Monday, 20 July 2026

2 verified findings from 1 run · the settled record for this UTC day, in the classic brief order.

Criticality

Kind

Topic

Region

TL;DR · the day in one read

01F5 out-of-band patches a 15-year-old pre-auth heap overflow in nginx's script engine; credited researcher shows it reaches RCE. F5 shipped an out-of-band fix (nginx 1.30.4 / 1.31.3, NGINX Plus R36 P7 / 37.0.3.1) for CVE-2026-42533, a pre-auth heap buffer overflow reachable via crafted HTTP requests on any nginx config that references a regex map variable after a regex capture in the same evaluated string. F5 frames real-world risk as primarily denial-of-service; the credited discoverer disputes that and demonstrates a reliable pre-auth RCE that defeats ASLR in a single request. No public exploit PoC yet (withheld ~21 days) and no in-the-wild exploitation, but the bug affects nginx 0.9.6 (2011) onward — anyone running internet-facing nginx/NGINX Plus should treat the F5 OOB patch as out-of-cycle. →
02GRU's Sandworm adopts ClickFix, blockchain-hidden C2 (EtherHiding) and a Signal-lured Android backdoor — transferable tradecraft for EU CI defenders. CERT-UA reports UAC-0145, a subcluster of Sandworm (APT44 / Seashell Blizzard, GRU), compromised at least 10 legitimate websites in June–July 2026 to serve a fake CAPTCHA that coerces visitors into pasting a PowerShell command (ClickFix), staging VBS persistence and Python backdoors. The injected CAPTCHA resolves its content domain via an Ethereum smart-contract call (EtherHiding) to survive takedowns, and the group separately distributes a full-featured Android backdoor (COWARDDUCK) via Signal disguised as security software. Primary targeting is Ukraine, but Sandworm is a standing threat to European CI/government and the technique stack is directly transferable. →

01Active threats, incidents & disclosures1 item

NOTABLENATOA2

CERT-UA: Sandworm subcluster UAC-0145 pairs ClickFix fake-CAPTCHA with Ethereum-smart-contract C2 resolution and a Signal-delivered Android backdoor

CERT-UA reports that UAC-0145 — a subcluster of UAC-0002 / Sandworm (APT44, Seashell Blizzard), the GRU-linked destructive-actor family — compromised at least 10 legitimate websites between June and July 2026 to serve a fake CAPTCHA that instructs visitors to paste and run a PowerShell command in the ClickFix pattern (The Hacker News, 2026-07-19). The PowerShell one-liner drops a VBS persistence stub into the Startup folder — "one of the variants of such a program was called GHETTOVIBE," per CERT-UA — which stages a PowerShell reconnaissance script (SCOUTCURL) that profiles the host, while two loaders, FLUIDLEECH (masquerading as software for removing computer viruses) and LOADLOOP, fetch a Python backdoor, FREAKYPOLL (The Hacker News, 2026-07-19). The compromised-site injection uses a bespoke tool, SMARTAXE, layered on the commodity Cloaking.House traffic-filtering service to serve different content by visitor; the injected CAPTCHA "content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract" (The Hacker News, 2026-07-19) — a eth_call-style read that replaces a hardcoded C2 domain and survives takedowns because the resolution layer lives on-chain.

Separately, UAC-0145 distributes a full-featured Android backdoor, COWARDDUCK, via Signal disguised as security software; it collects contacts, files matching targeted extensions, and real-time geolocation, uploading via the Dropbox API and pulling C2 tasking from content hosted on legitimate services (e.g. Steam Community) proxied through a public search-engine proxy — both chosen to blend into normal outbound traffic (CERT-UA, 2026-07-19). CERT-UA frames this as a continuation of its multi-year UAC-0145 tracking; the group's earlier tradecraft (trojanized torrent installers, Signal "antivirus" lures) is background — the in-window delta is the ClickFix vector, the EtherHiding C2-resolution layer, and the COWARDDUCK mobile backdoor. The ClickFix pivot marks a departure from Sandworm's prior reliance on trojanized Windows/Office installers (The Hacker News, 2026-07-19).

