Hack The Sec-Leading Resource Of Linux Tutorial

Proxmox VE vs VMware ESXi: Complete Install Guide (Bare Metal, Step-by-Step)

noreply@blogger.com (Raj) — Sun, 23 Aug 2026 23:29:49 +0530

This long-form guide covers two enterprise hypervisors side by side: Proxmox VE (open-source, KVM + LXC) and VMware ESXi (commercial, vSphere hypervisor). You will install both from bare metal, verify each web interface, create your first VM, and understand when to choose which platform.

Part A — Proxmox VE installation (bare metal)

A1. Requirements

64-bit CPU with VT-x/AMD-V enabled in BIOS
8 GB RAM minimum (16 GB+ for lab with multiple VMs)
32 GB+ boot disk (120 GB SSD recommended)
Static IP for management interface
Proxmox VE 9.x ISO from proxmox.com/downloads

A2. Create bootable USB

# On Linux workstation — flash ISO to USB
lsblk
sudo dd if=proxmox-ve_9.0-1.iso of=/dev/sdX bs=4M status=progress conv=fsync
# Or use Ventoy / Rufus / balenaEtcher on Windows

A3. Boot and start graphical installer

Insert USB, boot server, press F11/F12 for boot menu.
Select Install Proxmox VE (Graphical).
Accept EULA → select target disk (ext4 or ZFS).
Set country, timezone, keyboard.
Set root password and email for alerts.
Configure management network: hostname pve1.lab.local, IP 192.168.1.50/24, gateway, DNS.
Review summary → Install → reboot.

Installer console output (typical):

Starting Proxmox VE installer...
Formatting /dev/nvme0n1p2 ext4...
Installing base system packages...
Installing Proxmox VE packages (pve-manager, qemu, lxc)...
Configuring network vmbr0 on eno1...
Installation completed — rebooting.

A4. First login to Proxmox web UI

# From browser
https://192.168.1.50:8006
# Login: root / your-install-password
# Realm: Linux PAM standard authentication

# From SSH — verify version
ssh root@192.168.1.50
pveversion -v
systemctl status pveproxy pvedaemon pve-cluster

Expected pveversion output:

pve-manager/9.0.3/bc4f547a (running kernel: 6.8.12-1-pve)
qemu-server: 9.0.3
pve-qemu-kvm: 9.0.2-1

A5. Post-install Proxmox configuration

# Update repositories and upgrade
apt update && apt full-upgrade -y

# Disable enterprise repo if no subscription (lab only)
# Use pve-no-subscription repo per Proxmox wiki

# Download Ubuntu cloud-init template for CT/VM
pveam update
pveam available | grep ubuntu
pveam download local ubuntu-22.04-standard_22.04-1_amd64.tar.zst

# Check node status
pvesh get /nodes/pve1/status

A6. Create first VM in Proxmox

Datacenter → pve1 → Create VM.
General: VM ID 100, name ubuntu-web.
OS: ISO image (upload Ubuntu ISO to local storage first).
System: default BIOS, Q35 machine type.
Disks: 32 GB on local-lvm.
CPU: 2 cores, RAM: 2048 MB.
Network: vmbr0, virtio model.
Finish → Start VM → Open console.

# CLI create + start VM
qm create 100 --name ubuntu-web --memory 2048 --cores 2 \
  --net0 virtio,bridge=vmbr0 --scsi0 local-lvm:32
qm set 100 --cdrom local:iso/ubuntu-22.04.iso
qm start 100
qm list

Part B — VMware ESXi installation (bare metal)

B1. Requirements and licensing

Server on VMware HCL (Hardware Compatibility List)
ESXi 8.x ISO from Broadcom/VMware portal (free tier or vSphere license)
8 GB RAM minimum, 32 GB boot USB/SD or local disk
Management IP on dedicated VLAN recommended

B2. Boot ESXi installer

Flash ESXi ISO to USB, boot server.
Select ESXi-8.x Standard Installer.
Enter (Continue) through welcome → Accept EULA.
Select install disk (local SSD — all data will be erased).
Select keyboard layout.
Set root password (complexity required).
Confirm install → Reboot.

ESXi installer log on screen (DCUI):

VMware ESXi 8.0.2 Installation
Reading installation image...
Creating VMFS datastore 'datastore1' on Local NVMe...
Installing hypervisor binaries...
Installation successful. Please reboot.

B3. Configure ESXi management network (DCUI)

After reboot, press F2 on Direct Console UI.
Login as root.
Configure Management Network → IPv4 → Static.
IP: 192.168.1.60, Mask: 255.255.255.0, Gateway: 192.168.1.1
DNS: 8.8.8.8, Hostname: esxi1.lab.local
Test management network → working.

# From SSH (after enabling SSH in DCUI → Troubleshooting)
ssh root@192.168.1.60
vmware -v
esxcli system version get
esxcli network ip interface ipv4 get

Expected output:

VMware ESXi 8.0.2 build-22380479
   Product: VMware ESXi
   Version: 8.0.2
   Build: Releasebuild-22380479
   Update: 2

B4. Access ESXi Host Client (web UI)

# Browser
https://192.168.1.60/ui
# Login: root / password
# Create datastore, upload ISO, create VM from GUI

B5. Create first VM on ESXi

Host Client → Virtual Machines → Create VM.
Name: ubuntu-web-esxi, Compatibility: ESXi 8.x.
Guest OS: Linux → Ubuntu 64-bit.
Datastore: datastore1, 32 GB thin disk.
2 vCPU, 2 GB RAM, VMXNET3 network.
Mount Ubuntu ISO from datastore browser.
Power on → Open console → install OS.

# Useful ESXi CLI commands
esxcli vm process list
vim-cmd vmsvc/getallvms
esxcli storage filesystem list
esxcli system maintenanceMode set --enable true   # before major changes
esxcli system maintenanceMode set --enable false

Part C — Proxmox vs VMware: comparison

Feature	Proxmox VE	VMware ESXi
License	Open source + optional subscription	Commercial (free tier limited since Broadcom acquisition)
Web UI port	8006 (HTTPS)	443 / Host Client at /ui
Containers	Native LXC	Not native (VMs only)
Clustering	Built-in corosync cluster	Requires vCenter for multi-host
Backup	vzdump + Proxmox Backup Server	vSphere APIs / Veeam / image-level
Storage	ZFS, LVM, Ceph, NFS, iSCSI	VMFS, NFS, vSAN (with vSphere)
Best for	Homelab, MSPs, cost-sensitive hosting	Enterprise DC, existing VMware stack

Part D — When to choose which

Choose Proxmox VE when you want open-source KVM, LXC containers, integrated backups, ZFS/Ceph, and no per-socket licensing. Ideal for homelab, hosting providers, and Linux-first teams.

