Patch-Tuesday

This week proves that old vulnerabilities never die — they just wait for someone to look. NGINX Rift is an 18-year-old heap buffer overflow in the rewrite module that delivers RCE, discovered by an autonomous code analysis system. Exim’s Dead.Letter achieves unauthenticated remote code execution through a use-after-free triggered by a single stray byte in GnuTLS. Palo Alto ships a second PAN-OS RCE in two weeks — this time in IKEv2 processing. Microsoft’s May Patch Tuesday delivers 137 CVEs including critical Windows Netlogon and DNS overflows. And GreenPlasma (SB2026051378) continues Chaotic Eclipse’s disclosure campaign with a ctfmon.exe section hijack that escalates standard users to SYSTEM on Windows 11. Meanwhile in the lab, Pupy C2 completed its Python 3 migration, Nextcloud got a major version upgrade, Tailscale funnel replaced port forwarding for Plex remote access, and Max’s weekly audit found critical firewall gaps across two homelab hosts. ...

Windows Defender Is the Target Now This week’s headline isn’t about some exotic exploit kit. It’s about the security tool itself getting owned. Three zero-days targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have shifted from proof-of-concept to active in-the-wild exploitation. All three come from the same researcher (Nightmare-Eclipse / Chaotic Eclipse), who released exploit code publicly in protest over Microsoft’s handling of the disclosure process. Huntress Labs has confirmed hands-on-keyboard attackers combining these with compromised SSL VPN credentials for real intrusions. ...