InfoSecBulletin Cybersecurity for mankind
A new security flaw affecting NGINX Plus and NGINX Open is being used by hackers days after it was made public, according to VulnCheck. The flaw, known as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in the ngx_http_rewrite_module that affects NGINX versions 0.6.27 to 1.30.0. An AI security firm called depthfirst says this flaw began in 2008.
“It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it,” security researcher Kevin Beaumont said. “To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.”
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
AlmaLinux maintainers said: “Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce.”
“That said, ‘not easy’ is not ‘impossible,’ and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent,” the maintainers added.
The newest research from VulnCheck shows that threat actors are using the flaw as a weapon, with attempts seen on its honeypot networks. We do not know the details of the attacks or their goals yet. Users should install the latest updates from F5 to protect their networks from ongoing threats.
Flaws in openDCIM Also Exploited
The news comes as VulnCheck showed attacks focusing on two serious problems in openDCIM, an open-source tool for managing data center infrastructure. These issues are both scored 9.3 on the CVSS scale, as listed below :
CVE-2026-28515: A missing authorization issue lets a logged-in user access LDAP settings even if they shouldn’t. In Docker setups where REMOTE_USER is used without checking who the user is, the endpoint can be accessed without a password. This means someone could change the app settings without permission.
CVE-2026-28517: An operating system command injection vulnerability impacting the “report_network_map.php” component that processes a parameter called “dot” without sanitization and passes it directly to a shell command, resulting in arbitrary code execution.
Security researcher Valentin Lobstein from VulnCheck in 2026 discovered the two vulnerabilities alongside CVE-2026-28516 , an SQL injection vulnerability in openDCIM. According to Lobstein, the three flaws can be chained to achieve remote code execution over five HTTP requests and spawn a reverse shell.
“The cluster of attacker activity we’re observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP web shell,” Caitlin Condon, vice president of security research at VulnCheck, said.