Choose VMware ESXi when your organization already runs vSphere, needs official enterprise support, vMotion with vCenter, or compliance mandates for VMware-only stacks.

Part E — Side-by-side verification checklist

# === Proxmox (192.168.1.50) ===
pveversion
pvesm status
qm list
pct list
journalctl -u pveproxy --since today | tail -20

# === ESXi (192.168.1.60) ===
vmware -v
esxcli hardware platform get
esxcli vm process list
grep -i error /var/log/vmkernel.log | tail -10
grep -i error /var/log/hostd.log | tail -10

Part F — Common issues

Proxmox

Cannot access :8006 — check systemctl status pveproxy, firewall, and certificate.
No subscription nag — expected without license; use no-subscription repo for lab.
VM won't start — enable VT-x in BIOS; check journalctl -u qmeventd.

VMware ESXi

Installer doesn't see NIC — inject VIB driver or use supported HCL hardware.
License warning — assign license in Host Client → Manage → Licensing.
Datastore full — esxcli storage vmfs extent list and expand or add disk.

You now know how to install and verify both Proxmox VE and VMware ESXi from scratch. For production, add backup (PBS or vzdump / Veeam), monitoring, and cluster planning before migrating workloads.

How To Install cPanel / WHM on AlmaLinux 9 (Complete Step-by-Step Guide)

noreply@blogger.com (Raj) — Sun, 23 Aug 2026 23:29:36 +0530

This is a complete, production-style guide to install cPanel & WHM on a fresh AlmaLinux 9 VPS or dedicated server. You will prepare the OS, run the official installer, read the real install logs, finish the WHM setup wizard, and verify Apache, MySQL, and the first cPanel account.

Time required: 45–90 minutes (installer download + compile). License: cPanel requires a paid license — trial available for new IPs.

Server requirements
Pre-install checklist (hostname, DNS, firewall)
Prepare AlmaLinux 9
Download and run the cPanel installer
Monitor cPanel install logs (what each stage means)
First WHM login and initial setup wizard
Create your first cPanel account
Post-install hardening and verification
Common install errors and log fixes

1. Server requirements

OS: AlmaLinux 9 / Rocky Linux 9 / CloudLinux 9 (64-bit)
RAM: Minimum 2 GB (4 GB+ recommended for production)
Disk: 20 GB minimum (40 GB+ for mail and backups)
CPU: 1 core minimum (2+ for shared hosting)
Network: Static IPv4, resolvable hostname (FQDN)
Ports: 22, 53, 80, 443, 2083, 2087, 2089, 3306 (see full list in WHM docs)

2. Pre-install checklist

cPanel is picky about hostname and DNS. Fix these before running the installer.

# Set FQDN hostname (replace with your domain)
hostnamectl set-hostname server1.example.com
hostname -f

# /etc/hosts must resolve the FQDN to your server IP
cat <<'EOF' | sudo tee -a /etc/hosts
203.0.113.10   server1.example.com server1
EOF

# Verify forward + reverse DNS (PTR) with your provider
dig +short server1.example.com
dig +short -x 203.0.113.10

Do not install Apache, Nginx, MySQL, or PHP before cPanel — the installer manages the full stack and will conflict with pre-installed packages.

3. Prepare AlmaLinux 9

# Update base OS
sudo dnf update -y
sudo dnf install -y curl wget perl

# Disable AlmaLinux firewall during install (re-enable after WHM config)
sudo systemctl stop firewalld
sudo systemctl disable firewalld

# Disable SELinux enforcement (cPanel sets this; required on fresh install)
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# Optional: disable NetworkManager if your provider requires static config
# cPanel documents both NM and sysconfig — keep NM if unsure
sudo timedatectl set-timezone Asia/Kolkata

4. Download and run the cPanel installer

Run as root from /home using the official cPanel bootstrap script:

cd /home
curl -o latest -L https://securedownloads.cpanel.net/latest
ls -lh latest
sh latest

Expected first output from the installer:

Verifying archive integrity... OK
Uncompressing cPanel & WHM Installer..................
Beginning main installation.
Started installation process. Log file: /var/cpanel/logs/install_log

The installer runs in the foreground for 45–90 minutes. Keep your SSH session open. Use a second terminal to watch logs (next section).

5. Monitor cPanel install logs

Primary log file during installation:

tail -f /var/cpanel/logs/install_log

Sample realistic install_log output (stages you should recognize):

[2026-08-23 18:04:12 +0530] Preparing system for cPanel & WHM installation...
[2026-08-23 18:04:15 +0530] Ensuring required Perl modules are installed...
[2026-08-23 18:04:22 +0530] Checking for existing web/mail/sql services... OK
[2026-08-23 18:05:01 +0530] Disabling conflicting services (httpd, mysqld if present)...
[2026-08-23 18:12:44 +0530] Installing cPanel layer 1...
[2026-08-23 18:28:33 +0530] Installing MySQL/MariaDB server...
[2026-08-23 18:45:02 +0530] Installing Apache (EasyApache build starting)...
[2026-08-23 19:02:18 +0530] Installing PHP handlers and extensions...
[2026-08-23 19:31:55 +0530] Installing Exim mail server...
[2026-08-23 19:48:07 +0530] Installing Dovecot (IMAP/POP3)...
[2026-08-23 20:05:44 +0530] Installing BIND/named (DNS)...
[2026-08-23 20:15:33 +0530] Installing WHM interface...
[2026-08-23 20:22:11 +0530] cPanel & WHM installation complete.
[2026-08-23 20:22:12 +0530] Access WHM: https://203.0.113.10:2087
[2026-08-23 20:22:12 +0530] Access cPanel: https://203.0.113.10:2083

Other useful log files during and after install:

# Main install progress
less /var/cpanel/logs/install_log

# EasyApache / web stack build
tail -f /var/cpanel/logs/easyapache/build_log

# General cPanel errors after install
tail -f /usr/local/cpanel/logs/error_log

# Apache error log (post-install debugging)
tail -f /usr/local/apache/logs/error_log

# MySQL/MariaDB
tail -f /var/lib/mysql/*.err 2>/dev/null || journalctl -u mariadb -f

6. First WHM login and initial setup wizard

Open https://YOUR_SERVER_IP:2087 in a browser.
Log in as root with your server root password.
Accept the End User License Agreement (EULA).
Enter contact email for server alerts.
Configure nameservers (e.g. ns1.example.com, ns2.example.com).
Set hosting plan defaults (disk, bandwidth, mail limits).
Enable/disable optional services (FTP, cPHulk brute-force protection).
Finish wizard — WHM dashboard loads at port 2087.

