Daily Threat Briefing
← All briefings

NGINX / NGINX Plus · SonicWall SMA 1000 · WordPress Core

Daily Threat Intelligence Briefing

Date: 2026-07-20 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

The dominant new development today is the confirmed active exploitation of SonicWall SMA 1000 zero-days by threat actor UTA0533, predating public disclosure since June 22. NGINX has patched a critical heap buffer overflow (CVE-2026-42533) enabling unauthenticated worker crashes and potential RCE — upgrade is urgent given NGINX’s ubiquity. The UAC-0145 (Sandworm sub-cluster) ClickFix campaign targeting Ukrainian entities has been newly attributed and reported. The BSI WordPress “wp2shell” emergency advisory remains the highest-priority European action item.

Critical Vulnerabilities

CVE-2026-42533 — NGINX / NGINX Plus (Heap Buffer Overflow, Unauthenticated RCE)

  • Severity: Critical (CVSS score not yet published in available data)
  • EPSS: Not yet scored
  • Technical detail: A remote, unauthenticated attacker can trigger a heap buffer overflow in the NGINX worker process by sending crafted HTTP requests. Successful exploitation can crash or restart the worker process (denial of service); code execution may also be possible, though not yet confirmed in the wild. Affects all NGINX stable builds prior to 1.30.4, mainline prior to 1.31.3, and NGINX Plus prior to R37.0.3.1. NGINX is deployed as a reverse proxy, load balancer, and web server across a vast proportion of enterprise and cloud infrastructure, making the attack surface extremely broad.
  • Exploitation status: No confirmed in-the-wild exploitation reported; patch was shipped July 15.
  • Remediation: Upgrade to NGINX 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus R37.0.3.1 immediately. Prioritize internet-facing deployments.

CVE-2026-15409 — SonicWall SMA 1000 (Zero-Day, Actively Exploited Pre-Disclosure)

  • STATUS CHANGE: Previously reported as having a public PoC. New material development: Volexity has confirmed that threat actor UTA0533 exploited SonicWall SMA 1000 series appliances as zero-days prior to public disclosure, with activity traced back to at least June 22, 2026. This confirms pre-patch compromise of unpatched appliances is highly probable.
  • Update: Any SMA 1000 deployment that was unpatched between June 22 and the patch date should be treated as potentially compromised. Initiate incident response: forensic review of VPN session logs, lateral movement indicators, and credential exposure. Apply vendor patches immediately if not already done.

CVE-2026-63030 / CVE-2026-60137 — WordPress Core (“wp2shell”, Unauthenticated RCE)

  • ONGOING — STATUS CHANGE (from yesterday): Public exploits confirmed circulating; BSI emergency advisory active. Patch to 6.9.5 / 7.0.2 remains critically urgent — verify manually on every internet-facing installation.

ONGOING:

  • CVE-2026-47865 / CVE-2026-47871 / CVE-2026-47867 / CVE-2026-47869 (VMware Avi Load Balancer): unauthenticated auth bypass chains to RCE; patch all affected branches, restrict control plane access.
  • CVE-2026-58644 (SharePoint Server): CISA KEV deadline passed 2026-07-19 — verify patched; treat unverified deployments as compromised.
  • CVE-2026-25089 / CVE-2026-39808 (Fortinet FortiSandbox): CISA KEV deadline passed — escalate any outstanding remediation.
  • LegacyHive (Windows LPE zero-day): no patch available; maintain EDR alerting on privilege escalation activity.
  • CVE-2026-44747 (SAP NetWeaver ABAP, CVSS 9.9): patch immediately if not done.
  • CVE-2026-53412 (Zoom for Windows, CVSS 9.8): patch to 7.0.0+.

European Advisories

BSI Emergency Advisory — WordPress “wp2shell” (2026-07-18, ONGOING): The BSI advisory covering CVE-2026-63030 and CVE-2026-60137 remains active. No new BSI WID or CERT-EU advisories were published in the last 24 hours. Full technical detail and remediation guidance covered in Critical Vulnerabilities (yesterday’s STATUS CHANGE entry). BSI Advisory

Heise Security — NGINX heap buffer overflow: Heise has flagged CVE-2026-42533 as critical; covered in full in Critical Vulnerabilities above.

