Daily · 2026-05-18
🔴 NGINX Exploitation Active, 🪟 Windows MiniPlasma Zero-Day, 🏢 Grafana Breach Confirmed, 🐧 DirtyDecrypt PoC, 🤖 Claude Code RCE, 🍎 Apple M5 Kernel Exploit
Critical: NGINX Rift exploitation confirmed over the weekend with 5.7M exposed servers; Windows MiniPlasma zero-day PoC grants SYSTEM on fully patched Windows 11; DirtyDecrypt PoC adds fourth Dirty Frag-class Linux LPE. Major incidents: Grafana Labs breach via stolen GitHub token (Coinbase Cartel); Tycoon2FA returns with OAuth device-code phishing. Patch priorities: Claude Code RCE (v2.1.118), NGINX rewrite patches, and PHP image-processing memory bugs.
Active exploitation of CVE-2026-42945, the NGINX heap buffer overflow in the rewrite module that went undetected for 18 years, is the day's defining story. VulnCheck confirmed in-the-wild attacks over the weekend, with roughly 5.7 million internet-exposed servers potentially vulnerable and a public PoC that includes an ASLR bypass. Patches shipped last week, so deployments using rewrite or set directives have no excuse for delay. NGINX Rift
The MiniPlasma zero-day is a different kind of problem: a claimed privilege escalation to SYSTEM on fully patched Windows 11 through the cldflt.sys cloud filter driver, with a PoC and the suggestion that a 2020 report was never properly fixed. Public exploit code for an unpatched Windows LPE is a real exposure, and detection engineering for it should not wait for an official patch. Windows MiniPlasma zero-day
Two threads deserve attention. The Grafana Labs breach shows a pull_request_target workflow handing a privileged GitHub token to an attacker who forked a public repo, and the Fast16 framework shows offensive capability aimed at corrupting nuclear test simulations rather than stealing data, with tampering triggers keyed to uranium-compression density thresholds.
Watchlist: NGINX rewrite deployments, MiniPlasma detection coverage, and any CI system with pull_request_target workflows handling privileged tokens.