[broadcom]

October 18, 2026

• Unauthenticated over-the-air RCE against Broadcom Wi-Fi chipsets was disclosed by Quentin Kaiser after his Hexacon talk — code execution on affected routers from radio range, no Wi-Fi password required (@thegrugq). · Vulnerabilities & Exploits

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants

July 30, 2026

• Broadcom patched critical VMware flaws including a vCenter authentication bypass (CVE-2026-59309), a Directory-Service/Syslog directory traversal (CVE-2026-59310), and an ESXi VM-escape enabling code execution on the host. No exploitation reported yet, but escape-class bugs warrant priority. The Hacker News, SecurityWeek · Vulnerabilities & Exploits

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius