PAN-OS

This week proves that old vulnerabilities never die — they just wait for someone to look. NGINX Rift is an 18-year-old heap buffer overflow in the rewrite module that delivers RCE, discovered by an autonomous code analysis system. Exim’s Dead.Letter achieves unauthenticated remote code execution through a use-after-free triggered by a single stray byte in GnuTLS. Palo Alto ships a second PAN-OS RCE in two weeks — this time in IKEv2 processing. Microsoft’s May Patch Tuesday delivers 137 CVEs including critical Windows Netlogon and DNS overflows. And GreenPlasma (SB2026051378) continues Chaotic Eclipse’s disclosure campaign with a ctfmon.exe section hijack that escalates standard users to SYSTEM on Windows 11. Meanwhile in the lab, Pupy C2 completed its Python 3 migration, Nextcloud got a major version upgrade, Tailscale funnel replaced port forwarding for Plex remote access, and Max’s weekly audit found critical firewall gaps across two homelab hosts. ...

This week is a gut check for anyone who thinks patching is optional. A Palo Alto firewall zero-day gives unauthenticated root — and it’s been exploited since April 9. ShinyHunters breached Canvas LMS, stole data from 8,800 schools, then defaced 330 university login portals during finals week. DigiCert, one of the world’s largest certificate authorities, was compromised through a malicious screensaver file that led to stolen code-signing certificates. RansomHouse hit Trellix, the cybersecurity firm born from the McAfee/FireEye merger. Ivanti dropped another EPMM zero-day — their third this year — and CISA gave agencies just three days to patch. And the vm2 Node.js sandboxing library has another escape, this time via WebAssembly. Meanwhile in the lab, we deployed Termix + Apache Guacamole for browser-based remote access, killed Gmail’s Smart Features, and took a hard look at homelab attack surfaces after Max’s weekly audit. ...