TheNde
보안· · 2분

NGINX Vulnerability: A Wake-Up Call.

Today in cybersecurity, we're seeing a mix of critical vulnerabilities and major competitions shaping the landscape. From serious exploits in Microsoft Exchange to a successful Pwn2Own event showcasing cutting-edge research, the stakes are high. Stay vigilant and informed.

한눈에
  1. NGINX Vulnerability: A Wake-Up Call
  2. Pwn2Own Berlin: Big Wins and Big Bucks
  3. Supply Chain Attacks: A Growing Concern
01 · 보안

NGINX Vulnerability: A Wake-Up Call

NGINX vulnerability could lead to critical security issues.
NGINX vulnerability could lead to critical security issues.

A newly discovered critical vulnerability in NGINX has made waves, with proof-of-concept code already circulating. This flaw, tracked as CVE-2026-42945, could allow remote code execution if exploited under certain conditions. It’s a reminder that even long-standing software can harbor serious risks.

02 · 보안

Pwn2Own Berlin: Big Wins and Big Bucks

Pwn2Own Berlin 2026 showcased critical vulnerabilities.
Pwn2Own Berlin 2026 showcased critical vulnerabilities.

Pwn2Own Berlin 2026 wrapped up with over $1.2 million awarded for zero-day exploits across three days. Researchers pushed boundaries, showcasing vulnerabilities in systems like Windows 11 and Microsoft Exchange. This event highlights the importance of security research in a rapidly evolving threat landscape.

03 · 보안

Supply Chain Attacks: A Growing Concern

Supply chain attacks impact multiple organizations.
Supply chain attacks impact multiple organizations.

The TanStack supply chain attack has put OpenAI in the spotlight, highlighting the risks of compromised packages in software development. With multiple organizations affected, it's a stark reminder of how interconnected our digital ecosystem is. Keeping software ecosystems secure is more critical than ever.

04 · 보안

Microsoft Exchange Under Threat

Microsoft Exchange server vulnerability poses serious risks.
Microsoft Exchange server vulnerability poses serious risks.

Microsoft has issued warnings regarding a zero-day flaw in Exchange Server exploited in the wild. The vulnerability allows for arbitrary code execution through crafted emails, underscoring the need for immediate mitigations. Organizations are advised to enable the Exchange Emergency Mitigation Service to protect against potential attacks.

05 · 보안

Credential Theft on the Rise

Compromised packages lead to credential theft.
Compromised packages lead to credential theft.

Recent attacks have seen popular packages like node-ipc compromised to steal credentials. Such incidents raise alarms about the security of widely-used software libraries. Developers must remain vigilant about the packages they include in their projects.

핵심 숫자
$1.2M

Total amount awarded at Pwn2Own Berlin 2026 for zero-day vulnerabilities.

출처
137

Number of vulnerabilities patched by Microsoft in their latest update, including critical zero-days.

출처
84

Malicious artifacts released in the recent TanStack supply chain attack.

출처
주요 뉴스
SecurityWeek

Microsoft Exchange Server Zero-Day Exploited

Microsoft has confirmed that a newly disclosed zero-day vulnerability in Exchange Server is being actively exploited. The flaw allows attackers to execute arbitrary code via crafted emails, necessitating immediate mitigation measures.

Zero Day Initiative

Pwn2Own Berlin 2026: Record-Breaking Event

The Pwn2Own Berlin event concluded with a staggering $1.2 million awarded for zero-day exploits. The competition showcased vulnerabilities in major platforms, reinforcing the critical role of white-hat hackers.

BleepingComputer

Compromised npm Packages Targeting Developers

The popular node-ipc package has been compromised to inject credential-stealing malware. This incident raises concerns about the security of software supply chains and the need for vigilant package management.

빠른 링크
  1. Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout SkimmingA critical flaw in the Funnel Builder plugin for WordPress is being exploited to steal credit card information. — The Hacker News
  2. Russian Hackers Turn Kazuar Backdoor Into Modular P2P BotnetRussian hackers have transformed the Kazuar backdoor into a modular peer-to-peer botnet designed for stealth and persistence. — BleepingComputer
  3. CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access ExploitsCISA has added a new Cisco SD-WAN vulnerability to its Known Exploited Vulnerabilities catalog. — The Hacker News
  4. Chrome 148 Update Patches Critical VulnerabilitiesGoogle released an update for Chrome 148 addressing 79 vulnerabilities, including several critical issues. — SecurityWeek
  5. Microsoft Rejects Critical Azure Vulnerability Report, No CVE IssuedA researcher claims Microsoft has silently patched a critical Azure vulnerability without issuing a CVE. — BleepingComputer
  6. Avada Builder WordPress Plugin Flaws Allow Site Credential TheftTwo vulnerabilities in the Avada Builder plugin could allow attackers to steal sensitive information. — BleepingComputer
  7. American Lending Center Data Breach Affects 123,000 IndividualsA data breach at American Lending Center has impacted over 123,000 individuals, including sensitive personal information. — SecurityWeek