# Verify WHM/cPanel services after wizard
/usr/local/cpanel/scripts/check_cpanel_rpms --all
whmapi1 system_info
systemctl status cpanel
systemctl status httpd
systemctl status mariadb

Expected healthy service check:

[root@server1 ~]# systemctl status cpanel --no-pager
● cpanel.service - cPanel services
   Active: active (running)

[root@server1 ~]# /usr/local/cpanel/bin/whmapi1 version
  version: 126.0.1
  build: 126.0.1_12345

7. Create your first cPanel account

In WHM: Home → Account Functions → Create a New Account

Domain: clientdomain.com
Username: client1
Password: strong password
Package: default or custom hosting plan
Mail routing: Local Mail Exchanger

# CLI alternative — create account from WHM API
whmapi1 createacct username=client1 domain=clientdomain.com password='StrongPass123!' plan=default

User logs in at https://203.0.113.10:2083 or https://clientdomain.com:2083 after DNS points to the server.

8. Post-install hardening and verification

# Enable CSF firewall (if installed via WHM) or configure firewalld rules
# WHM → Plugins → ConfigServer Security & Firewall

# Force SSL for WHM/cPanel
whmapi1 set_tweaksetting key=requiressl value=1

# Verify open ports
ss -tlnp | grep -E '2083|2087|80|443|53|25|587'

# Test Apache vhost
curl -Ik https://clientdomain.com

# AutoSSL (Let's Encrypt) — WHM → SSL/TLS → Manage AutoSSL

9. Common install errors and log fixes

Log message / symptom	Fix
`hostname: Name or service not known`	Fix FQDN in `/etc/hosts` and provider PTR record
`Port 53 already in use`	Stop systemd-resolved or bind conflict: `systemctl stop systemd-resolved`
`Insufficient memory` in install_log	Upgrade to 4 GB RAM or add swap: `fallocate -l 4G /swapfile && mkswap /swapfile`
Install hangs at MySQL stage	Check `/var/lib/mysql/.err`; remove partial install: `rm -rf /var/lib/mysql/` and re-run installer only if cPanel support advises
`License expired` on WHM login	Activate trial/paid license at manage2.cpanel.net; run `/usr/local/cpanel/cpkeyclt`

# Refresh cPanel license if WHM shows license error
/usr/local/cpanel/cpkeyclt

# Re-run check after any failed stage
grep -i error /var/cpanel/logs/install_log | tail -20
grep -i fail /usr/local/cpanel/logs/error_log | tail -20

Quick reference — important paths

Install log: /var/cpanel/logs/install_log
WHM error log: /usr/local/cpanel/logs/error_log
Apache config: /usr/local/apache/conf/httpd.conf
User web roots: /home/USERNAME/public_html
WHM URL: https://IP:2087
cPanel URL: https://IP:2083

You now have a fully working cPanel / WHM server on AlmaLinux 9. Next steps: configure backups in WHM, set up AutoSSL, and create hosting packages before onboarding client accounts.

[HIGH PRIORITY] Ray Project Code Injection RCE (CVE-2025-62593)

noreply@blogger.com (Raj) — Sat, 22 Aug 2026 18:21:07 +0530

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2025-62593 is a code-injection flaw in Ray-Project Ray (Python distributed computing framework). Attackers exploit browser-based DNS-rebinding against developer Ray dashboards to run arbitrary code on Linux ML training hosts — linked to ShadowRay 2.0 campaigns.

Affected Ray

Ray versions before 2.52.0
Ray clusters with dashboard bound to 0.0.0.0 on port 8265
GPU/ML dev servers on Linux (Ubuntu, RHEL) running Ray for training jobs

Check version

pip show ray | grep Version
ray --version
ss -tlnp | grep 8265
curl -s http://127.0.0.1:8265/ | head -5

Patching Method

Upgrade Ray: pip install 'ray>=2.52.0' in every virtualenv and container image.
Rebuild Docker images pinning ray==2.52.0 or later in requirements.
Restart Ray head and worker nodes after upgrade.
Bind dashboard to localhost only: ray start --dashboard-host=127.0.0.1.
Firewall port 8265 — never expose Ray dashboard to internet.
Audit ~/.ray and job logs for unauthorized job submissions.
Rotate cloud API keys stored in Ray job environment variables.

pip install 'ray>=2.52.0' --upgrade
ray stop && ray start --head --dashboard-host=127.0.0.1

Until patched

Stop Ray cluster if dashboard is internet-accessible
Use SSH tunnel for dashboard access instead of public binding
Segment ML dev VLAN from production networks

CVSS: Critical. CISA deadline: 20 Aug 2026 for federal agencies.

[HIGH PRIORITY] macOS Screen Sharing Auth Bypass (CVE-2026-65400)

noreply@blogger.com (Raj) — Sat, 22 Aug 2026 18:20:54 +0530

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-65400 is an improper-authentication flaw in macOS built-in Screen Sharing. Attackers on the local network log in without valid credentials — Dutch NCSC confirmed active exploitation including root access and cryptominer deployment.

Affected macOS

macOS versions before Apple's August 2026 security update
Macs with Screen Sharing or Remote Management enabled in System Settings
Developer workstations and design Macs on office LAN or home Wi-Fi

Check exposure

sudo systemsetup -getremotelogin
sudo launchctl list | grep -i screensharing
defaults read /Library/Preferences/com.apple.RemoteManagement 2>/dev/null

Patching Method

Install macOS security update via System Settings → General → Software Update.
Reboot Mac after update completes.
Confirm macOS build matches Apple security advisory fixed versions.
Disable Screen Sharing if not required: System Settings → General → Sharing.
Review /var/log/system.log for Screen Sharing login events from unknown IPs.
Rotate local admin and FileVault recovery keys if Mac was on untrusted network.
Run EDR/AV scan for Monero miners or persistence agents.

sw_vers
log show --predicate 'process == "screensharingd"' --last 7d | tail -30

Until patched

Turn off Screen Sharing and Remote Management immediately
Enable macOS firewall — block all incoming connections
Do not connect Mac to public Wi-Fi with sharing enabled

CVSS: up to 9.8 Critical. Exploitation confirmed within days of disclosure.

