InfoSecBulletin Cybersecurity for mankind
A new security flaw affecting NGINX Plus and NGINX Open is being used by hackers days after it was made public, according to VulnCheck. The flaw, known as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in the ngx_http_rewrite_module that affects NGINX versions 0.6.27 to 1.30.0. An AI security firm called depthfirst says this flaw began in 2008.
“It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it,” security researcher Kevin Beaumont said. “To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.”
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
AlmaLinux maintainers said: “Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce.”
“That said, ‘not easy’ is not ‘impossible,’ and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent,” the maintainers added.
The newest research from VulnCheck shows that threat actors are using the flaw as a weapon, with attempts seen on its honeypot networks. We do not know the details of the attacks or their goals yet. Users should install the latest updates from F5 to protect their networks from ongoing threats.
Flaws in openDCIM Also Exploited
The news comes as VulnCheck showed attacks focusing on two serious problems in openDCIM, an open-source tool for managing data center infrastructure. These issues are both scored 9.3 on the CVSS scale, as listed below :
CVE-2026-28515: A missing authorization issue lets a logged-in user access LDAP settings even if they shouldn’t. In Docker setups where REMOTE_USER is used without checking who the user is, the endpoint can be accessed without a password. This means someone could change the app settings without permission.
CVE-2026-28517: An operating system command injection vulnerability impacting the “report_network_map.php” component that processes a parameter called “dot” without sanitization and passes it directly to a shell command, resulting in arbitrary code execution.
Security researcher Valentin Lobstein from VulnCheck in 2026 discovered the two vulnerabilities alongside CVE-2026-28516 , an SQL injection vulnerability in openDCIM. According to Lobstein, the three flaws can be chained to achieve remote code execution over five HTTP requests and spawn a reverse shell.
“The cluster of attacker activity we’re observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP web shell,” Caitlin Condon, vice president of security research at VulnCheck, said.