Previously reported BSI advisories (ONGOING): WID-SEC-2026-2400 (Moodle/M365 plugin), WID-SEC-2026-2398 (Chrome), WID-SEC-2026-2393 (Ubuntu Pro client), WID-SEC-2026-2390 (nginx-ui) — apply vendor patches if not yet done.

Active Threats and Campaigns

NEW — UAC-0145 (Sandworm sub-cluster) ClickFix Campaign: CERT-UA has attributed a ClickFix CAPTCHA-based social engineering campaign to UAC-0145, a sub-cluster of Sandworm (GRU-affiliated). Targets are Ukrainian entities; victims are tricked into pasting malicious commands via fake CAPTCHA prompts, resulting in data-stealing malware infection. While primary targeting is Ukrainian government and organizations, the ClickFix delivery technique is actively being replicated by other threat actors (see ACR Stealer below) and represents a live threat to European organizations. Block clipboard-injection lures via browser policy; alert on unexpected mshta.exe, wscript.exe, or PowerShell spawned from browser processes. The Hacker News

NEW — ViPNet Update Mechanism Abuse: An advanced threat actor is abusing the software update mechanism of ViPNet, a widely used private networking suite in Russian government and enterprise environments, to deliver malware to target organizations. Relevance for European organizations is limited but notable for threat intelligence tracking of supply-chain update abuse TTPs. Bleeping Computer

ONGOING — ACR Stealer (enterprise surge): Microsoft-confirmed surge continues; ClickFix delivery, targeting browser credentials and M365 documents. Hunt for ClickFix lure execution chains and audit OAuth tokens.

ONGOING — NadMesh Botnet: Actively scanning for exposed AI services (Langflow, ComfyUI, Ollama, n8n); harvesting cloud keys and Kubernetes tokens. Audit internet exposure of all AI/ML endpoints.

ONGOING — ViteVenom / ChainVeil: Malicious npm packages targeting Vite ecosystem with blockchain-based C2; enforce lockfile integrity and audit dependencies.

Security News and Context

SonicWall SMA zero-day pre-disclosure exploitation: Volexity’s investigation confirms UTA0533 exploited SMA 1000 appliances before patches were available, underscoring the risk window for network edge devices. The Hacker News

OpenSSL “HollowByte” DoS: An 11-byte TLS request can permanently consume up to 131 KB of server memory per connection on unpatched glibc-based OpenSSL servers; fix was silently shipped in June with no CVE or advisory. Verify OpenSSL versions are current. Bleeping Computer

Ernst & Young data breach: EY is notifying customers following compromise of a third-party IT support ticketing system. Bleeping Computer

  1. Upgrade NGINX immediately to 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus R37.0.3.1 — CVE-2026-42533 heap buffer overflow is unauthenticated and affects all prior builds.
  2. Treat unpatched SonicWall SMA 1000 deployments as compromised — initiate IR: review VPN session logs from June 22 onward, check for lateral movement and credential theft (CVE-2026-15409).
  3. Verify WordPress wp2shell patches applied (6.9.5 / 7.0.2) — public exploits circulating; manual verification required, do not rely on auto-update confirmation.
  4. Block ClickFix delivery vectors — enforce browser policy against clipboard injection; alert on mshta.exe/wscript.exe/PowerShell spawned from browser processes (UAC-0145, ACR Stealer).
  5. Audit internet-exposed AI/ML services (Langflow, ComfyUI, Ollama, n8n) — NadMesh actively harvesting credentials from unprotected endpoints.
  6. Verify OpenSSL is current on all TLS-terminating servers — HollowByte DoS fix was silently shipped in June; no CVE assigned, check changelog or version directly.
  7. Confirm SharePoint and FortiSandbox patches applied — CISA KEV deadlines passed 2026-07-19; escalate any outstanding remediation to emergency priority.
  8. Continue remediation of previously reported items: VMware Avi Load Balancer (all branches), LegacyHive (Windows LPE — EDR monitoring only), SAP NetWeaver ABAP CVE-2026-44747, Zoom CVE-2026-53412, 7-Zip (upgrade to 26.02).