[HIGH PRIORITY] Microsoft SharePoint Authentication Bypass (CVE-2026-55040)

noreply@blogger.com (Raj) — Sat, 22 Aug 2026 18:20:41 +0530

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-55040 is a weak-authentication flaw in Microsoft SharePoint Server. Remote attackers bypass security features and authentication over the network — enabling unauthorized access to sites, document libraries, and potentially code execution via malicious web parts.

Affected SharePoint

SharePoint Server subscription editions listed in Microsoft security guide
On-premises SharePoint exposed on ports 443/80
Hybrid deployments with on-prem SharePoint still serving content

Verify build

Get-SPFarm | Select BuildVersion
(Get-SPServer).Version
curl -sk https://sharepoint.corp/_layouts/15/viewlsts.aspx | head -5

Patching Method

Download SharePoint security update from Microsoft Update Catalog.
Run Microsoft SharePoint Products Configuration Wizard after patch install.
Apply patch to all WFE and app servers in the farm — same maintenance window.
Verify farm version in Central Administration → Upgrade Status.
Review IIS and ULS logs for anomalous authentication from external IPs.
Reset farm service account passwords if exploitation suspected.
Enable SharePoint audit logging for site collection admin changes.

Get-SPProduct -All | Where-Object {$_.Patchable -eq $true}
Merge-SPLogFile -Path C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\LOGS

Until patched

Restrict SharePoint to VPN or internal network only
Enable WAF rules blocking known SharePoint exploit paths
Disable anonymous access and unused site collections

CVSS: 9.1 Critical. Federal remediation deadline: 21 Aug 2026.

[HIGH PRIORITY] Windows IKE Service Double-Free RCE (CVE-2026-33824)

noreply@blogger.com (Raj) — Sat, 22 Aug 2026 18:20:27 +0530

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-33824 is a double-free memory corruption bug in Microsoft Windows Internet Key Exchange (IKE) Service Extensions. Unauthenticated remote attackers send crafted UDP packets to achieve remote code execution — no user interaction required.

Affected systems

Windows Server and Windows client builds listed in Microsoft MSRC advisory
Systems with IKE and AuthIP IPsec Keying Modules service running
VPN gateways, domain controllers, and edge Windows servers on UDP 500/4500

Check exposure

Get-Service IKEEXT | Select Name, Status, StartType
Get-WindowsFeature RemoteAccess | Select InstallState
netstat -an | findstr ":500 :4500"

Patching Method

Install August 2026 (or later) cumulative Windows security update from WSUS/Intune.
Reboot server after patch — IKEEXT service restart alone is insufficient.
Confirm KB number matches Microsoft advisory for CVE-2026-33824.
On Linux-managed fleets: patch Windows VMs via WSUS or SCCM maintenance window.
Review Windows Event Log (System) for IKEEXT crashes before patch date.
Block UDP 500/4500 at perimeter firewall for non-VPN hosts as defense-in-depth.

systeminfo | findstr KB
Get-HotFix | Sort-Object InstalledOn -Descending | Select -First 5

Workaround (temporary)

Disable IKEEXT service only if IPsec/VPN is not required on that host
Restrict UDP 500/4500 to known VPN peer IPs at firewall
Prioritize internet-facing and domain-joined servers first

CVSS: 9.8 Critical. Confirmed exploited in the wild.

[HIGH PRIORITY] VMware vCenter Syslog Path Traversal RCE (CVE-2026-59310)

noreply@blogger.com (Raj) — Sat, 22 Aug 2026 18:20:14 +0530

⚠ HIGH PRIORITY — CISA KEV (Aug 2026). CVE-2026-59310 is a path traversal flaw in VMware vCenter's Syslog server. Any attacker with network access to vCenter can achieve remote code execution on the appliance — full control of your virtualization management plane.

Affected vCenter

VMware vCenter Server builds listed in Broadcom VMSA-2026-0008
vCenter with Syslog forwarding enabled (default in many deployments)
Management VLAN reachable from compromised workstation or flat network

Check version

ssh admin@vcenter.local
vpxd -v 2>/dev/null || cat /etc/vmware-vpx/version
ss -tlnp | grep 514

Patching Method

Download fixed vCenter ISO/patch from Broadcom Customer Connect.
Snapshot vCenter VM or take appliance backup before upgrade.
Apply patch via VAMI (https://vcenter:5480) → Update → Install.
Reboot vCenter; confirm Syslog service starts cleanly.
Verify build matches VMSA fixed-version table.
Review Syslog and vpxd logs for traversal attempts in last 30 days.
Rotate vCenter SSO and local admin passwords post-patch.

grep -i syslog /var/log/vmware/vpxd.log | tail -50
grep -i traversal /var/log/vmware/syslog.log 2>/dev/null

Until patched

Restrict vCenter management (443, 5480) to jump-host IP allowlist
Segment vCenter on dedicated management VLAN — no internet exposure
Assume compromise if vCenter was internet-facing and unpatched

CVSS: 9.8 Critical. No vendor workaround — patch only.

[HIGH PRIORITY] VMware ESXi TOCTOU Privilege Escalation (CVE-2025-22224)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:57:17 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-22224 is a time-of-check time-of-use (TOCTOU) vulnerability in VMware ESXi VMX process allowing local attackers with VM access to escalate to code execution on the hypervisor host — critical for multi-tenant and cloud ESXi clusters.