Defender takeaway

Sandworm is a standing threat to European critical infrastructure and government, so this technique stack matters to EU/Swiss defenders even though the current victims are in Ukraine. Hunt on the desktop chain: a Startup-folder VBS created around the time a browser presents a "CAPTCHA" asking the user to open Win+R or a terminal and paste text; PowerShell child processes of explorer.exe or a browser with no prior parent-child history (process-creation telemetry with lineage — Sysmon EID 1, EDR process events); and, for the EtherHiding tell, outbound eth_call-style JSON-RPC traffic to public Ethereum nodes originating from endpoints rather than developer tooling. For mobile fleets, treat Signal-delivered APKs claiming to be AV/security tools as hostile, and watch BYOD/MDM egress for the Dropbox-API-plus-legitimate-platform C2 pattern. Triage: developer and IT-admin hosts legitimately spawn PowerShell from many parents and legitimately query blockchain nodes — the discriminators are (1) the PowerShell instance being a child of a browser/explorer immediately after a web CAPTCHA prompt, paired with a new Startup-folder VBS, and (2) eth_call traffic from a general-purpose endpoint with no Web3 developer role; either alone is weak, the sequence is the signal.

The CAPTCHA content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract using an address specified in the source code.

The malware embedded in the APK file is a full-featured backdoor codenamed COWARDDUCK that can clandestinely collect the following details

The Hacker News 2026-07-19

threat20 Jul 04:30Zsingle-source · national CERTOpen finding ↗

Sources: CERT-UA · The Hacker News

02Deep dive1 item

HIGHCVE-2026-42533NATOB2

CVE-2026-42533 — nginx / NGINX Plus: PCRE capture-clobber pre-auth heap overflow, researcher demonstrates RCE beyond F5's DoS-only framing (CVSS 9.2)

CVE-2026-42533 is a missing save/restore of PCRE capture state across nginx's two-pass script-expression engine. nginx evaluates a compiled expression in a LEN pass that measures the result size and a VALUE pass that writes into a buffer sized by the LEN pass, and both passes resolve capture references such as $1 by reading r->captures, a shared mutable array on the request (Stan Shaw, 2026-07-19). When a map directive using a regex pattern is evaluated between the two passes — i.e. a config where a regex capture source (location, server_name, rewrite, or if) produces captures that appear before a regex map variable in the same evaluated buffer — the map's own regex evaluation clobbers the shared capture state, so the LEN and VALUE passes disagree on the buffer size. The result is an unauthenticated, pre-auth heap buffer overflow triggerable by crafted HTTP requests, reachable from any directive that evaluates a compiled expression (proxy_set_header, fastcgi_param, return, add_header, rewrite, set, root, alias, access_log, and more). The clobber is not specific to one call site: the same LEN/VALUE pattern appears in at least 13 independent call sites across 9 source files (Stan Shaw, 2026-07-19).

The bug has existed since nginx 0.9.6 (2011, when map gained regex support). F5 — which owns nginx — shipped an out-of-band fix on 2026-07-15/16 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus R36 P7 and release 37.0.3.1, rating it CVSS 4.0 9.2 (critical) / CVSS 3.1 8.1 (high) (SecurityWeek, 2026-07-16). F5's advisory frames real-world risk on ASLR-enabled systems as primarily denial-of-service — a characterization the credited discoverer directly disputes (Stan Shaw, 2026-07-19; The Hacker News, 2026-07-19). The credited discoverer, Stan Shaw, disputes the DoS-only framing and demonstrates two chainable primitives: an information-leak variant (a clobbered capture smaller than the original) that returns uninitialised heap residue — on Ubuntu 24.04 with glibc 2.39 a libc pointer at offset 0x08 and a heap pointer at 0x10, enough to defeat ASLR in one unauthenticated GET — and a heap-overflow variant (a clobbered capture larger than the original) that writes attacker-controlled request-body content past the buffer and hijacks control flow through nginx's pool-cleanup mechanism, tested at 10/10 reliability with full ASLR enabled (Stan Shaw, 2026-07-19). "A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw told The Hacker News (2026-07-19).

No full exploit write-up or PoC is public yet — the author is withholding both for ~21 days post-patch — and no in-the-wild exploitation has been observed; the CVE is not in CISA KEV as of this run. The precedent the author cites is directly relevant: CVE-2026-42945 ("Rift"), a weaker flaw in the same nginx script engine that only mattered with ASLR disabled, "saw active exploitation shortly after its PoC dropped" (Stan Shaw, 2026-07-19; Rift's confirmed in-the-wild exploitation was covered here on 2026-05-18). This bug does not require ASLR to be off, so the same trajectory should be assumed once the withheld PoC ships (early August 2026 by the author's stated timeline).

