Saturday the engineers went out in Downtown SF. These are the best people I have ever worked with. We are all really smart and we work hard, but we also play hard, and it is always a blast with these guys in and out of the office. That is what makes this team so special.
That trust between one another is how DeepTempo is going to win at detection. You only get a model that actually sees the wire if the people building it trust each other enough to go deep.
This week's attackers went after a different kind of trust. The internet facing control planes companies already live inside.
Branch61G Weekly. Here is what actually hit over the past seven days.
China nexus crew turns vCenter into a root shell, then a smokescreen
The most pressing control plane story this week is Broadcom VMware vCenter. CVE-2026-59310, CVSS 9.8. Directory traversal in the vCenter Syslog server. Unauthenticated, network reachable, code execution as root on the appliance. Broadcom shipped the emergency patch on July 29. QUIRSO watched compromises start talking to attacker infrastructure on August 3, five days later. By August 7 they had 361 victim IPs across 47 countries. Germany, the United States, Turkey, Iran, and France took the heaviest hits.
QUIRSO puts moderate confidence on a Chinese speaking operator working China time zone hours. Chinese language artifacts in the scripts. Chinese management tools. Victimology that skips mainland China. On at least one vCenter Server Appliance they also saw scanning and account creation consistent with CVE-2026-59309, an authentication bypass in vmdir, including a fake VMware Fleet user agent and a new vcenter_admin identity. QUIRSO says that thread did not overlap with the CVE-2026-59310 chain that actually owned the box.
The syslog bug is the one that finished the job. The actor dropped a malformed cron file named like a remote syslog, zz-poc59310-syslog.log, under /etc/cron.d. Cron executed at least one of those files and pulled a backdoor QUIRSO calls linuxFile from 5.34.177[.]38 on port 9861. linuxFile opens a WebSocket to intel.se9ly9upbhay.shop, runs commands through /bin/sh, XOR hides its controller address, and persists through systemd and cron. From there the operator ran a second play that looks like VMware itself. Cron jobs impersonating vmware-vpxd-stats, vmware-perf-collect, and vmware-perf-sync. An SSH public key into authorized_keys. A JSP webshell named vmware-perf-update.jsp. Passwordless sudo for the perfcharts service account. Stolen vmdir machine credentials. New SSO admins named adminuser and vcadmin. Local accounts on the ESXi hosts underneath.
Then they pulled esxi.sh and a reverse SSH binary from the same infrastructure. Outbound C2. No inbound hole required. On the box QUIRSO fully worked, the last move was a Babuk derived locker that writes .babyk on ESXi. QUIRSO treats that encryptor as a smokescreen, locking the logs so the rest of the intrusion is harder to reconstruct. Later in the week the same operator stood up a GitHub repo, pikpak0066/tmpclean, that looks like a Go /tmp cleaner and quietly ships more reverse SSH builds.
The dodge is appliance legitimacy. vCenter is supposed to talk to ESXi, run cron, open SSH, and wear VMware process names. An EDR agent watching a guest VM never sees root on the appliance. A playbook waiting for a ransomware family name is late, and it may be chasing the decoy. The tell on the wire is a vCenter box that suddenly holds a WebSocket C2, an outbound reverse SSH tunnel, brand new admin identities, and then ESXi encryption.
And in a separate incident, the control plane under fire was not the hypervisor. It was the commerce stack that runs the store.
SAP Commerce Cloud, CVSS 10.0, hunted three days after the patch
CVE-2026-58231 is a 10.0 in SAP Commerce Cloud's Data Hub Adapter. Unauthenticated attacker, default authentication client, weak authorization and input checks, arbitrary code execution, internal components in reach. SAP patched it in the August release. Defused Cyber's honeypots started eating exploitation attempts three days later. There is still no public proof of concept. KEVIntel saw two attempts on August 14 from a single U.S. IP. Onapsis says you patch, rebuild, and redeploy, or you IP filter the exposed endpoint until you can.
Nobody has named this week's shooter. The history on this control plane is loud anyway. Prior SAP bugs, including CVE-2025-31324 on NetWeaver, were run by China nexus clusters UNC5221, UNC5174, and CL-STA-0048, and by ransomware crews BianLian and RansomExx. In April 2025, unknown operators used that older SAP hole to drop the Auto-Color backdoor on a U.S. chemicals company. When a default client on an internet facing commerce plane goes CVSS 10, that crowd shows up fast, even before a writeup exists.
The dodge is "commerce traffic." A default auth client submitting input to a Data Hub function can look like the application doing its job. Signature packs have nothing to match when there is no public PoC and no malware family yet. The miss is treating the first request as business as usual while someone is already in a position to run code inside the store.
Different attack, same week, and the control plane this time was the map server sitting on top of the database.
GeoServer SQLi, probed within hours, RCE when PostGIS is too trusted
A researcher posting as q1uf3ng dropped an unauthorized SQL injection in GeoServer on August 12. jsonArrayContains in the GeoTools PostGIS datastore writes a user value into generated SQL with no escaping. watchTowr saw hundreds of exploitation attempts within hours, from a small pool of IPs. Early traffic was reconnaissance. Trigger the error, map who is vulnerable, do not always continue. Jake Knott at watchTowr said that pause will not last. GeoServer already has multiple entries in CISA KEV. In 2024, CVE-2024-36401 was run at scale to turn boxes into DDoS nodes, miners, and residential proxies.
