Month: January 2024

Enlarge (credit: Getty)

VMware's new owner is ending the virtualization and cloud computing company's partner programs. It's unclear who or how many current partners will be able to sell VMware-related offerings after April 2024, leaving potential for tens of thousands of businesses to be disrupted.

Broadcom, which closed its VMware acquisition in November, told The Register in late December that “effective February 5, 2024, Broadcom will be transitioning VMware’s partner programs to the invitation-only Broadcom Advantage Partner Program.” This signaled the end of VMware's partnerships with solution providers, resellers, and distributors. But today’s news reportedly reveals a final closure date for the cloud services provider partner program, which debuted in 2019.

Today, The Register reported that Broadcom recently shared an end-of-partnership date specifically for VMware cloud service provider partners, which work with VMware through the VMware Partner Connect Program that launched in 2020.

Enlarge / A child with measles. (credit: Greene, Charles Lyman)

The US may be heading to a "dangerous vaccination tipping point," with immunization rates falling so low that population-level immunity is now at risk, and we will likely see thousands of needless deaths this respiratory virus season, two top officials for the Food and Drug Administration warned in a recent JAMA commentary.

FDA Commissioner Robert Califf and top FDA vaccine regulator Peter Marks noted the profound benefits of lifesaving vaccines—which save millions of lives in the US each year—and their established safety, which is monitored both passively and actively through multiple, overlapping federal safety monitoring systems. And yet, "an increasing number of people in the US are now declining vaccination for a variety of reasons, ranging from safety concerns to religious beliefs," thanks to the rise of anti-vaccine misinformation spread on social media and elsewhere on the Internet.

Data from the Centers for Disease Control and Prevention last year found that, for the third consecutive year, vaccination rates among kindergartners had continued to slip, with rates of non-medical vaccination exemptions rising to an all-time high. There are now 10 states with vaccination exemption rates over 5 percent, meaning that even if clinicians and health officials manage to vaccinate all non-exempt children, the state will not be able to reach the target of 95 percent coverage needed to curb the spread of disease on a population level.

Enlarge (credit: Cummins)

Cummins, which makes diesel engines for trucks, among other products, will pay a record Clean Air Act civil penalty of $1.675 billion in a lawsuit brought by the US Department of Justice, the Environmental Protection Agency, and the California Air Resources Board.

Like Volkswagen before it, Cummins was found to have fitted engines—in this case, diesel engines installed in more than 630,000 Ram 2500 and Ram 3500 pickup trucks built between 2013–2019—with illegal "defeat device" software that allowed the truck engines to pass emissions tests but then emit much more pollution while in operation. The DOJ said it also found undisclosed emissions software on an additional 330,000 trucks built between 2019 and 2023.

Cummins must recall and repair the non-compliant engine software, extend the warranty period for some parts of those powertrains, fund and develop ways to reduce nitrogen oxides (NOx) from engine emissions, and implement procedures to prevent cheating in the future.

Enlarge (credit: Getty Images)

Unknown threat actors are actively targeting two critical zero-day vulnerabilities that allow them to bypass two-factor authentication and execute malicious code inside networks that use a widely used virtual private network appliance sold by Ivanti, researchers said Wednesday.

Ivanti reported bare-bones details concerning the zero-days in posts published on Wednesday that urged customers to follow mitigation guidance immediately. Tracked as CVE-2023-846805 and CVE-2024-21887, they reside in Ivanti Connect Secure, a VPN appliance often abbreviated as ICS. Formerly known as Pulse Secure, the widely used VPN has harbored previous zero-days in recent years that came under widespread exploitation, in some cases to devastating effect.

Exploiters: Start your engines

“When combined, these two vulnerabilities make it trivial for attackers to run commands on the system,” researchers from security firm Volexity wrote in a post summarizing their investigative findings of an attack that hit a customer last month. “In this particular incident, the attacker leveraged these exploits to steal configuration data, modify existing files, download remote files, and reverse tunnel from the ICS VPN appliance.” Researchers Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Thomas Lancaster went on to write: