Five days. That's how long it took.

Broadcom published security advisory VMSA-2026-0006 on July 29, 2026, disclosing two critical vulnerabilities in VMware vCenter Server. CVE-2026-59309 is an authentication bypass in the VMware Directory Service. CVE-2026-59310 is a directory traversal in the vCenter Syslog server. Both carry CVSS 9.8. Both are remotely exploitable by unauthenticated attackers with network access. Neither has a workaround.

By August 3, QUIRSO researchers identified the first compromised systems communicating with attacker-controlled command-and-control infrastructure. By August 5, 343 of the 361 total identified victims — 95 percent — had already been compromised. The attackers deployed reverse SSH tooling to establish persistent backdoors. The Hacker News reported the campaign on August 12. It is ongoing.

This is not a story about a bug. Bugs happen. This is a story about the infrastructure model that made the bug unpatchable for the people who needed to patch it most.

The Timeline

| Date | Event | |------|-------| | July 29 | Broadcom publishes VMSA-2026-0006 with patches | | August 3 | First compromised systems detected phoning home to C2 | | August 4 | 151 new victim IPs observed | | August 5 | 343 of 361 total victims compromised (95%) | | August 7 | Campaign confirmed across 47 countries | | August 12 | Public reporting confirms active exploitation |

Five days from patch to mass exploitation. If you run vCenter and you didn't patch within that window, you may already be compromised.

Why This Matters for Community Infrastructure

The audience for this site is not enterprise IT. It's fire halls, town offices, small organizations, community organizers — the people running infrastructure on budgets that don't include a 24/7 SOC. These are exactly the environments that Broadcom's VMware acquisition has hit hardest.

Since Broadcom acquired VMware in November 2023, the pattern has been consistent:

  • Killed the free tier. VMware ESXi Free was discontinued in February 2024. The hypervisor that let small organizations virtualize without a subscription is gone.
  • Raised prices. VMware subscription bundles replaced perpetual licenses. Customers who owned VMware outright were forced onto subscription pricing. For small organizations, the cost jumped from a one-time capital expense to a recurring operational cost that never ends.
  • Killed the partner ecosystem. Broadcom cut VMware resellers, limiting procurement channels for small customers who relied on local partners.
  • Now: a critical vulnerability with no workaround. If your Broadcom subscription lapsed — and many lapsed because of the price increases — you cannot patch. You are running a CVSS 9.8 RCE with no remediation path other than paying Broadcom.

This is the proprietary trap. The vendor controls the patch. The vendor controls the price of the patch. The vendor controls whether you're allowed to fix your own infrastructure. When the vendor's business model changes, your security posture changes with it — whether you like it or not.

What Open Source Looks Like Under the Same Pressure

Proxmox VE 9.2 shipped on May 21, 2026. It runs on Debian 13.5 with Linux kernel 7.0. It has a Dynamic Load Balancer for HA clusters, native WireGuard in the SDN stack, custom CPU models in the GUI, and full Arm64 support. It is AGPLv3 licensed. The source code is public. The no-subscription repository is free.

When a vulnerability is disclosed in Proxmox, the patch is published in the public repository. There is no subscription gate. There is no license check. There is no vendor deciding whether you're allowed to remediate. The security advisory and the fix arrive together, and anyone can apply them.

This is not theoretical. It is the platform we deploy for communities. It is what we run. When a CVE drops, the response is apt update && apt upgrade, not a phone call to a vendor account manager.

The argument for open-source infrastructure has always included auditability — you can read the code. But the argument that matters in moments like this is simpler: you can fix it. Without asking permission. Without paying a toll. Without waiting for a vendor whose business model has shifted away from you.

The Migration Math

If you're running vCenter 8.0, the patch is 8.0 U3k. If you're running vCenter 9.0, the patch is 9.0.2.0100. If you're running vCenter 9.1, the patch is 9.1.0.0300. Apply them now. This is not optional.

But the longer conversation is about the path off VMware entirely. The migration tooling exists. Proxmox publishes an official import tool (qm import for VMware disks, pvesm import for OVF/OVA). The community has documented the process extensively. The feature gap that kept people on VMware — DRS, HA, SDN — has been closed. Proxmox 9.2's Dynamic Load Balancer does what DRS does, without the subscription. WireGuard SDN does encrypted inter-site networking without a separate VPN layer.

For a 3-node community cluster — the deployment we build for fire halls and town offices — the comparison is stark:

| | VMware vSphere | Proxmox VE 9.2 | |---|---|---| | License | Broadcom subscription (recurring) | AGPLv3 (free, optional paid support) | | HA + Load Balancing | DRS (requires highest tier) | Dynamic Load Balancer (included) | | Encrypted SDN | NSX (add-on, complex) | WireGuard (integrated, simple) | | Patch access | Requires active subscription | Public repository, no gate | | Auditability | Closed source | Full source, AGPLv3 | | Cost for 3-node cluster | $10K+/year subscription | $0 or ~€300/year for enterprise repo |

The cost line is approximate and depends on your specific situation. The auditability line is not approximate. The patch access line is not approximate. Those are structural differences, not pricing tiers.

What to Do Today

  1. If you run vCenter: patch immediately. CVE-2026-59310 has no workaround. If your Broadcom subscription has lapsed, you need to have a hard conversation about why a vendor is gatekeeping a security fix for a CVSS 9.8 vulnerability.
  2. If you run vCenter and your subscription lapsed: you are in the worst position. You cannot patch. You should isolate vCenter from any network exposure immediately, including internal networks where lateral movement is possible. Then plan your migration.
  3. If you're already on Proxmox: this is the week to validate your backup strategy and confirm your cluster is healthy. The infrastructure you're running doesn't have this vulnerability. But it does have the same responsibility to stay patched — apt update && apt upgrade on a schedule.
  4. If you're deciding: the active exploitation of CVE-2026-59310 is a concrete data point in a decision that was already being made on cost and sovereignty grounds. A CVSS 9.8 with no workaround, actively exploited within five days, on a platform that gates the fix behind a subscription — that's not a risk calculation. It's a signal.

The Bigger Picture

The sovereignty argument is often abstract. Data residency. Jurisdiction. Vendor lock-in. These matter, but they're slow arguments. They take years to play out.

Security is the fast argument. It plays out in five days. It plays out when 361 systems across 47 countries get compromised because the patch was published on a Tuesday and the exploitation started on Saturday. It plays out when the people who needed the patch most couldn't get it because their subscription lapsed.

The case for sovereign, community-owned infrastructure has never been about open source being perfect. It's about open source being fixable. By you. On your timeline. Without a vendor's permission.

That difference is the whole argument. And this week, it's not theoretical.