Full Daily Digest

The NGINX vulnerability, CVE-2026-42945, stems from a heap buffer overflow in the ngx_http_rewrite_module, introduced in 2008. Attackers exploit this flaw via crafted HTTP requests, leading to worker crashes or, in rare cases, remote code execution when ASLR is disabled. The attack path requires knowledge of specific NGINX configurations, making exploitation targeted but feasible. Concurrently, openDCIM vulnerabilities (CVE-2026-28515, CVE-2026-28517, CVE-2026-28516) are being chained by a Chinese threat actor using AI-driven tools to automate vulnerability discovery and deploy PHP web shells. Mitigation includes applying patches from F5 for NGINX and enforcing strict authentication and input validation in openDCIM deployments. Organizations should also enable ASLR and monitor for suspicious HTTP traffic.

The Hacker News · 2026-05-17 · Vulnerability: NGINX CVE-2026-42945 exploited in the wild, enabling worker crashes and potential RCE on ASLR-disabled systems.

The Cisco SD-WAN zero-day and unpatched Microsoft Exchange flaw represent immediate risks, with attackers likely leveraging these for lateral movement and data exfiltration. The AI-assisted zero-day exploit targeting a web administration tool underscores the evolving sophistication of threat actors, particularly in bypassing 2FA through semantic logic errors. Defenders should prioritize patching and monitor for unusual authentication patterns. The rise in machine identities, especially AI agents, introduces new attack surfaces, necessitating robust identity management and monitoring solutions. Tools like Rustinel offer promise for unified endpoint detection, but organizations must balance AI adoption with oversight to avoid increased complexity and risk.

Help Net Security · 2026-05-17 · Vulnerability: Critical vulnerabilities in Cisco SD-WAN and Microsoft Exchange are actively exploited, while AI-assisted criminal zero-day exploits and surging machine identities dominate security concerns.

The breach began with the compromise of a GitHub token, granting the attacker access to Grafana's codebase. This attack path underscores the risks of insufficient token management and the need for robust access controls. While Grafana mitigated the incident by invalidating credentials and enhancing security, the extortion attempt highlights a shift in attacker tactics—focusing on data theft rather than encryption. Organizations must prioritize token lifecycle management, implement multi-factor authentication, and monitor GitHub activity for anomalies. Additionally, aligning with FBI guidance against ransom payments is critical to deter future attacks.

The Hacker News · 2026-05-17 · Incidents: Grafana's GitHub token breach led to codebase theft and extortion attempts by CoinbaseCartel, with no customer data compromised.