Greenplasma

This week proves that old vulnerabilities never die — they just wait for someone to look. NGINX Rift is an 18-year-old heap buffer overflow in the rewrite module that delivers RCE, discovered by an autonomous code analysis system. Exim’s Dead.Letter achieves unauthenticated remote code execution through a use-after-free triggered by a single stray byte in GnuTLS. Palo Alto ships a second PAN-OS RCE in two weeks — this time in IKEv2 processing. Microsoft’s May Patch Tuesday delivers 137 CVEs including critical Windows Netlogon and DNS overflows. And GreenPlasma (SB2026051378) continues Chaotic Eclipse’s disclosure campaign with a ctfmon.exe section hijack that escalates standard users to SYSTEM on Windows 11. Meanwhile in the lab, Pupy C2 completed its Python 3 migration, Nextcloud got a major version upgrade, Tailscale funnel replaced port forwarding for Plex remote access, and Max’s weekly audit found critical firewall gaps across two homelab hosts. ...

TL;DR GreenPlasma (SB2026051378) is an unpatched Windows privilege escalation that chains a ctfmon.exe section creation bug with registry symlink hijacking and DACL relaxation to go from standard user → SYSTEM with zero interaction. No CVE assigned yet. No patch available. Affected: Windows 11, Windows Server 2022/2026 Not affected: Windows 10 (different ctfmon implementation) Requires: Standard user, interactive session Impact: Full SYSTEM shell Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/GreenPlasma The Context: Chaotic Eclipse’s Disclosure Campaign This is the fifth zero-day from the researcher Chaotic Eclipse (aka Nightmare-Eclipse), who has been publicly releasing Windows vulnerabilities after disputes with Microsoft’s MSRC over bug bounty responses. ...