Affected ESXi

ESXi 8.0 before ESXi 8.0 U3d
ESXi 7.0 before ESXi 7.0 U3s
Hosts running untrusted or compromised VMs

Verify version

ssh root@esxi-host
esxcli system version get
vmware -v

Patching Method

Snapshot VM inventory; plan rolling cluster maintenance.
Download fixed ESXi image (8.0 U3d / 7.0 U3s) from Broadcom portal.
Evacuate VMs or enter maintenance mode per host.
Apply update via vSphere Lifecycle Manager or esxcli software profile.
Reboot host; verify esxcli system version get shows patched build.
Review VM guest tools for escape indicators on sensitive VMs.

esxcli system maintenanceMode set --enable true
esxcli software profile update -p ESXi-8.0.0-XXXX -d https://host/update
esxcli system maintenanceMode set --enable false

Workaround until patched

Do not run untrusted VMs on shared ESXi hosts
Enable lockdown mode and restrict host admin access
Segment management network from VM traffic

[HIGH PRIORITY] SimpleHelp Remote Support RCE (CVE-2024-55956)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:57:04 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-55956 allows unauthenticated remote code execution in SimpleHelp remote support software on Linux and Windows. MSPs and IT teams use SimpleHelp for remote desktop — exploitation grants access to all connected endpoints.

Affected SimpleHelp

SimpleHelp before 5.5.8
Self-hosted SimpleHelp on port 443/8080
MSP remote support gateways

Check version

curl -sk https://support.example:443/ | grep -i simplehelp
systemctl status simplehelp 2>/dev/null

Patching Method

Download SimpleHelp 5.5.8+ from vendor portal.
Notify users — brief outage during upgrade.
On Linux: stop service, backup /opt/simplehelp, run upgrade installer, restart.
Verify version in admin console About page.
Audit technician accounts for unknown admin users.
Invalidate all active remote sessions and regenerate API keys.

systemctl restart simplehelp
grep -i version /opt/simplehelp/config/*.xml 2>/dev/null

Until patched

Disable internet access to SimpleHelp portal
Require VPN for all remote support sessions
Assume breach if exposed unpatched during active exploitation window

[HIGH PRIORITY] Palo Alto Expedition Tool RCE (CVE-2024-8957)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:56:51 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-8957 is an unauthenticated remote code execution flaw in Palo Alto Networks Expedition migration tool (runs on Linux). Attackers steal PAN-OS firewall configs, credentials, and API keys from migration projects.

Affected Expedition

Expedition before 1.2.30
Expedition servers on Ubuntu/RHEL with port 443 exposed
Migration projects containing production firewall exports

Detect exposure

ss -tlnp | grep 443
curl -sk https://expedition.internal/ | grep -i expedition
grep -R Expedition /opt/ 2>/dev/null

Patching Method

Download Expedition 1.2.30+ from Palo Alto support portal.
Stop Expedition service on Linux host.
Backup /opt/expedition project database and exports.
Run vendor upgrade script or replace container/image per KB.
Restart service; verify version in Expedition web UI.
Rotate all PAN-OS API keys and admin passwords stored in Expedition projects.
Re-import firewall configs from clean backups if compromise suspected.

systemctl status expedition 2>/dev/null
find /opt/expedition -mtime -7 -type f -ls 2>/dev/null

Hardening

Never expose Expedition to internet — internal VLAN only
Delete migration projects after cutover
Encrypt stored firewall exports at rest

[HIGH PRIORITY] Cisco ASA and FTD WebVPN RCE (CVE-2025-20362)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:56:38 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-20362 is a remote code execution vulnerability in Cisco ASA and FTD WebVPN / remote access VPN services. Critical for perimeter firewalls protecting Linux and Windows internal networks.

Affected Cisco

ASA software trains listed in Cisco PSIRT advisory (2025)
FTD with remote access VPN / SSL VPN enabled
Internet-exposed VPN portals on port 443

Verify exposure

show version | include Software
show running-config webvpn
show vpn-sessiondb summary

Patching Method

Download fixed ASA/FTD image from Cisco Software Central.
Export running config backup before upgrade.
Install fixed image via ASDM or CLI software install workflow.
Reboot appliance; verify WebVPN service after patch.
Temporarily disable WebVPN if emergency patch window delayed.
Review VPN logs for anomalous pre-auth connections.

show version
show running-config | include webvpn
show logging | include 443

Post-patch

Restrict VPN portal source IPs at upstream firewall
Enable MFA for all VPN users
Audit for unknown local accounts on ASA

[HIGH PRIORITY] Ivanti Policy Secure Stack Buffer Overflow (CVE-2025-0288)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:56:25 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-0288 is a stack buffer overflow in Ivanti Policy Secure and Connect Secure gateways. Unauthenticated remote attackers achieve RCE on VPN appliances — part of the 2025 Ivanti patch wave alongside CVE-2025-22457.

Affected Ivanti

Policy Secure before 22.7R1.3
Connect Secure builds listed in Ivanti advisory (patch alongside 22457)
Internet-exposed VPN concentrators

Verify build

show version
show config ssl

Patching Method

Apply latest Ivanti cumulative patch from security advisory (minimum fixed builds per product line).
Run ICT/EAST scan before and after patching.
Import patch via admin console; allow full reboot cycle.
Disable internet VPN access until patch confirmed.
Rotate all VPN user credentials and SAML secrets post-patch.
Hunt for web shells and rogue admin accounts in appliance logs.

last -20
grep -i admin /var/log/messages 2>/dev/null | tail -30

Workaround

Block VPN portal at perimeter firewall immediately
Restrict to IP allowlist if VPN must remain partially available

[HIGH PRIORITY] Fortinet FortiWeb SQL Injection RCE (CVE-2025-25257)

noreply@blogger.com (Raj) — Fri, 21 Aug 2026 09:56:10 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-25257 is an unauthenticated SQL injection in Fortinet FortiWeb WAF appliances. Attackers achieve remote code execution on Linux-based FortiWeb devices protecting public web applications.

Affected FortiWeb

FortiWeb before 7.6.3
FortiWeb before 7.4.7
Internet-facing WAF on ports 443/8443

Check version

get system status
diagnose version

Patching Method

Download fixed FortiWeb firmware from Fortinet support portal.
Schedule maintenance — WAF will briefly stop filtering traffic during reboot.
Install via System → Firmware → Upgrade in FortiWeb GUI.
Reboot appliance; confirm version matches PSIRT fixed build table.
Review WAF logs for SQLi payloads in last 30 days.
Rotate FortiWeb admin passwords and API tokens.

get system status | grep Version
execute log filter category 0
execute log display

Until patched

Restrict FortiWeb management to OOB network
Enable FortiGuard IPS signature if emergency mitigation published
Assume compromise if internet-facing and unpatched

[HIGH PRIORITY] Progress WhatsUp Gold RCE (CVE-2024-6670)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:32:48 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-6670 is an unauthenticated remote code execution flaw in Progress WhatsUp Gold network monitoring. Attackers run commands on Windows or Linux monitoring servers with network visibility into your entire infrastructure.

