InfoSecBulletin Cybersecurity for mankind
A new security flaw affecting NGINX Plus and NGINX Open is being used by hackers days after it was made public, according to VulnCheck. The flaw, known as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in the ngx_http_rewrite_module that affects NGINX versions 0.6.27 to 1.30.0. An AI security firm called depthfirst says this flaw began in 2008.
“It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it,” security researcher Kevin Beaumont said. “To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.”
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
CVE-2026-0257
Palo Alto Warns of GlobalProtect VPN Vuln Actively Exploited
BD Gov.t to set up Tk192.66cr AI hub with support from Koica
Critical Splunk Enterprise Pre-Auth RCE Chain Exposes Databases With Zero Authentication
Anthropic disables Fable 5 and Mythos 5 Access after US order limiting foreign access
AlmaLinux maintainers said: “Turning the heap overflow into reliable code execution is not trivial in the default configuration, and on systems with ASLR enabled (which is the default on every supported AlmaLinux release), we do not expect a generic, reliable exploit to be easy to produce.”
“That said, ‘not easy’ is not ‘impossible,’ and the worker-crash DoS is exploitable enough on its own that we recommend treating this as urgent,” the maintainers added.
The newest research from VulnCheck shows that threat actors are using the flaw as a weapon, with attempts seen on its honeypot networks. We do not know the details of the attacks or their goals yet. Users should install the latest updates from F5 to protect their networks from ongoing threats.
Flaws in openDCIM Also Exploited
The news comes as VulnCheck showed attacks focusing on two serious problems in openDCIM, an open-source tool for managing data center infrastructure. These issues are both scored 9.3 on the CVSS scale, as listed below :
CVE-2026-28515: A missing authorization issue lets a logged-in user access LDAP settings even if they shouldn’t. In Docker setups where REMOTE_USER is used without checking who the user is, the endpoint can be accessed without a password. This means someone could change the app settings without permission.
CVE-2026-28517: An operating system command injection vulnerability impacting the “report_network_map.php” component that processes a parameter called “dot” without sanitization and passes it directly to a shell command, resulting in arbitrary code execution.
Security researcher Valentin Lobstein from VulnCheck in 2026 discovered the two vulnerabilities alongside CVE-2026-28516 , an SQL injection vulnerability in openDCIM. According to Lobstein, the three flaws can be chained to achieve remote code execution over five HTTP requests and spawn a reverse shell.
“The cluster of attacker activity we’re observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP web shell,” Caitlin Condon, vice president of security research at VulnCheck, said.
