VMware has confirmed that a file from the VMware ESX server hypervisor source code has indeed been leaked by a hacker that goes by the handle "Hardcore Charlie" .

"The posted code and associated commentary dates to the 2003 to 2004 timeframe," specified Iain Mulholland, Director of VMware Security Response Center, and added that there is a possibility that more files may be posted in the future, as the hackers claimed to have in his possession around 300 MB of VMWare source code.

But, he said that fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers.

"VMware proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today," he explained. "We take customer security seriously and have engaged internal and external resources, including our VMware Security Response Center, to thoroughly investigate."

The file was part of a batch of documents released by the hacker, which also contains what seems to be a legitimate-looking internal VMWare memo and some internal email exchanges.

The provenience of the leaked code has not been confirmed yet, but it seems to come from the servers of the China Electronics Import & Export Corporation (CEIC), which recently suffered a breach, allegedly by the hands of Hardcore Charlie.

According to Threatpost, the hacker has boasted of breaching a number of big firms located in the Asia-Pacific region, and said he is sitting on over a terabyte of data slurped from their servers. He also claims that he and his associates still have access to the networks of some of those companies.

Some of those documents have already been leaked online, and among them are shipping documents of US Military transports in Afghanistan. These are not classified, but the question is how and why did they end up on the compromised servers.

Mandiant CSO Richard Bejtlich says that while the US military should investigate for potential internal leaks or errors that resulted in the documents being exported from its unclassified network, past experiences point to the fact that it's unlikely that Chinese firms have engaged in company-to-company spying.