Defender takeaway

nginx and NGINX Plus terminate internet-facing traffic across virtually every public-sector e-government portal, CI-operator API gateway and public service, so exposure is broad even though the trigger depends on a specific config pattern. Because F5's advisory understates the ceiling as DoS, treat this as a pre-auth RCE candidate on exposed edge and prioritise the out-of-band patch on that basis, not on the DoS reading. The config-pattern dependency is the discriminator that turns "patch everything" into "know your exposure first": most nginx deployments will not combine a regex capture with a later regex-map reference in one evaluated string, and the ones that do are the immediate-risk set. Detection is limited pre-PoC — the mechanism's observable signature is anomalously large or malformed request bodies immediately followed by nginx worker-process restarts/crashes on edge hosts (the DoS primitive's crash signature); a two-request info-leak-GET-then-overflow-POST shape is inferable from the mechanism but not a source-stated detection rule. The author's public static config scanner (github.com/0xCyberstan/CVE-2026-42533-Config-Scanner) follows includes, handles cross-directive triggering and distinguishes exploitable from safe ordering — run it against every internet-facing config now to enumerate which vhosts were exposed before you patch.

A missing save/restore of PCRE capture state in nginx’s script engine lets a remote unauthenticated attacker trigger a heap buffer overflow with fully controlled content and length

This bug does not require ASLR to be off. The info leak primitive defeats it in a single GET request.

Stan Shaw (cyberstan.co.uk) 2026-07-19

vulnerability20 Jul 04:27Zmulti-sourceOpen finding ↗

Sources: Stan Shaw (cyberstan.co.uk) · SecurityWeek · The Hacker News

03Action items2 items

Upgrade every internet-facing nginx to ≥ 1.30.4 (stable) or 1.31.3 (mainline), and NGINX Plus to R36 P7 / 37.0.3.1 — F5 released this out-of-band, so it is not carried by a normal release-train upgrade.
FindingCVE-2026-42533
Before patching, audit each internet-facing nginx config for a regex map variable referenced after a regex capture ($1/$2/named groups from location/server_name/rewrite/if) in the same evaluated string; restructure (move the map reference before the capture, or split the expression) to remove the trigger on any host that cannot be patched immediately.
FindingCVE-2026-42533

Verification & coverage notes1 run

2026-07-20T0409Z-intel · Claude Opus 4.8 · window 24 h · 2 entries published

Verification & coverage notes

Intraday fire — 5 h gap to the previous run (the 2026-07-19T2310Z-weekly), 24 h window (hard floor). The prior 24 h were already worked by the 2026-07-19T0408Z-intel run, the 2026-07-19T1308Z-audit, and the W29 weekly, so the genuinely-new slice was small and most of the landscape was already covered; dedup carried the load. Two entries published from three real candidates; the national-CERT/government and incident/breach source layers were genuinely quiet (weekend), with S2 and S4 returning honest empties after thorough sweeps.

Published

2026-07-20/cve-2026-42533-nginx-pcre-capture-clobber-preauth-rce — deep dive (category network-stack-rce). New in-window pre-auth heap overflow in nginx / NGINX Plus's script engine, patched out-of-band by F5 on 2026-07-15/16; the credited discoverer disputes F5's DoS-only framing and demonstrates a reliable pre-auth RCE (single-GET ASLR defeat + control-flow hijack). Clears the vulnerability gate on the out-of-band-patch / pre-auth-RCE-on-exposed-edge criterion (action beyond the regular patch cycle) despite no public exploit PoC (author withholding ~21 days) and no in-the-wild exploitation yet. Priority high, not critical — no public PoC, no verified scanning, not in KEV. CVE id, CVSS (4.0 9.2 / 3.1 8.1), affected/fixed versions and CWE-122 verified against the F5-sourced NVD record; F5's own advisory page (K000162097) is JS-gated and not directly citable, so cited via SecurityWeek + the credited researcher. Deep dive earned on the "substantive new technical analysis, actionable" criterion — the two-pass capture-clobber mechanism, the specific vulnerable config pattern, and the scan-before-patch exposure-enumeration workflow give a skilled responder something to act on.
2026-07-20/uac-0145-sandworm-clickfix-etherhiding-android-backdoor — threat, notable. CERT-UA's disclosure of Sandworm subcluster UAC-0145 pairing ClickFix fake-CAPTCHA drive-by with on-chain C2 resolution (EtherHiding via a bespoke SMARTAXE injector) and a Signal-delivered Android backdoor (COWARDDUCK). Primary targeting is Ukraine, so it clears the gate on the same-actor read (Sandworm/GRU is a standing threat to European CI + government) plus transferable TTPs — framed around the technique stack, not the victims. New entity actor:uac-0145 registered with a related-to relation to actor:sandworm — the typed relationship vocabulary has no actor→actor subcluster edge, so related-to records CERT-UA's stated subcluster hierarchy (captured in the edge's note) without overclaiming a specialized type.