Affected WhatsUp Gold

WhatsUp Gold before 2024.0.1
Monitoring servers on ports 9643/443
MSP NOC dashboards exposed to internet

Detect exposure

nmap -p 9643,443 --script http-title monitor-subnet/24
curl -sk https://monitor.example:9643/ | grep -i whatsUp

Patching Method

Download WhatsUp Gold 2024.0.1+ from Progress support.
Stop WhatsUp Gold services on Linux: systemctl stop whatsuptime (service name varies by install).
Run vendor upgrade installer or apply hotfix package.
Restart services; confirm version in web admin About page.
Rotate SNMP/SSH/API credentials stored in WhatsUp Gold credential library.
Review alert history for unauthorized script execution indicators.

# Linux — verify service after patch
systemctl status whatsuptime 2>/dev/null || ps aux | grep -i whatsUp
ss -tlnp | grep 9643

Hardening

Never expose WhatsUp Gold to public internet
Segment monitoring server from production VLANs
Use read-only SNMP community strings where possible

[HIGH PRIORITY] Ivanti Connect Secure Auth Bypass (CVE-2023-46805)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:32:36 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2023-46805 is an authentication bypass in Ivanti Connect Secure VPN. Chained with CVE-2024-21887 command injection for unauthenticated RCE on Linux-based ICS appliances.

Affected Ivanti

Ivanti Connect Secure 9.x before 9.1R14
Ivanti Policy Secure before fixed builds
Internet-exposed VPN gateways

Check version

show version
curl -sk https://vpn.example.com/dana-na/ | head -3

Patching Method

Apply Ivanti cumulative patch to minimum 9.1R14 or 22.7R2.1 per advisory.
Run Ivanti ICT (Integrity Checker Tool) before patching — save report.
Import patch via admin console; allow full reboot.
Re-run ICT after patch — investigate any failures.
Also patch CVE-2024-21887 if not on fixed build.
Force password reset for all VPN users and admins.

# Post-patch persistence hunt
last -20
find /home -name '*.pl' -o -name 'c.cgi' 2>/dev/null

Until patched

Disable VPN portal at perimeter firewall
Use Ivanti external ICT if internal patching delayed
Assume compromise if exposed without patch for >72 hours

[HIGH PRIORITY] Veeam Backup Enterprise Manager Auth Bypass (CVE-2024-5806)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:32:24 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-5806 is an authentication bypass in Veeam Backup Enterprise Manager on Windows and Linux backup servers. Attackers access backup consoles, steal credentials, and encrypt or exfiltrate backup repositories — catastrophic for ransomware recovery.

Affected Veeam

Veeam Backup & Replication before 12.2.0.334
Enterprise Manager exposed on port 9398/443
Linux Veeam backup proxies and management servers

Check version

# Linux Veeam server
veeamconfig --version 2>/dev/null || systemctl status veeamtransport
ss -tlnp | grep 9398

Patching Method

Download Veeam Backup & Replication cumulative patch from Veeam portal.
Pause backup jobs; notify stakeholders of maintenance window.
On Linux: run vendor veeam-update script or mount update ISO per KB; restart Veeam services.
On Windows: run Veeam update installer over existing install.
Verify version in Console → Help → About.
Rotate all stored credentials in Veeam Credential Manager.
Audit backup job history for unauthorized restore/export operations.

systemctl restart veeamtransport veeambroker veeamdeploymentservice
grep -i 'login\|auth' /var/log/veeam/*.log 2>/dev/null | tail -20

Post-patch

Never expose Veeam Enterprise Manager to internet
Use separate backup account with MFA and immutable storage
Test restore from clean backup after incident

[HIGH PRIORITY] Palo Alto PAN-OS Authorization Bypass (CVE-2025-0108)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:32:10 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-0108 is an authorization bypass in Palo Alto PAN-OS management and dataplane paths. Attackers bypass security policies on unpatched firewalls — critical for perimeter Linux/Windows networks behind PAN devices.

Affected PAN-OS

PAN-OS 11.2 before 11.2.4-h4
PAN-OS 11.1 before 11.1.6-h1
PAN-OS 10.2 before 10.2.13-h3
GlobalProtect and SSL decryption enabled environments

Verify version

> show system info | match sw-version
> show system state | match cfg

Patching Method

Download fixed PAN-OS content/software from Palo Alto support portal.
Export running config baseline before change.
Install via Device → Software in HA-aware order (passive first).
Reboot if required; validate policy commit succeeds post-upgrade.
Diff running config against baseline for unauthorized rule changes.
Review traffic logs for policy bypass indicators after patch date.

> show system info | match sw-version
> show config diff running-config saved-config
> show admins all

Until patched

Apply Palo Alto Threat Prevention temporary mitigation if published
Restrict management plane to OOB network
Increase logging on deny→allow policy anomalies

[HIGH PRIORITY] Atlassian Confluence Broken Access Control (CVE-2023-22515)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:31:58 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2023-22515 is a broken access control flaw in Atlassian Confluence Data Center and Server. Unauthenticated attackers create admin accounts and take over Confluence on Linux Tomcat hosts — often chained before CVE-2023-22527 exploitation.

Affected Confluence

Confluence 8.0.0 through 8.5.1
Self-hosted wiki on port 8090/443
Instances without IP restriction on /setup path

Check for compromise

curl -s http://confluence:8090/status
grep -R 'confluence.version' /opt/atlassian/confluence/

Patching Method

Backup Confluence home and database immediately.
Upgrade to Confluence 8.5.2+ via Atlassian installer or download upgrade JAR from Atlassian security advisory.
On Linux: /opt/atlassian/confluence/bin/stop-confluence.sh, apply upgrade, start-confluence.sh.
Review User management for unknown admin accounts.
Delete suspicious users; force password reset for all admins.
Block external access until patched and audited.

# Audit admin users in Confluence DB (PostgreSQL example)
sudo -u postgres psql confluence -c "SELECT user_name, created_date FROM cwd_user ORDER BY created_date DESC LIMIT 10;"

Workaround

Restrict Confluence to internal VPN only
Block /setup/ paths at reverse proxy
Enable SAML/SSO with MFA after patch

[HIGH PRIORITY] SAP NetWeaver Visual Composer RCE (CVE-2025-31324)

noreply@blogger.com (Raj) — Thu, 20 Aug 2026 11:31:44 +0530

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-31324 is an unauthenticated remote code execution flaw in SAP NetWeaver Visual Composer / Metadata Uploader on Java-based SAP stacks. Attackers deploy JSP webshells and pivot to SAP ERP databases on Linux hosts.

