NGINX ngx_http_rewrite_module Heap-Based Buffer Overflow (Queries and Signatures Only)

An unauthenticated attacker can crash the NGINX worker process by sending crafted HTTP requests - CVE-2026-42945:

https://docs.vulncheck.com/initial-access/2026-05-15#cve-2026-42945-nginx-ngx_http_rewrite_module-heap-based-buffer-overflow-queries-and-signatures-only

⚡ DNS is not just about domains. It is about Trust.

Recent supply chain incidents are a strong reminder that modern attacks often start through tools and workflows developers already trust:

• npm packages and dependency updates
• compromised maintainer accounts
• VSCode extensions
• GitHub Actions workflows
• fake installers and update mechanisms

Several recent cases highlight this trend:

• Axios compromised on npm - malicious versions dropped a Remote Access Trojan >
• Compromised VSCode Nx Console >
• OpenAI TanStack npm supply chain attack >
• OpenAI Axios developer tool compromise >
• GitHub unauthorized access to internal repositories >

The key takeaway: supply chain attacks are becoming more relevant to every developer, engineering team, and company.

DNS security should not be treated as an optional layer.

It can provide visibility and control when malicious code attempts to:

• connect to C2 infrastructure
• reach phishing domains
• communicate with fake update servers
• exfiltrate data through suspicious endpoints

If malicious code has already entered the environment, visibility becomes critical...

At this point, the key questions are simple:

• Can you see where it is trying to connect?
• Can you understand whether that connection is expected?
• Can you react before the incident becomes bigger?

OpenBLD.net - Security starts earlier than incident response.

Watch yourself, your emails, your extensions, and your DNS. Peace ✌️

Bumblebee (from Perplexity)

Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.

https://github.com/perplexityai/bumblebee

HTTP/2 Bomb

https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

Rokarolla : Android Banker with Complete Device Takeover Capabilities

https://zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities

Crypto Clipper uses Tor and worm-like propagation for persistence and control

https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/

P.S. it work at current time, In the world of artificial intelligence and technological breakthrough)

FortiBleed - Breach How 80,000+ Corporate= Firewalls Were Quietly Compromised

If your organization uses a Fortinet firewall or VPN product and appears in this dataset, treat your network perimeter as already compromised and act immediately. SOCRadar rates this campaign Critical..:

https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/

DuneSlide: Two Critical RCE vulnerabilities via Zero-Click Prompt Injection in Cursor IDE

https://www.catonetworks.com/blog/duneslide-two-critical-rce-vulnerabilities/

Vishing actors target Entra passkey enrollment (mimics the Microsoft passkey enrollment)

The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing (“vishing”) scheme. The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey.:

https://www.okta.com/en-au/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/

Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting

https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left

Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories

https://www.stepsecurity.io/blog/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm

ClickLock Stealer: Paste Once, Lose Everything

Upon execution of the ClickFix command, the malicious script shows a terminal-based loading animation mimicking Cloudflare progress bar with browser verification flow..:

https://www.group-ib.com/blog/clicklock-stealer-macos-malware/

Welcome to Danglegeddon

Silent Push Simulation Demonstrates Why Dangling Dns Domains Continue To Pose Global Threats..:

https://www.silentpush.com/blog/danglegeddon/

Threat Actors Abuse Trusted Software Lures and Cloudflare Tunnels to Deploy ScreenConnect RMM Agents Across Windows and macOSScreenConnect RMM Agents Across Windows and macOS

Analyzing SMOKE#SCREEN:

https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/

7-Zip Leaves Extracted Malware Without Mark-of-the-Web, Bypassing Windows SmartScreen

evil 7-zip)

https://cyberpress.org/7-zip-bypasses-smartscreen-protections/

3 BILLION DNS queries.

Almost +1 billion in one week.

OpenBLD started in 2019 as a homegrown project handling around 35K DNS queries a day.

Today:

→ ~15M queries/hour
→ 4K+ queries/second
→ servers distributed around the world
→ billions of DNS queries processed

And it still runs mostly on regular VPS infrastructure - with plenty of performance headroom left.

Getting here required years of optimizing the entire stack: networking, DNS processing, caching, filtering, load balancing, observability, and the Go code itself.

Now the growth is public too:

Real-time OpenBLD network statistics are live on OpenBLD.net.

From 35K/day to 3 billion.

Still building. 🚀

Fast. Private. Open.

Clop Returns with Custom Implant in Mass-Extortion Campaign

..“Clop's” exploitation of CVE-2026-12569 in PTC Windchill has returned the group to mass exploitation, delivering a custom web shell that provides full data-theft capability from the moment of deployment, with no additional tooling required..:

https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign/

Manic: Blend between Banking Malware & Spyware

is a new Android banking malware and mobile spyware:

https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware