VulnHub

Researchers have identified multiple vulnerabilities in NGINX Plus and NGINX Open, including a severe flaw that has existed for 18 years. The most critical issue, a heap buffer overflow in the ngx_http_rewrite_module (CVE-2026-42945), could allow attackers to execute arbitrary code remotely without authentication. This vulnerability has a high severity score of 9.2 on the CVSS v4 scale. Organizations using these web servers are at risk, as the flaw could lead to significant security breaches. It is crucial for affected users to address this vulnerability promptly to safeguard their systems.

A serious vulnerability has been found in certain configurations of the Exim mail transfer agent, which could allow remote attackers to execute arbitrary code without authentication. This flaw poses a significant risk to systems running Exim, as it could lead to unauthorized access and control over affected servers. Organizations using Exim should take immediate action to assess their configurations, as attackers could exploit this vulnerability if not addressed promptly. The issue emphasizes the need for regular updates and security checks in mail server configurations to protect against potential breaches. Users and administrators are advised to stay vigilant and ensure they are running the latest versions of the software.

A serious vulnerability, identified as CVE-2025-32975, has been discovered in Quest KACE SMA, an endpoint management tool used by organizations to oversee their IT assets. This flaw poses a significant risk as it could allow attackers to compromise all managed systems within affected organizations. Researchers have determined that around 60 organizations may be vulnerable due to this unpatched issue. The potential for widespread impact makes it crucial for companies using this software to take immediate action to secure their systems. Ignoring this vulnerability could lead to severe operational disruptions and data breaches.

Foxconn, known as the largest electronics manufacturer globally, has confirmed that it was hit by a cyberattack attributed to the Nitrogen ransomware gang. The attack has affected some of its North American factories, prompting disruptions in operations. While Foxconn is working to restore normalcy, the incident raises concerns about the vulnerability of major manufacturing firms to cyber threats. Ransomware attacks like this often target essential infrastructure, which can lead to significant financial and operational repercussions. As the situation develops, stakeholders in the electronics supply chain will need to assess their security measures to prevent similar incidents.

Sasha Levin, a co-maintainer of the Linux kernel, has introduced a proposal for a runtime killswitch designed to disable vulnerable kernel functions temporarily. This mechanism would be accessible through securityfs, allowing system administrators to quickly mitigate risks associated with known vulnerabilities. The proposal aims to provide a practical solution for managing vulnerabilities in the Linux kernel, which is critical given the widespread use of Linux in servers and devices. By enabling a quick response to potential exploits, this initiative could help enhance the security posture of systems utilizing the Linux kernel. The implementation of such a killswitch is especially relevant as cyber threats continue to evolve, targeting vulnerabilities in operating systems.

A newly discovered vulnerability, identified as CVE-2026-41940, is affecting cPanel and WebHost Manager, allowing attackers to exploit it shortly after it was made public. The threat actor known as Mr_Rot13 has been observed using this flaw to deploy a backdoor known as Filemanager, which can grant unauthorized access to compromised systems. This situation poses serious risks to web hosting providers and their customers, as it could lead to data breaches and unauthorized control over hosted websites. Companies using affected versions of cPanel and WebHost Manager need to take immediate action to secure their systems and protect sensitive data from being exploited. The urgency of addressing this vulnerability cannot be overstated, given the potential for widespread impact on affected users.

A serious security vulnerability in cPanel, identified as CVE-2026-41940, is currently being exploited by a threat actor known as Mr_Rot13. This flaw allows attackers to bypass authentication and gain elevated control over cPanel and WebHost Manager (WHM) environments. The exploitation of this vulnerability has led to the deployment of a backdoor named Filemanager on compromised systems. This incident is particularly concerning because it puts web hosting environments at risk, potentially allowing unauthorized access to sensitive data and control over web applications. Users and administrators of affected cPanel and WHM versions need to be vigilant and take immediate action to secure their systems.

Instructure, the company behind the Canvas learning management system, has acknowledged that a security flaw was exploited by hackers to alter Canvas login portals. This breach allowed the attackers to leave an extortion message, raising serious concerns about the security of educational platforms used by schools and students. The incident underscores the vulnerability of widely used technologies in the education sector, as they can be targeted for malicious purposes. Users of Canvas, including students and educators, may face disruptions or potential data risks due to this security lapse. It's crucial for institutions to evaluate their security measures and ensure that similar vulnerabilities are patched to prevent future incidents.

A new vulnerability known as Dirty Frag has been discovered in the Linux kernel, raising alarms among security professionals. This bug could allow attackers to exploit systems running affected versions of the kernel, potentially leading to unauthorized access or control. Users and organizations that rely on Linux-based systems, particularly those using versions released in recent years, need to take immediate action to mitigate risks. As of now, there is no straightforward fix available, which adds to the urgency of the situation. It's crucial for system administrators to monitor updates from their Linux distributions and apply any available security patches as soon as they are released to protect their systems from potential exploitation.

A vulnerability known as Dirty Frag has been discovered in Linux systems, which could allow attackers to gain root access. This flaw has been around for nine years and is particularly concerning because proof-of-concept (PoC) exploit code is now publicly available, increasing the risk of exploitation. Users and organizations running vulnerable Linux distributions should be aware that this could lead to severe security breaches if not addressed. It is crucial for system administrators to assess their systems for this vulnerability and take immediate action to mitigate potential threats. The ongoing presence of this flaw emphasizes the need for regular updates and vigilance in maintaining system security.