Weekly Threat & Lab Roundup: NGINX Rift, Exim Dead.Letter, PAN-OS IKEv2 RCE, Patch Tuesday 137 CVEs, and Pupy Python 3 Migration Milestone

This week proves that old vulnerabilities never die — they just wait for someone to look. NGINX Rift is an 18-year-old heap buffer overflow in the rewrite module that delivers RCE, discovered by an autonomous code analysis system. Exim’s Dead.Letter achieves unauthenticated remote code execution through a use-after-free triggered by a single stray byte in GnuTLS. Palo Alto ships a second PAN-OS RCE in two weeks — this time in IKEv2 processing. Microsoft’s May Patch Tuesday delivers 137 CVEs including critical Windows Netlogon and DNS overflows. And GreenPlasma (SB2026051378) continues Chaotic Eclipse’s disclosure campaign with a ctfmon.exe section hijack that escalates standard users to SYSTEM on Windows 11. Meanwhile in the lab, Pupy C2 completed its Python 3 migration, Nextcloud got a major version upgrade, Tailscale funnel replaced port forwarding for Plex remote access, and Max’s weekly audit found critical firewall gaps across two homelab hosts.

NGINX Rift: CVE-2026-42945 — An 18-Year-Old Heap Overflow Delivers RCE

Security research firm depthfirst used their autonomous code analysis system to scan the NGINX source code. After six hours, the system identified 4 remote memory corruption issues — all confirmed by the NGINX security team. The most critical one has been lurking since 2008.

The Vulnerability

CVE-2026-42945 (CVSS 9.2 Critical) is a heap buffer overflow in ngx_http_rewrite_module. It’s triggered when a rewrite directive contains a question mark (causing the script engine to permanently set e->is_args = 1), followed by a set directive referencing a regex capture group. The two-pass script engine design — first pass calculates buffer size, second pass copies data — breaks because the is_args flag is never reset between passes. The length calculation underestimates the buffer needed, and the copy phase writes attacker-controlled escaped URI data past the heap boundary.

The vulnerability affects NGINX 0.6.27 through 1.30.0 — that’s every version for 18 years. Any server using rewrite and set directives together (common in API gateway configurations) is vulnerable.

Three Additional CVEs

The AI Discovery Angle

This is worth calling out specifically: the initial findings were discovered autonomously by depthfirst’s analysis system, which generated vulnerability descriptions, root cause analysis, and proof-of-concept code without human intervention. The PoC demonstrates RCE with ASLR off. A public exploit is now available on GitHub (580+ stars). If you run NGINX with rewrite+set, patch to 1.31.0 immediately.

Remediation

# Check your NGINX version
nginx -v

# Upgrade to 1.31.0+ (released May 13, 2026)
# Package managers:
sudo apt update && sudo apt upgrade nginx    # Debian/Ubuntu
sudo yum update nginx                          # RHEL/CentOS

# Workaround if you can't upgrade immediately:
# Avoid using rewrite + set directives in the same location block
# Audit your nginx.conf for the pattern:
grep -r "rewrite.*set\|set.*rewrite" /etc/nginx/

Homelab Impact

Our Nginx Proxy Manager on the Pi 5 uses nginx under the hood with rewrite rules for custom domain routing. We’re running the NPM containerized build which bundles its own nginx binary — the fix requires an NPM image update, not a host-level nginx upgrade. Added to the watch list.

Exim Dead.Letter: CVE-2026-45185 — Unauthenticated RCE via GnuTLS Use-After-Free

XBOW security discovered CVE-2026-45185: a remotely reachable use-after-free in Exim’s BDAT body parsing path when built with GnuTLS. The trigger? A client sends a TLS close_notify mid-transaction during binary data transmission. This causes a one-byte offset error in Exim’s receive buffer tracking — a single stray byte that corrupts heap metadata and enables full remote code execution, unauthenticated, from the network.

Why This Matters

Exim is the default MTA on Debian and many Linux distributions. It handles email routing for roughly half the internet’s mail servers. An unauthenticated RCE in Exim is the kind of vulnerability that gets wormed. The last time Exim had a critical RCE (CVE-2019-10149 in 2017), it was mass-exploited within days of public disclosure.

