InfoSecBulletin Cybersecurity for mankind
A new security flaw affecting NGINX Plus and NGINX Open is being used by hackers days after it was made public, according to VulnCheck. The flaw, known as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in the ngx_http_rewrite_module that affects NGINX versions 0.6.27 to 1.30.0. An AI security firm called depthfirst says this flaw began in 2008.
“It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it,” security researcher Kevin Beaumont said. “To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.”
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
AlmaLinux maintainers said: “Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce.”
“That said, ‘not easy’ is not ‘impossible,’ and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent,” the maintainers added.
The newest research from VulnCheck shows that threat actors are using the flaw as a weapon, with attempts seen on its honeypot networks. We do not know the details of the attacks or their goals yet. Users should install the latest updates from F5 to protect their networks from ongoing threats.
Flaws in openDCIM Also Exploited
The news comes as VulnCheck showed attacks focusing on two serious problems in openDCIM, an open-source tool for managing data center infrastructure. These issues are both scored 9.3 on the CVSS scale, as listed below :
CVE-2026-28515: A missing authorization issue lets a logged-in user access LDAP settings even if they shouldn’t. In Docker setups where REMOTE_USER is used without checking who the user is, the endpoint can be accessed without a password. This means someone could change the app settings without permission.
CVE-2026-28517: An operating system command injection vulnerability impacting the “report_network_map.php” component that processes a parameter called “dot” without sanitization and passes it directly to a shell command, resulting in arbitrary code execution.
Security researcher Valentin Lobstein from VulnCheck in 2026 discovered the two vulnerabilities alongside CVE-2026-28516 , an SQL injection vulnerability in openDCIM. According to Lobstein, the three flaws can be chained to achieve remote code execution over five HTTP requests and spawn a reverse shell.
“The cluster of attacker activity we’re observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP web shell,” Caitlin Condon, vice president of security research at VulnCheck, said.