Affected SAP products

SAP NetWeaver Java Visual Composer before fixed SAP Security Note
Metadata Uploader component on exposed SAP Java ports (50000/50100)
Self-hosted SAP on SUSE/RHEL with Tomcat backend

Detect exposure

nmap -p 50000,50100,443 sap-subnet/24
curl -sk https://sap.example:443/irj/portal | head -5

Patching Method

Download SAP Security Note patch from SAP Support Portal (S-user required).
Schedule SAP maintenance window — stop SAP Java stack via SAP MMC or sapcontrol -nr 00 -function Stop.
Apply SAP kernel/SCA component updates per note instructions.
Restart SAP instances; verify component version in SAP GUI or sapcontrol -nr 00 -function GetVersionInfo.
Scan /usr/sap/*/J* for unexpected JSP/webshell files.
Rotate SAP admin, DB, and RFC credentials after patch.

# Linux SAP host — check for webshells
find /usr/sap -name '*.jsp' -mtime -14 -ls 2>/dev/null
grep -R 'Visual Composer' /usr/sap/*/J*/ 2>/dev/null | head

Until patched

Disable Metadata Uploader if SAP note provides workaround
Block SAP Java ports from internet at firewall
Require VPN for all SAP admin access

Cisco IOS XE Web UI Persistent Implant (CVE-2024-20399)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:35:01 +0530

CVE-2024-20399 allows authenticated attackers to install persistent implants on Cisco IOS XE devices via the Web UI. Survives reboots when chained with CVE-2023-20198 — CISA KEV, critical for edge routers and switches.

Affected IOS XE

IOS XE with Web UI enabled (same exposure as CVE-2023-20198)
ISR, ASR, Catalyst 9000 series on vulnerable trains
Devices already compromised may retain implant after partial patch

Check for implant before patching

show version
show platform software fed active install package integrity 2>/dev/null
# Cisco PSIRT IOC — check for bad.lemonade / malicious Lua

Patching Method

Run Cisco PSIRT compromise detection script from advisory first.
If compromised: factory reset or Cisco TAC recovery before patching.
Download IOS XE image with both 20198 and 20399 fixes from Software Central.
Backup config: copy running-config flash:backup.cfg
Install fixed image; full reload required.
After reboot: no ip http server and no ip http secure-server
Rotate all credentials; rebuild AAA from clean template.

show version | include Version
show running-config | include http
show logging | include LOGIN

Post-patch hardening

Disable Web UI permanently if SSH/NETCONF suffices
Restrict management plane to out-of-band network
Monitor Cisco PSIRT for updated IOCs monthly

pgAdmin4 Authentication Bypass via Deserialization (CVE-2024-5910)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:34:48 +0530

CVE-2024-5910 is an authentication bypass in pgAdmin4 when deserialization of untrusted data is triggered. Attackers gain admin access to PostgreSQL management UI on Linux servers — leading to database takeover.

Affected pgAdmin4

pgAdmin4 before 8.11
Docker and pip installs on Ubuntu, Debian, RHEL
pgAdmin exposed on port 5050/443 without IP restriction

Check version

pip show pgadmin4 | grep Version
docker exec pgadmin4 cat /pgadmin4/version.json 2>/dev/null
curl -s http://127.0.0.1:5050/misc/ping

Patching Method

pip install on Linux

sudo systemctl stop pgadmin4
pip install --upgrade pgadmin4==8.11
sudo systemctl start pgadmin4

Docker

docker pull dpage/pgadmin4:8.11
docker compose down
docker compose up -d

After upgrade, reset pgAdmin master password and review stored server connections.
Rotate PostgreSQL passwords for all servers registered in pgAdmin.
Restrict pgAdmin to VPN or SSH tunnel — never public internet.

Post-patch audit

Check pgAdmin user table for unknown admin accounts
Review PostgreSQL logs for new superuser grants
Enable 2FA if using pgAdmin 8.11+ with MFA support

Ivanti Sentry Server-Side Request Forgery Chain (CVE-2024-21893)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:34:34 +0530

CVE-2024-21893 is a server-side request forgery (SSRF) flaw in Ivanti Sentry (formerly MobileIron). Chained with other Ivanti bugs, attackers pivot from Sentry to internal Connect Secure appliances and Linux backend services.

Affected Ivanti Sentry

Ivanti Sentry before 9.18.0.4
Sentry 9.17.x and earlier builds
Mobile device management gateways on port 443

Verify version

show version
curl -sk https://sentry.example.com/ | grep -i ivanti

Patching Method

Download Ivanti Sentry patch 9.18.0.4+ from security advisory.
Schedule MDM downtime — mobile enrollments pause during reboot.
Apply patch via Sentry admin console or vendor CLI bundle.
Reboot appliance; verify build in admin UI.
Patch linked Connect Secure / Policy Secure if in same Ivanti stack.
Review Sentry logs for SSRF patterns targeting internal 127.0.0.1 or RFC1918 hosts.

# Post-patch — check for lateral movement artifacts
grep -i 'ssrf\|127.0.0.1\|internal' /var/log/sentry/*.log 2>/dev/null | tail -20

Hardening

Do not expose Sentry admin to internet
Segment Sentry from internal database VLANs
Enable Ivanti ICT scan after every major patch

Atlassian Confluence Template Injection RCE (CVE-2023-22527)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:34:20 +0530

CVE-2023-22527 is an unauthenticated OGNL/template injection in Atlassian Confluence Data Center and Server. Attackers achieve RCE on Linux hosts running Confluence — CISA KEV, mass scanning within hours of disclosure.

Affected Confluence

Confluence Data Center and Server 8.5.x before 8.5.4
Confluence 8.4.x, 8.3.x, 8.2.x, 8.1.x, 8.0.x per advisory matrix
Self-hosted on Linux with Tomcat (port 8090/443)

Check version

curl -s http://confluence:8090/status | grep -i version
grep -R 'confluence.version' /opt/atlassian/confluence/ 2>/dev/null

Patching Method

Download fixed Confluence JAR/installer from Atlassian security advisory.
Backup /var/atlassian/application-data/confluence and database.
Stop Confluence: systemctl stop confluence or /opt/atlassian/confluence/bin/stop-confluence.sh
Apply upgrade via installer or replace affected JARs per Atlassian KB.
Start Confluence; confirm version in About Confluence.
Scan for rogue plugins, new admin users, and unexpected network connections.