Hadrian later filled in the rest of the chain. The bad value rides in over HTTP, lands in a PostgreSQL jsonb_path_exists() expression, and with WFS 1.0 you can get a second statement executed at the top of the query. If GeoServer's database user is superuser, or holds pg_execute_server_program, that becomes OS command execution on the database host. Without those privileges you still read whatever that database user can see. Maintainers called it a regression of CVE-2023-25158. Fixes are in GeoServer 3.0.1, 2.28.5, and 2.27.6. Until those builds are on the box, the map server is a public query API sitting on the crown jewels.
The dodge is GIS hygiene. WFS filters are what this product is for. A SIEM that only alerts on a CVE string had nothing for hours after disclosure. A playbook waiting for miner telemetry is watching the 2024 ending, not this week's probing. The tell is a sudden, tight burst of identical filter errors from a handful of IPs, then any follow on reach from that GeoServer into a database host it never used that way.
Three control planes in and the fourth is the product lifecycle system that holds the drawings.
Clop walks PTC Windchill and FlexPLM, then puts GE, Philips, and Shell on the leak site
Clop listed a batch of 43 new names this week. General Electric said it is assessing the claim. Philips said a specific enterprise server holding internal data was hit, contained, and kept away from customer environments. Shell is investigating a claimed 89GB. ReliaQuest and Ransom-ISAC have already confirmed the vector. Clop is stealing through internet exposed PTC Windchill and FlexPLM, CVE-2026-12569, improper input validation, then dropping JSP webshells and pulling data out of the PLM. PTC says more than 30,000 customers sit on these products, including aerospace, defense, automotive, heavy machinery, retail, and medtech. The haul Clop is advertising is the kind of material a PLM actually holds. Backups, project plans, facility photos, drawings, diagrams, blueprints.
PTC started shipping patches on June 17 and told customers to hunt for compromise even before public exploitation was confirmed. CISA put the bug in KEV and gave federal agencies three days. Germany's BSI woke people up in the middle of the night. Clop has run this exact movie before on Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U, Cleo, MOVEit Transfer, and Oracle EBS. MOVEit alone hit more than 2,770 organizations. The U.S. State Department still has a $10 million reward out for information tying this crew to a foreign government.
The dodge is product traffic on a system that is supposed to move files. A JSP dropped on Windchill can look like a vendor page. Bulk export of drawings can look like an engineer doing their job if the only question the stack asks is whether the session eventually authenticated. The leak site is the late signal. The early one is a PLM that starts staging and shipping the archive.
What this week means
vCenter, SAP Commerce, GeoServer, PTC PLM. Four separate incidents. The same shape underneath. Attackers keep choosing the internet facing box that already runs the estate. Hypervisor brain, store backend, map server, product lifecycle system. Trust is thickest there. Visibility is thinnest. After the first hit, the rest looks like cron, a default client, a map filter, or a PLM download.
Saturday is the other half of why we win. This team trusts each other enough to build for that layer instead of waiting on a named playbook. Detections stay broken for attacks that do not match one. DeepTempo is already part of the change. LogLM is a foundation model built as an encoder on network metadata. It learns normal deeply enough that a genuine deviation is legible on its own, with no prewritten signature for that CVE or appliance family required first.
Walk those four back through the wire. On vCenter, linuxFile's WebSocket C2 and the reverse SSH outbound tunnel sit outside a healthy appliance baseline even if the first syslog traversal is thin in netflow. New SSO admins, ESXi account creation, and a .babyk encryptor are recon, C2, and ransomware on the completion path LogLM is built for. On SAP Commerce, the default client request may look like app traffic, but a completed campaign still needs recon, C2, or data leaving that commerce plane, and that is where the model wins. On GeoServer, a tight probe burst against WFS from a handful of IPs is recon at a cadence no map user produces. If they convert that SQLi into command execution on the PostGIS host, the follow on C2 or export is the same behavioral grammar. On Clop, JSP webshell callbacks plus bulk drawings, backups, and blueprints leaving Windchill or FlexPLM are exfiltration, independent of whether CVE-2026-12569 had a signature pack yet.
That is the generalizability. New control plane, same grammar underneath it. DeepTempo's LogLM catches what the rulebook has never named yet. That is how this team wins.
AI SOCs are only as good as the detections that feed them. When a zero day or a novel sequence slips past those detections, the rest of the stack has nothing left to reason over.
The crew I would go downtown with is the reason we can watch that layer. Branch61G keeps reading the control plane.
Sources for this week include The Hacker News and BleepingComputer coverage of the VMware vCenter CVE-2026-59310 campaign reported by QUIRSO, The Hacker News on SAP Commerce Cloud CVE-2026-58231 exploitation attempts, The Hacker News on the GeoServer jsonArrayContains SQL injection and watchTowr's probing telemetry, and BleepingComputer reporting on Clop's PTC Windchill and FlexPLM theft claims against GE, Philips, and Shell.
