
Malicious cron tasks are frequently used to inject attacker-controlled public keys into the root user’s authorized_keys file, ensuring that SSH access remains available even if other backdoors are removed. This foundational tactic has recently converged with the exploitation of CVE-2026-59310, a critical vulnerability within the VMware vCenter Syslog Service that allows for unauthenticated remote code execution. As of 2026, the