Single-source / carve-outs

The UAC-0145 entry is single-source-national-cert: CERT-UA is the primary disclosing authority for its own jurisdiction; The Hacker News (2026-07-19) corroborates in English but derives its facts from the same CERT-UA advisory, so it is effectively single-origin. Noted in the entry's sourcing_note. CERT-UA's page carries a Published Time metadata artefact (2026-03-10) contradicting its own June–July 2026 activity dates — treated as a site artefact, freshness anchored to the 2026-07-19 disclosure.

Borderline drops (recoverable)

borderline-drop: SANS ISC Hikvision ISAPI /ISAPI/System/status reconnaissance scanning (S3) — single-source (SANS ISC handler diary, reliability B), reconnaissance-only with no confirmed exploitation, a narrow product footprint, and the only action it implies (don't expose camera management interfaces to the internet; use HTTPS + non-Basic auth) is standing hygiene rather than a task derived from this observation. Fails the actionability bar. Recover if exploitation of the endpoint (post-recon credential brute-forcing or a specific CVE) is confirmed.
borderline-drop: Abbott LabCentral / ShadowByt3$ second incident (S4) — the in-window source is a verbatim recap of 2026-07-17 reporting; no fresh delta to anchor an update, and the ShinyHunters half is already covered (2026-07-18 Abbott entry).
borderline-drop: assorted out-of-nexus / stale S4 leads — River Financial Corp 8-K/A (out-of-nexus US community bank), Clover Health 8-K (out-of-nexus US health insurer, routine ATO), Coca-Cola/fairlife ransomware (out-of-nexus US food manufacturing, no fresh delta), ViPNet "HelloNet" repackaging (already covered 2026-07-17), Bluebell Group leak-site claim (unconfirmed, no nexus). All logged with reasons in findings.S4.yaml.

Coverage gaps: trellix (JS-SPA shell, no listing content recoverable — flag for a structured-endpoint recipe), huntress (partial/cached listing, latest dated item outside window), securelist (landing-nav only, no per-article dates; visible titles already covered), cert-eu (curated advisory list on a low, non-daily cadence — newest 2026-06-10). None are unrecovered fetch failures; all are "checked, nothing in-window" against a quiet weekend.

Watchlist: not configured for this deployment (product and supplier watchlists empty) — sweep is a no-op; line omitted from telemetry.

Essential-coverage: all essential national-CERT/government/KEV sources (CISA KEV, ENISA EUVD, NCSC-CH, NCSC-NL, BSI, ANSSI/CERT-FR, CERT-EU, CERT-PL, NCSC-UK, CISA advisories/directives) attempted and reachable; no misses. CISA KEV catalog carried no new additions inside the window (newest entries dated 2026-07-16, already covered).

Deep-dive rotation: category network-stack-rce — not used in the trailing 7 days (recent picks: other, firewall-vpn-rce, apt-campaign, identity-infra, linux-lpe). No prior deep dive today (deep_dives_today: 0).

Verification. Three iterations (Opus / Sonnet / Opus rotation); confirmed CLEAN published under the double-CLEAN gate (iteration 2 Sonnet CLEAN + iteration 3 Opus CLEAN — two consecutive CLEANs on two different models). Iteration 1 (Opus, cold) found one truth defect and one advisory: the run-record notes described the new UAC-0145→Sandworm edge as part-of while the registry deliberately used related-to (the typed vocabulary has no actor→actor subcluster edge), and the nginx body's "F5 frames risk as DoS-primary" clause was weakly cited to SecurityWeek. Both fixed (run-record note corrected to related-to with the reason; DoS-framing clause re-cited to cyberstan + The Hacker News, SecurityWeek kept for CVSS/patch). Iterations 2 and 3 independently re-read both entries + the run record cold against freshly-fetched sources and confirmed every evidence quote verbatim, every quantifier and CVSS/version sourced, all seven ATT&CK ids active in v19.1 and body-supported, no IOCs, and correct classification/priority/action-item discipline. entries_dropped_by_verification: 0; verification_residual_count: 0.

Data-model note (surfaced for the operator / weekly audit): the typed relationship vocabulary (docs/pipeline.md § Relationships, enforced by site/content_model.py) has no actor→actor containment edge, so a declared actor subcluster (UAC-0145 is a CERT-UA-declared subcluster of UAC-0002/Sandworm) can only be recorded as related-to with the hierarchy in the edge note, or folded into aliases (as UAC-0113 was on actor:sandworm). A dedicated subcluster-of / actor-scoped part-of edge would model the recurring APT-umbrella / UAC-subcluster pattern more faithfully; noted here rather than changing the normative model in a routine intel run.