Affected Configurations

• Exim built with GnuTLS (not OpenSSL — OpenSSL builds are unaffected)
• Versions before 4.99.3
• The vulnerability is in the BDAT (binary data) command path

Remediation

# Check if you're running Exim with GnuTLS
exim -bV | grep -i "TLS\|GnuTLS"

# Upgrade to 4.99.3+
# Debian/Ubuntu:
sudo apt update && sudo apt upgrade exim4

# If you can't upgrade immediately, consider switching to OpenSSL build:
# Rebuild Exim with USE_OPENSSL=yes in Local/Makefile

Homelab Note

Our homelab doesn’t run Exim (email goes through Gmail/Maton), so no direct exposure. But if you’re running any Linux server that handles mail, check your MTA now.

CVE-2026-0263: PAN-OS IKEv2 RCE — Palo Alto’s Second RCE in Two Weeks

Just one week after the Captive Portal zero-day (CVE-2026-0300) dominated headlines, Palo Alto Networks disclosed CVE-2026-0263: a remote code execution vulnerability in IKEv2 processing. CVSS 7.2 (High), urgency rated HIGHEST by PAN-OS PSIRT.

Details

An unauthenticated attacker can achieve RCE by sending crafted IKEv2 packets to the firewall. Unlike the Captive Portal vulnerability which required the portal to be enabled, IKEv2 is enabled by default on any PAN-OS device terminating VPN connections — which is most of them.

Affected Versions

• PAN-OS 11.1 (fixed in 11.1.x)
• PAN-OS 11.2 (fixed in 11.2.x)
• PAN-OS 12.1 (fixed in 12.1.x)
• Cloud NGFW and Prisma Access also affected

The Pattern

Two critical RCEs in two weeks from the same vendor is a pattern, not a coincidence. PAN-OS is a monolithic network operating system with decades of accumulated code. The attack surface — captive portals, IKEv2, web interfaces, management planes — is enormous. If you’re running PAN-OS, treat every disclosure as potentially exploitable and maintain aggressive patch cadences.

Microsoft May 2026 Patch Tuesday: 137 CVEs, 31 Critical, No Zero-Days

Microsoft shipped fixes for 137 vulnerabilities this Patch Tuesday, including 31 rated Critical. No active zero-days this month — a rare piece of good news. But the criticals are alarming.

Standout Criticals

CVE-2026-41089 and CVE-2026-41096 are the most concerning. A Netlogon overflow enabling unauthenticated RCE over the network is the kind of vulnerability that enabled the Zerologon attack (CVE-2020-1472). DNS server overflow is equally dangerous in Active Directory environments — a malicious DNS response could compromise the DNS server itself.

AI-Discovered CVEs

Microsoft noted that 16 of the 120 CVEs were discovered by their new multi-model agentic security system. This is the second month running where AI-assisted vulnerability discovery has produced significant findings. The NGINX Rift discovery by depthfirst’s autonomous system (above) is part of the same trend. AI-driven code auditing is no longer theoretical.

Remediation

Deploy the May 2026 cumulative updates immediately. Priority targets:

1. Domain Controllers — Netlogon and DNS vulnerabilities
2. Exchange Servers — check for any Exchange-specific CVEs
3. Internet-facing Windows Servers — network-accessible RCE vectors

# Check installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

# Or via WSUS/MECM for enterprise deployments

GreenPlasma (SB2026051378): CTFMON Section Hijack — Standard User → SYSTEM on Windows 11

The Chaotic Eclipse / Nightmare-Eclipse disclosure campaign continues with GreenPlasma, tracked as security bulletin SB2026051378. Following BlueHammer, RedSun, UnDefend, and YellowKey, this latest entry exploits ctfmon.exe (the Text Services Framework surrogate) to achieve privilege escalation from standard user to SYSTEM on Windows 11.

The Attack Chain

1. Symlink creation: Attacker creates a junction/symlink at a path that ctfmon.exe will traverse
2. ctfmon trigger: Force ctfmon.exe to create a named section object at the symlinked path
3. Section hijack: The created section inherits the security descriptor of the target path
4. ACL manipulation: Modify the section’s DACL to allow write access
5. Payload injection: Write shellcode or DLL into the section
6. Execution: ctfmon.exe, running as SYSTEM, loads/executes the injected content
7. Persistence: The section persists across logon sessions

Key Details

• No CVE assigned yet — no patch available
• Windows 10 not affected (different ctfmon implementation)
• Windows 11 vulnerable — tested and confirmed
• Public PoC on GitHub (363+ stars)
• Requires standard user — running as admin may not trigger the correct code path

We tested the PoC on our Windows 11 baremetal host. Stages 1-2 succeeded (symlink created, ctfmon triggered), but Stage 3 timed out — ctfmon didn’t create the section at the symlinked path when running as admin. A proper test requires a true standard user account, which is the realistic attack scenario anyway.

