Inferlume

Top CVEs

CVE-2026-42945 NGINX heap buffer overflow exploited in the wild for denial of service and potential remote code execution. CVE-2026-41940 cPanel pre authentication root bypass exploited at scale to deploy ransomware and conscript botnets. CVE-2026-41089 Windows Netlogon stack buffer overflow allowing unauthenticated remote code execution on domain controllers. CVE-2026-48027 Nx Console Visual Studio Code extension vulnerability allowing developer workstation compromise. CVE-2026-48778 Notepad++ critical arbitrary code execution flaw triggered via malformed configuration files.

Attack Vectors This Week

The primary attack vectors observed this week centered heavily on package manager dependency confusion, typosquatting within public registries, and application extension poisoning. Threat actors successfully weaponized public registries by forcing misconfigured internal package managers to pull malicious packages instead of internal ones. Additionally, perimeter edge exposure remained highly volatile with unauthenticated remote exploitation attempts targeting exposed enterprise virtual private network entry points and ubiquitous web hosting control panels.

Actor & Infrastructure Patterns

Adversaries displayed sophisticated infrastructure engineering by leveraging automated package template generators to rapidly deploy multiple variations of targeted payloads within compact multi hour windows. In the Megalodon campaign, infrastructure was highly automated using generic bot accounts to push thousands of forged commits. The use of anti analysis tools, specifically heavy JavaScript obfuscation via automated toolchains, was standard across all observed software registry payloads aiming to blind basic static analysis engines.

MITRE ATT&CK Themes

• T1195 Supply Chain Compromise — observed across multiple campaigns leveraging public registries and poisoned developer tools to compromise software creation.

• T1190 Exploit Public Facing Application — utilized heavily in the exploitation of NGINX, cPanel, and GlobalProtect vulnerabilities.

• T1552 Unsecured Credentials — targeted specifically via credential harvesting routines aimed directly at cloud access keys and continuous integration secrets.

• T1082 System Information Discovery — deployed heavily via reconnaissance stagers designed to extract hostnames, Node versions, and environment variables.

Threat Detection

rule Malicious_npm_Recon_Stager {
    meta:
        description = "Detects obfuscated JavaScript postinstall stagers looking for developer environment details"
        author = "NightWatch CTI"
        date = "20260531"
    strings:
        $postinstall = "postinstall" ascii nocase
        $process_env = "process.env" ascii
        $node_version = "process.versions.node" ascii
        $obfuscation_marker = "obfuscator.io" ascii nocase
        $ci_variable = "CLOUDPLATFORM" ascii
    condition:
        $postinstall and ($process_env or $node_version) and (1 of ($obfuscation_marker, $ci_variable))
}

title: NGINX CVE-2026-42945 Heap Overflow Exploitation Attempt
id: nginx_rift_exploit_detect
status: experimental
description: Detects HTTP requests crafted to trigger heap buffer overflow in NGINX rewrite module
logsource:
    category: webserver
    product: nginx
detection:
    suspicious_uri:
        cs_uri_query|contains:
            - '%3F%24'
            - '?$1'
    worker_crash_pattern:
        status: '499'
        count: '>50'
        timespan: '60s'
    condition: suspicious_uri or worker_crash_pattern
level: high

-- SIEM Query Pseudocode Hunt for Megalodon CI CD Credential Theft
-- Focuses on unexpected cloud API calls originating from CI CD runner IPs
SELECT 
    source_ip, 
    action, 
    cloud_resource, 
    timestamp 
FROM 
    cloud_audit_logs 
WHERE 
    action IN ('GetSecretValue', 'AssumeRoleWithWebIdentity') 
    AND source_ip NOT IN (known_ci_runner_ip_list) 
GROUP BY 
    source_ip 
HAVING 
    COUNT(*) > 5