Posts Archives - Vali Cyber

The Problem with Patching: Why the Hypervisor Needs Runtime Security

A Record Year for CVEs Patching was built for a world that gave defenders time. Vulnerabilities were disclosed, vendors shipped fixes, and security teams had days or weeks to test and deploy them before attackers could act. That world no longer exists, and security...

CVE-2026-47876: Host Code Execution from a Guest VM, and the Control That Constrains It

A critical out-of-bounds write in the VMXNET3 virtual network adapter lets an attacker with local administrative privileges inside a guest VM execute code on the ESXi host. ZeroLock’s VMX Lockdown rule is designed to constrain that path. What...

AI-Assisted Ransomware Attack on ESX: Inside Aurora’s “Vibe Hacking” Campaign

Hacking ESX is as easy as 1, 2, 3. Literally. Between April 8 and May 21, 2026, an operator from the Aurora ransomware group worked through ten victim networks with help from an AI coding assistant. He typed instructions, and the AI worked out the commands, ran them,...

What Is a CVE? Common Vulnerabilities and Exposures Explained

CVE stands for Common Vulnerabilities and Exposures. In cybersecurity, a CVE is a public catalog entry for a known security flaw in software or hardware, and every entry gets a unique ID that looks like CVE-2021-44228. When someone says they’ve patched a CVE,...

Aurora: A Threat Profile

Aliases Tracked as Aurora or Aur0ra; no confirmed MITRE group designation or stable alternate operator name at the time of writing. Get Threat Intel and Security Updates Delivered to Your Inbox. Profiling Threat Actor Type: Financially motivated ransomware...

Vali Cyber Announces New Integration with CrowdStrike Falcon Next-Gen SIEM

NEW YORK – Fal.Con 2026 – AUGUST 31, 2026 – Vali Cyber today at Fal.Con 2026 announced a new integration with CrowdStrike that enables security data from ZeroLock® to flow into CrowdStrike Falcon® Next-Gen SIEM. The integration enables security teams to...