Detection

# Monitor for ctfmon.exe creating sections in unusual paths
# Sysmon Event ID 5 (ObjectCreated) with Image = ctfmon.exe
# Look for section objects created in user-writable directories

In the Lab: Pupy C2 Python 3 Migration, Nextcloud Upgrade, Tailscale Funnel, and Critical Audit Findings

Pupy C2 Completes Python 3 Migration

This was the week’s biggest lab effort. The Pupy C2 framework — an open-source remote administration tool we’ve been modernizing — completed its Python 3 migration after months of incremental work. Here’s what happened:

12 commits in one afternoon session:

1. Stripped all bare except: clauses → except Exception:
2. Deleted the Python 2 library_patches_py2/ directory
3. Removed __future__ imports, version guards, and Py2 compat blocks (443 files, -2,846 lines)
4. Replaced Py2 types: unicode→str, basestring→str, long→int, xrange→range
5. Replaced Py2 imports: urllib2, ConfigParser, StringIO
6. Replaced creddump7 with pypykatz for credential dumping
7. Added HTTP fronting transport (http_front) for CDN domain fronting
8. Added Flake8 CI workflow
9. Added type hints, SQLite session persistence, module auto-reload watcher
10. Final Py2 remnant cleanup 11-12. Lint fixes and README accuracy updates

Then the runtime hit. The server wouldn’t start. The root cause? Not Python 3 breakage — an expired SSL CA certificate from 2016 (notAfter=2019). The M2Crypto library couldn’t compile with modern OpenSSL/SWIG, so we replaced it entirely with Python’s cryptography library. Key generation dropped from >5 minutes to 1.5 seconds.

Five new post-exploitation modules added:

All use pure ctypes, RW→RX memory flip, no external dependencies, Python 3 only.

28/28 tests passing, Flake8 CI clean, README overhauled with accurate format tables (11 formats, 14 transports).

Nextcloud v33.0.3 Upgrade

Upgraded the Docker-VM Nextcloud instance from v30 to v33.0.3. The upgrade path:

• NC image: 30 → latest (v33.0.3)
• MariaDB: 10.5 → 10.11
• PHP memory_limit: 1G → 2G
• PHP opcache: 128 → 256
• Added container memory limits: NC 2G, DB 768M, Redis 256M
• Pruned 17.58GB of unused Docker images (27 → 14 images)
• All config survived the recreate: trusted_proxies, domains, loglevel

Tailscale Funnel Replaces Port Forwarding for Plex

We killed port 32400 on the router and replaced it with Tailscale funnel on the Pi 5:

tailscale funnel --bg --https 443 https+insecure://192.168.2.40:32400

Plex is now accessible at https://pi5.adal-pancake.ts.net/. The routing:

• LAN: plex.ricanwarfare.com → AdGuard DNS rewrite → 192.168.2.40 (direct to NAS)
• Remote: NPM 301 redirect → pi5.adal-pancake.ts.net → Tailscale funnel → Plex

Cloudflare CNAME is set to DNS-only (grey cloud) — no Cloudflare proxying of video traffic (ToS compliant). NPM proxy host handles the redirect with SSL wildcard cert, HTTP/2, and Block Exploits enabled.

Also fixed a double-HTTPS redirect bug in the NPM nginx configuration (changed https:// to $scheme:// in the redirect directive).

NPM Proxy Audit & Hardening

Audited all 21 NPM proxy hosts on the Pi 5:

• WebSocket enabled on 8 services that needed it (cloud, chat, immich, jellyfin, qbittorrent, kasm, portal, adguard)
• Cloudflare real_ip + set_real_ip_from added to 7 hosts missing it (adguard, chrome, drop, kavita, opbtracker, pdf, ssh)
• Block Exploits enabled on 3 hosts missing it (adguard, jellyfin, kavita)
• NPM mem_limit set to 512m (was unlimited), cloudflared 128m

Max’s Weekly Security Audit: Critical Findings

Max (our security subagent) ran the weekly audit on May 10. The results were a wake-up call:

🔴 CRITICAL — Docker-VM has NO firewall. UFW is completely inactive. All Docker containers are directly accessible from the LAN with zero host-level filtering.