# Linux Tomcat path — hunt webshells post-patch
find /opt/atlassian/confluence -name '*.jsp' -mtime -14 -ls
grep -R 'cmd.exe\|/bin/bash' /opt/atlassian/confluence/temp/ 2>/dev/null

Workaround until patched

Block external access to Confluence at firewall/WAF
Restrict to VPN-only if internal wiki must stay online
Disable anonymous access and guest spaces

Progress MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:34:06 +0530

CVE-2023-34362 is an unauthenticated SQL injection in Progress MOVEit Transfer MFT servers. Attackers deploy web shells (e.g. human2.aspx) and steal data from thousands of organizations — one of the largest 2023 supply-chain breaches.

Affected MOVEit

MOVEit Transfer before 2023.0.3 (June 2023 emergency patch)
Windows and Linux MOVEit Transfer instances
Internet-facing MFT on ports 443/8443

Detect exposure

curl -sk https://mft.example.com/human.aspx | head -5
find /opt/MOVEit -name 'human2.aspx' -o -name '*.zip' 2>/dev/null

Patching Method

Isolate MOVEit from network if compromise suspected.
Download latest MOVEit Transfer cumulative patch from Progress support.
On Linux: stop MOVEit service, apply vendor patch script or RPM, run database migration if prompted.
On Windows: run Progress installer over existing instance.
Restart services; verify version in MOVEit admin console.
Delete unauthorized ASPX/JSP files; restore DB from clean backup if webshell found.
Rotate SFTP keys, API tokens, and partner credentials.

# Linux — check MOVEit version after patch
systemctl status moveit-transfer
grep -R 'Version' /opt/MOVEit/config/ 2>/dev/null

Post-patch

Engage IR firm if human2.aspx or LEMURLOOT indicators found
Notify data owners per breach disclosure requirements
Segment MFT from domain controllers and databases

Citrix Bleed NetScaler Session Token Leak (CVE-2023-4966)

noreply@blogger.com (Raj) — Wed, 19 Aug 2026 18:33:51 +0530

CVE-2023-4966 (nicknamed Citrix Bleed) is a buffer overread in Citrix NetScaler ADC and Gateway. Attackers leak session tokens from memory and hijack authenticated VPN/admin sessions without credentials — CISA KEV listed.

Affected Citrix

NetScaler ADC and Gateway 14.1 before 14.1-8.50
NetScaler ADC and Gateway 13.1 before 13.1-49.15
NetScaler ADC 13.0 before 13.0-92.19 (EOL branch)

Check version

show version
show ns config | grep -i ssl

Patching Method

Download fixed NetScaler build from Citrix downloads portal.
Schedule maintenance — active sessions will be terminated on reboot.
Install via GUI: Configuration → System → Upgrade or CLI install ns workflow per Citrix KB.
Reboot appliance; confirm version matches advisory fixed table.
Force global session reset — invalidate all existing tokens post-patch.
Rotate admin passwords and MFA seeds; review AAA logs for hijacked sessions.

# CLI version check after patch
show version
clear ssl session -all

Until patched

Block NetScaler VPN portal from internet if possible
Enable MFA on all Citrix-published apps
Monitor for logins from unusual geographies after token leak window

Hack The Sec-Leading Resource Of Linux Tutorial

Proxmox VE vs VMware ESXi: Complete Install Guide (Bare Metal, Step-by-Step)

Part A — Proxmox VE installation (bare metal)

A1. Requirements

A2. Create bootable USB

A3. Boot and start graphical installer

A4. First login to Proxmox web UI

A5. Post-install Proxmox configuration

A6. Create first VM in Proxmox

Part B — VMware ESXi installation (bare metal)

B1. Requirements and licensing

B2. Boot ESXi installer

B3. Configure ESXi management network (DCUI)

B4. Access ESXi Host Client (web UI)

B5. Create first VM on ESXi

Part C — Proxmox vs VMware: comparison

Part D — When to choose which

Part E — Side-by-side verification checklist

Part F — Common issues

Proxmox

VMware ESXi

How To Install cPanel / WHM on AlmaLinux 9 (Complete Step-by-Step Guide)

Table of contents

1. Server requirements

2. Pre-install checklist

3. Prepare AlmaLinux 9

4. Download and run the cPanel installer

5. Monitor cPanel install logs

6. First WHM login and initial setup wizard

7. Create your first cPanel account

8. Post-install hardening and verification

9. Common install errors and log fixes

Quick reference — important paths

[HIGH PRIORITY] Ray Project Code Injection RCE (CVE-2025-62593)

Affected Ray

Check version

Patching Method

Until patched

[HIGH PRIORITY] macOS Screen Sharing Auth Bypass (CVE-2026-65400)

Affected macOS

Check exposure

Patching Method

Until patched

[HIGH PRIORITY] Microsoft SharePoint Authentication Bypass (CVE-2026-55040)

Affected SharePoint

Verify build

Patching Method

Until patched

[HIGH PRIORITY] Windows IKE Service Double-Free RCE (CVE-2026-33824)

Affected systems

Check exposure

Patching Method

Workaround (temporary)

[HIGH PRIORITY] VMware vCenter Syslog Path Traversal RCE (CVE-2026-59310)

Affected vCenter

Check version

Patching Method

Until patched

[HIGH PRIORITY] VMware ESXi TOCTOU Privilege Escalation (CVE-2025-22224)

Affected ESXi

Verify version

Patching Method

Workaround until patched

[HIGH PRIORITY] SimpleHelp Remote Support RCE (CVE-2024-55956)

Affected SimpleHelp

Check version

Patching Method

Until patched

[HIGH PRIORITY] Palo Alto Expedition Tool RCE (CVE-2024-8957)

Affected Expedition

Detect exposure

Patching Method

Hardening

[HIGH PRIORITY] Cisco ASA and FTD WebVPN RCE (CVE-2025-20362)

Affected Cisco

Verify exposure

Patching Method

Post-patch

[HIGH PRIORITY] Ivanti Policy Secure Stack Buffer Overflow (CVE-2025-0288)

Affected Ivanti