Here's the PoC for Nginx CVE-2026-42945 which works against vanilla Ubuntu (and any other distro?) + Nginx with ASLR enabled. I have included all iterations of the PoC the LLM was kicked to improve.
TL;DR: We can use an LFI/file-read primitive to leak enough details from /proc/<nginx-worker>/mem to bypass ASLR and achieve reliable RCE, in most cases at first shot.
There are still other ways to make it work, with even less subtle primitives. If you ask Geppetto nicely, he will help you ;)
https://t.co/VawjqrMisN
@IntCyberDigest As explained in the description of the repository, it requires a LFI/read-file primitive. So you'd have another unfunny vulnerability as well
NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in @nginx impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at https://t.co/KeoblrGL24
Hard to patch if there's no patch. It's a 0day, and thank you for that.
Blocking the module has some more side-effects than the ones described, see https://t.co/gRUDttbSYQ
I call that irresponsible disclosure, change my mind.
Patch your Linux boxes!
https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX
Patch your Linux boxes!
https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX
@vxunderground > RHEL 14.3
Did the LLM code a special futuristic version of RHEL? (https://t.co/5Y2KejOFif)
Also https://t.co/3uWXC0mTTC may help to see what Ubuntu versions effectively are affected
Had an amazing time at @1ns0mn1h4ck, perfectly organized as always π₯
Favorite talk was probably @ElykDeer's one about the TantΕ plugin for @vector35 Binary Ninja π₯·
What's quite concerning is not only what @evilsocket found out. The fact that there's something going around at VINCE which leads to people having access to vulnerabilities people report using the "responsible" disclosure path..
Amazing research btw. Ignore the hate, keep it up
JUST IN - Global cyber outage. Cybersecurity platform CrowdStrike is "down" worldwide, causing global IT problems, Microsoft crashes, 911 outages across several US states, and disruptions in international airlines, banks and media outlets.
@I_AM_NO_LEGEND π It's pretty hard to answer that, security is a pretty wast area and has lots of subtopics which may interest you more than others. There's a link - https://t.co/TnLMnmOoJ2 - I like, though at some point you will have to find something more specific and targeted you enjoy :D