🔴 CRITICAL — CVE-2026-31431 “Copy Fail” — Linux kernel LPE via algif_aead crypto interface. All Linux hosts in the lab are running unpatched kernels. Public PoC available, in-the-wild exploitation confirmed.

🟠 HIGH — Pi 5 INPUT policy is ACCEPT. Only Tailscale-specific rules exist. AdGuard admin panel (8181) and Uptime Kuma (3001) are accessible from any LAN IP.

🟠 HIGH — Multiple Ollama CVEs — heap OOB read (CVE-2026-7482), auth bypass (CVE-2025-63389), and Windows auto-update RCE (CVE-2026-42248/42249).

🟡 MEDIUM — AdGuard Home arbitrary file read (CVE-2024-36814), Proxmox XSS in three datacenter fields, runc container escape (CVE-2025-52881).

Tailscale Audit & Fixes

• DNS loop fixed: Global nameserver was pointing to the Pi 5 itself (loop) → changed to 192.168.2.56 (AdGuard)
• Split DNS added: ricanwarfare.com → 192.168.2.56
• IPv6 forwarding enabled on Pi 5 and persisted
• UDP GRO enabled on eth0 via systemd unit
• Stale devices identified: el-ipad (188 days), ipad153 (68 days) — recommended removal
• Apple TVs advertising as exit nodes unnecessarily — recommended disabling

Other Lab Work

• OPB Tracker: 8-feature UX overhaul (auto-save, copy-to-clipboard, MPA validation, duplicate-for-cycle, dashboard search, compact mode, dark mode, comparison view)
• Momentum Fusion v3.1: Fixed ghost position bug in eod_flush(), added open_orders_for() and cancel_orders_for() to AlpacaClient
• qBittorrent recovery: Stale lockfile/ipc-socket caused crash loop; removed stale files, restarted container
• LiteParse updated to 1.5.3, converted 6 PDFs to markdown
• ACP (Agent Communication Protocol) setup: Installed @openclaw/acpx plugin, configured Claude/Codex/Gemini/OpenCode/Cursor harnesses
• Proxmox snapshot: snapshot_2026_05_12_2011 on VM 115

Week in Review: The Old Is New Again

NGINX Rift is the story of the week. An 18-year-old vulnerability, discovered by an AI system, with a public exploit — in the software that powers a third of the internet. It’s a reminder that the bugs that hurt most aren’t the novel zero-days; they’re the ones that have been sitting in the codebase since 2008, waiting for someone — or something — to look.

Exim’s Dead.Letter follows the same pattern: a use-after-free in well-trodden code, triggered by a single byte offset. The AI discovery trend is accelerating — Microsoft’s own agentic system found 16 CVEs this Patch Tuesday, and depthfirst’s autonomous scanner found four memory corruption issues in NGINX after six hours of analysis.

In the lab, the Pupy Python 3 migration hit a major milestone: the server runs, credentials generate, payloads pack, and 28 tests pass. The remaining work (Docker build verification, end-to-end callback test, async event loop refactor) is non-trivial but the foundation is solid. The homelab audit findings — especially the missing firewalls on Docker-VM and Pi 5 — are the immediate priority.

Next week’s priorities:

1. 🔴 Enable UFW on Docker-VM and Pi 5
2. 🔴 Patch Linux kernels across all hosts (CVE-2026-31431)
3. 🟠 Update Ollama and AdGuard Home
4. 🟠 Investigate unknown NAS ports (8888, 8989, 8388, 5510, 7878, 8191)
5. 🟡 Pupy end-to-end callback test with separate target VM
6. 🟡 Update NPM container image for NGINX 1.31.0 fix

Weekly threat and lab roundup for May 10–16, 2026. Threat intelligence compiled from NVD, vendor advisories, BleepingComputer, and depthfirst research. Lab updates sourced from daily operations logs and Max’s weekly security audit.