Calix router flaw lets attackers bypass NAT on ISP-issued hardware with no fix in sight, and Apollo Global Management confirmed a four-day breach tied to the same social-engineering campaign hitting Blackstone and Bain Capital. ## Content **TLDR:** CISA gave federal agencies three days to patch a critical Zimbra RCE now under active attack, with over 12,000 exposed servers still sitting on the internet. DigitalOcean quietly pulled off two fleet-wide hypervisor patches back to back, including a same-day AMD Zen speculative-execution fix, with zero customer impact. A new paper shows encrypted reasoning traces from stateless LLM APIs can be extracted and transcribed by jailbreaking a weaker model, exposing hidden chain-of-thought. Elsewhere, an unpatched Calix router flaw lets attackers bypass NAT on ISP-issued hardware with no fix in sight, and Apollo Global Management confirmed a four-day breach tied to the same social-engineering campaign hitting Blackstone and Bain Capital. --- ## CISA gives agencies three days on actively exploited Zimbra RCE CVE-2026-73570 lets an unauthenticated attacker trigger arbitrary command execution on Zimbra Collaboration Suite through crafted SMTP requests when SNMP monitoring is enabled. Zimbra patched it in 10.1.20 back in July, but CERT Polska caught active exploitation in mid-August, prompting CISA to add it to the KEV catalog with an August 24 deadline. Over 12,000 servers are still exposed, mostly in Europe and Asia, and Zimbra has a history of being targeted by APT28, APT29, and Winter Vivern. [Read more](https://daily.dev/posts/vveir6FjZ) ## DigitalOcean patches two hypervisor bugs fleet-wide, no downtime either time DigitalOcean fixed a KVM guest-to-host escape (Januscape, CVE-2026-53359) across its entire hypervisor fleet within eight days using livepatching. Three weeks later it faced an unpatchable AMD Zen 'Safe RET' speculative-execution flaw that required rebooting roughly 1,600 hypervisors across twelve regions, finishing a day before AMD's public bulletin using the automation built for the first incident. Both remediations reported zero confirmed customer impact. [Read more](https://daily.dev/posts/Enoi72tn8) ## Researchers show encrypted reasoning traces can be extracted and read back in plain text Stateless reasoning-model APIs return encrypted chain-of-thought blobs so providers don't have to store conversation state, but a new paper shows those blobs are portable across conversations, accounts, and even different models. An encrypted trace from a strong model like Opus 4.8 can be handed to a weaker, less safety-hardened model like Haiku 4.5 and jailbroken into transcribing the hidden reasoning, including content the stronger model had internally considered but refused to say out loud. Providers have reportedly patched this by binding encryption to the same model, user, and conversation. [Read more](https://daily.dev/posts/jSsImWzRJ) ## Unpatched Calix router flaw bypasses NAT on ISP-issued hardware CVE-2026-75501 exposes an unauthenticated MiniUPnPd endpoint on port 5000 on the WAN side of Calix GS7 XGS routers used by Cox, Brightspeed, ALLO, CityFibre, and Conexon. Attackers can create or delete port-forwarding rules remotely, exposing internal cameras, NAS boxes, and admin panels, and the malicious mappings survive reboots. The researcher couldn't reach Calix directly and reported through CERT/CC; no patch exists, so the only mitigation right now is disabling UPnP. [Read more](https://daily.dev/posts/Z0P1T7CVP) --- ## Also notable - **Apollo Global Management breach tied to helpdesk-impersonation campaign:** Hackers spent four days inside Apollo's cloud environment in early July stealing SSNs and personal data, part of a broader vishing campaign (Google's UNC6671) that has also hit Blackstone, Bridgewater, Bain Capital, Levi Strauss, and RingCentral, with ransoms reportedly as high as $750,000. [Read more](https://daily.dev/posts/eNxZlRoJC) - **miniOrange SSO auth bypass under active exploitation, 30,000 paid users left in the dark:** Chained CVEs CVE-2026-61979 and CVE-2026-15981 let attackers forge SAML responses and log in as WordPress admin; both were patched in July but the vendor's advisory only covered the free edition, so paid customers got no update warning in their dashboard. [Read more](https://daily.dev/posts/ayeDWsaYu) - **SharePoint RCE chain detailed down to the gadget:** CVE-2026-63520 lets an authenticated attacker instantiate arbitrary .NET types via unvalidated Type.GetType() calls in SharePoint's BDC subsystem, and chaining it with auth-bypass CVE-2026-55040 turns it into unauthenticated RCE. [Read more](https://daily.dev/posts/5LEsi7Ws4) - **ToxicPanda 2.0 now blinds Google Play Protect using VPN permissions:** The Android banking trojan expanded from 16 to 349 targeted apps across 16 countries and 167 remote commands, and abuses legitimate VPN permissions to cut a device off from Play Protect checks entirely. [Read more](https://daily.dev/posts/T3lAVmue5) - **Open VSX blocklist can't tell a cleaned-up extension ID from a malicious one:** Socket found 491 Open VSX extension IDs impersonating VS Code Marketplace publishers over the past year, and when legitimate owners reclaim IDs swept up in malware takedowns, the ID-only blocklist has no way to distinguish the old malicious release from the new legitimate one. [Read more](https://daily.dev/posts/P15vNTrGO) ## Similar posts on daily.dev - [CISA: Critical VMware RCE flaw now exploited by ransomware gangs](https://daily.dev/posts/cisa-critical-vmware-rce-flaw-now-exploited-by-ransomware-gangs-ofrnqjulv) · BleepingComputer · 1 upvotes · 0 comments - [Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact](https://daily.dev/posts/patching-at-fleet-scale-twice-how-digitalocean-closed-januscape-and-the-amd-safe-ret-issue-without-enoi72tn8) · DigitalOcean · 1 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#digitalocean](https://daily.dev/tags/digitalocean) [View this post on daily.dev](https://daily.dev/posts/zimbra-rce-hits-active-exploitation-digitalocean-patches-two-hypervisor-flaws-without-downtime-4db5cspkp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/zimbra-rce-hits-active-exploitation-digitalocean-patches-two-hypervisor-flaws-without-downtime-4db5cspkp","headline":"Zimbra RCE hits active exploitation, DigitalOcean patches two hypervisor flaws without downtime","text":"CISA gave federal agencies three days to patch a critical Zimbra RCE now under active attack, with over 12,000 exposed servers still sitting on the internet. DigitalOcean quietly pulled off two fleet-wide hypervisor patches back to back, including a same-day AMD Zen speculative-execution fix, with zero customer impact. A new paper shows encrypted reasoning traces from stateless LLM APIs can be extracted and transcribed by jailbreaking a weaker model, exposing hidden chain-of-thought. Elsewhere, an unpatched Calix router flaw lets attackers bypass NAT on ISP-issued hardware with no fix in sight, and Apollo Global Management confirmed a four-day breach tied to the same social-engineering campaign hitting Blackstone and Bain Capital.","url":"https://daily.dev/posts/zimbra-rce-hits-active-exploitation-digitalocean-patches-two-hypervisor-flaws-without-downtime-4db5cspkp","datePublished":"2026-08-25T04:17:47.427Z","dateModified":"2026-09-13T20:50:21.367Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"Zimbra RCE hits active exploitation, DigitalOcean patches two hypervisor flaws without downtime"}]} ```