Critical 'Ni8mare' Flaw Hits n8n; Chinese Hackers Wielded VMware Zero-Day for a Year

New research from Huntress details how Chinese state-sponsored actors exploited three VMware ESXi zero-day vulnerabilities, collectively named 'ESXicape' (CVE-2025-22224, -22225, -22226), to achieve VM escape and execute code on the hypervisor. These exploits were developed as early as February 2024, a year before patches were released in March 2025. The attack chain observed in December 2025 involved initial access via a compromised SonicWall VPN, followed by privilege escalation and deployment of the ESXi exploit toolkit. This allows for persistent control over virtual infrastructure, total data access, and potential for widespread sabotage or ransomware. Over 30,000 internet-exposed ESXi instances may still be vulnerable, significantly increasing the threat level.

ManageMyHealth (MMH) is facing significant backlash for its poor communication following the data breach. Affected patients have reported receiving slow, confusing, and contradictory notifications, with some even locked out of their accounts when attempting to secure them. This has led to widespread frustration and anger among the 125,000 affected individuals. The new report also reveals an anonymous tip about a potential exposure was sent to the Privacy Commissioner in June 2025, prior to the confirmed breach, suggesting earlier security concerns. MMH has declined to comment on the attacker's identity or ransom demands, further fueling public discontent and increasing the incident's overall negative impact.