vCenter's 9.8 flaw was exploited five days after disclosure.

Transcript

Broadcom disclosed this vCenter flaw on July twenty ninth. By August third, people were exploiting it. Five days. It's a path traversal in the vCenter Syslog server, rated nine point eight, and it needs no credentials at all. Just network access. There is no workaround. But here's the part that catches people out. German forensics firm Quirso found the real attack chain during incident response, and it doesn't stop at code execution. The attackers wrote a cron job for persistence, then opened an outbound channel back to their own infrastructure. Patching closes the way in. It does not delete a cron job that already exists. So two clocks are running: close the hole, and evict whoever already came through. Quirso counted three hundred sixty one victim hosts across forty seven countries. And enterprise virtualization does not patch in five days. Most of those victims weren't careless.