@jerry Looks like there was a new release of nginx earlier today to address the unpatched RCE (CVE-2026-9256)

The previous announced sibling vulnerability to "nginx rift" has been fixed by F5 and has been assigned CVE-2026-9256):

https://my.f5.com/manage/s/article/K000161377

This was previously called "nginx-poolslip" (https://nitter.net/nebusecurity/status/2057071579876753643) and is a DoS with possible RCE ("if the attacker can bypass ASLR" - not sure how?), using a similar regex capture vector.

Wouldn't be surprised if this is the new norm: one vuln lands, everybody points their AI at that attack vector and discovers sibling vulns.

Another vuln in NGINX rewriting. Looks pretty similar to the last one. Requires ASLR bypass or disabled for RCE.

https://my.f5.com/manage/s/article/K000161377

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. (CVE-2026-9256)

LiteSpeed cPanel Plugin Zero-Day (CVE-2026-48172) Actively Exploited to Gain Server Root Access
#CyberSecurity
https://securebulletin.com/litespeed-cpanel-plugin-zero-day-cve-2026-48172-actively-exploited-to-gain-server-root-access/

@apz LOL very timely, just on that note, say hello to CVE-2026-9082
Not that I would trust Drupal or any other modern or ancient CMS any longer than I could throw it.

📰 Critical Unauthenticated SQLi Flaw in Drupal Core Hits PostgreSQL Sites

🚨 CRITICAL vulnerability in Drupal Core (CVE-2026-9082)! Unauthenticated SQL injection affects sites using PostgreSQL, allowing for potential RCE. Patch immediately! #Drupal #CyberSecurity #SQLi #Vulnerability

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/critical-sql-injection-vulnerability-cve-2026-9082-in-drupal-core-for-postgresql/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Linux fans, please tell me you have updated your machine for "CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path", right… right!?

@ruario No, because Ubuntu doesn't have updates yet... https://ubuntu.com/security/CVE-2026-46333

La faille CVE-2026-42945 nom de code « Nginx Rift » (note CVSS 9.2) a désormais sa page dédiée : https://depthfirst.com/nginx-rift
Les paquets pour Debian 13/12/11 sont bien disponibles depuis quelques jours https://security-tracker.debian.org/tracker/CVE-2026-42945 (les paquets ELS devraient arriver prochainement) #nginxrift

NGINX Rift (CVE-2026-42945): unauthenticated heap overflow triggered by unnamed PCRE captures plus a "?" in rewrite rules. Grep your configs tonight. DoS is trivial, RCE is hard but not theoretical. Akamai conveniently sells the bandage.
https://www.akamai.com/blog/security-research/2026/may/nginx-critical-heap-buffer-overflow-cve-2026-42945

@cR0w fr tho, I am somewhat torn on *aaS CVEs in general. Like, where is the line between CVE-2026-41104 in Microsoft Planetary Computer Pro and our local Kebab Shops website having an XSS? I can tell you the latter is rather critical infrastructure for our Security Department, I am sure someone out there also relies on the former :neobot_giggle: .

Like, there is a line, but I cant put my thumb on it

🛡️ CRITICAL: CVE-2026-41104 in Microsoft Planetary Computer Pro (GeoCatalog) enables remote, unauthenticated info disclosure via insecure deserialization. Patch now — official fix available. Details: https://radar.offseq.com/threat/cve-2026-41104-cwe-502-deserialization-of-untruste-e4c1701e #OffSeq #Vulnerability #InfoSec #Microsoft

📰 Warning: Microsoft Defender Flaws Actively Exploited to Gain SYSTEM Privileges

⚠️ ACTIVE EXPLOITATION ALERT: Flaws in Microsoft Defender (CVE-2026-41091, CVE-2026-45498) are being used by attackers to gain SYSTEM privileges and disable AV. Patch the Malware Protection Engine immediately! #CyberSecurity #Vulnerability #PatchNow

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/microsoft-defender-vulnerabilities-actively-exploited-for-privilege-escalati…

📰 Warning: Microsoft Defender Flaws Actively Exploited to Gain SYSTEM Privileges

⚠️ ACTIVE EXPLOITATION ALERT: Flaws in Microsoft Defender (CVE-2026-41091, CVE-2026-45498) are being used by attackers to gain SYSTEM privileges and disable AV. Patch the Malware Protection Engine immediately! #CyberSecurity #Vulnerability #PatchNow

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/microsoft-defender-vulnerabilities-actively-exploited-for-privilege-escalati…

Metasploit's latest release includes working exploits for CVE-2023-7102 (Barracuda RCE), CVE-2026-20182 (Cisco SD-WAN auth bypass), CVE-2026-41940 (cPanel root escalation), and CVE-2026-24479 (HUSTOJ zip-slip)....

https://captechgroup.com/about-us/threat-intelligence-center/metasploit-exploits-five-critical-vulnerabilities-05b155?utm_source=mastodon&utm_medium=social&utm_campaign=threat_intel&utm_content=metasploit-exploits-five-critical-vulnerabilities-across-email-security-and-netw