TL;DR
NGINX heap buffer overflow (CVE-2026-42533) patched; WordPress wp2shell RCE now has public exploits; UAC-0145 using ClickFix malware against Ukraine. Organizations running unpatched NGINX, WordPress, or vulnerable infrastructure must patch immediately.
Executive Summary
- NGINX critical heap buffer overflow (CVE-2026-42533) patched in versions 1.30.4, 1.31.3, and NGINX Plus 37.0.3.1 on July 15
- WordPress wp2shell RCE flaws now have public working exploits available, escalating patching urgency for all WordPress administrators
- Russian-attributed UAC-0145 using ClickFix CAPTCHA social engineering to deliver data-stealing malware to Ukrainian targets
- SonicWall SMA 1000 zero-days actively exploited since June 22 to gain root access; Inc ransomware confirmed chaining both vulnerabilities
- OpenSSL HollowByte memory exhaustion flaw shipped in June without CVE or advisory; 11-byte TLS requests can freeze unpatched servers on glibc systems
Top Threats Today
1. NGINX Heap Buffer Overflow – Remote Code Execution Risk
Severity: HIGH Affected: Technology
F5 has shipped fixes for a critical NGINX vulnerability allowing remote, unauthenticated attackers to trigger a heap buffer overflow in the worker process through crafted HTTP requests [1]. The flaw was patched on July 15, 2026, in NGINX stable version 1.30.4, mainline version 1.31.3, and NGINX Plus 37.0.3.1 [1]. Organizations still running earlier versions remain at risk.
Sources:[1] The Hacker News
Recommended Action
- Immediately upgrade NGINX to 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 or later
- Review access logs for anomalous HTTP requests targeting worker processes during the vulnerability window
- If immediate patching is not feasible, implement network segmentation to restrict untrusted HTTP traffic to NGINX instances
2. WordPress wp2shell RCE – Public Exploits Now Available
Severity: HIGH Affected: Technology
Critical WordPress Core RCE vulnerabilities dubbed “wp2shell” have been assigned CVE IDs, and working proof-of-concept exploits are now public [1][2]. The flaws allow unauthenticated HTTP requests to execute arbitrary code on WordPress sites; the full attack mechanism and a persistent-object-cache condition have been published [1]. Public exploit code has been released, making immediate patching imperative for all WordPress administrators [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Patch all WordPress Core installations to the latest stable version immediately
- Audit WordPress sites for signs of recent code execution or unauthorized administrator accounts
- Enable Web Application Firewall rules to block wp2shell exploitation patterns if patching is delayed
3. Russian APT UAC-0145 ClickFix Campaign – Targeted Malware Delivery
Severity: HIGH Affected: Government
Russian state-sponsored threat actors have been observed leveraging the ClickFix social engineering technique to trick Ukrainian targets into self-infecting with data-stealing malware [1]. The activity has been attributed to UAC-0145 by the Computer Emergency Response Team of Ukraine (CERT-UA) [1].
Sources:[1] The Hacker News
Recommended Action
- Educate users on ClickFix social engineering tactics: fake CAPTCHA overlays requesting system interaction
- Monitor for suspicious browser downloads and execution of unexpected executable files
- Block or alert on execution of common malware delivery vectors (PowerShell, WScript, unusual temp-folder activity)
4. SonicWall SMA Zero-Days Under Active Exploitation
Severity: HIGH Affected: Technology
Undocumented threat actors have been actively exploiting previously unknown vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days since June 22, 2026, prior to their public disclosure [1]. When chained together, the two vulnerabilities allow threat actors to gain root-level capabilities on the affected appliances [2]. Inc ransomware has been confirmed exploiting both flaws in active campaigns [2].
Sources:[1] The Hacker News[2] Dark Reading
Recommended Action
- Immediately apply SonicWall security updates for SMA 1000 series if available from vendor
- Isolate or disable SMA 1000 appliances if patches are not yet released
- Monitor VPN access logs for unauthorized root-level activity or sudden privilege escalations
- Prepare incident response for potential ransomware deployment on internal networks accessible via SMA
5. OpenSSL HollowByte Memory Exhaustion – Silent Server Freeze Risk
Severity: HIGH Affected: Technology
OpenSSL shipped a fix in June for the HollowByte flaw without issuing a CVE, advisory, or changelog entry ⚠[1]. Eleven-byte TLS requests can cause an unpatched OpenSSL server to allocate up to 131 KB of memory for a message that never arrives [1]. On glibc-based systems, that memory remains unavailable until the process restarts, effectively freezing server resources [1].
Sources:[1] The Hacker News
Recommended Action
- Update OpenSSL to the latest patched version immediately
- Monitor OpenSSL processes for unexpected memory growth or high memory utilization on TLS endpoints
- Consider implementing per-connection memory limits or connection timeouts to mitigate resource exhaustion from incomplete TLS handshakes
Ongoing Coverage
- Microsoft & Windows: Routine Patch Tuesday activity continues; see earlier coverage for the record-breaking 570-patch release.
- GitHub CISA Credential Leak: CISA has issued a postmortem on its contractor data breach exposing internal credentials and AWS Govcloud keys in a public repository for six months [12].
- FBI Seizes NetNut Proxy Platform: The FBI and industry partners seized hundreds of domains associated with NetNut, a residential proxy service operated by publicly-traded Alarum Technologies [14].
Today’s Action Checklist
- ☐ URGENT: Patch NGINX to 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 or later
- ☐ URGENT: Patch WordPress Core to latest version; audit sites for unauthorized access
- ☐ URGENT: Apply SonicWall SMA 1000 security updates or isolate appliances pending patches
- ☐ Update OpenSSL to latest patched version on all TLS-terminating servers
- ☐ Alert security and user-facing teams to ClickFix social engineering tactics targeting organization and region