Weaponization of CVE-2026-42945: NGINX Rewrite Module Vulnerability Under Active Exploitation

A critical security flaw impacting NGINX Plus and NGINX Open Source, tracked as CVE-2026-42945, has transitioned from public disclosure to active exploitation in the wild. The vulnerability is a heap buffer overflow within the ngx_http_rewrite_module that allows unauthenticated attackers to trigger worker process crashes (denial-of-service) or potentially achieve remote code execution (RCE) via crafted HTTP requests. While RCE is largely mitigated by Address Space Layout Randomization (ASLR), honeypot data confirms threat actors are already weaponizing the flaw to disrupt services. This exploitation coincides with a cluster of attacks targeting openDCIM infrastructure management software, reportedly utilizing AI-assisted vulnerability discovery tools. F5 has released patches, and immediate updates are recommended for all NGINX deployments within the affected version range (0.6.27 to 1.30.0). Read more

Taiwan April 2026 Public Cyber Signals: Listed-Company Incident Disclosures in Context

Nogosee monitored 13 Taiwan listed-company cyber incident disclosures in April 2026. The cleaned month is incident-only: 13 incident records, 0 governance records, and 0 procurement records. This is a MOPS incident-disclosure snapshot for analyst workflow use, not a complete census of Taiwan cyber activity. Read more

Hong Kong Finance and Cloud Security Escalation Checklist: Practical Workflow for GovCERT.HK Alerts

Use this practical checklist to triage Hong Kong finance, cloud, identity, telecom, and critical-infrastructure signals from GovCERT.HK. It provides reader-focused steps, decision criteria, ownership guidance, and escalation thresholds based on alert type, sector relevance, and threat level—without implying new publication or inventing numeric thresholds. Read more

How to Build a Lightweight East Asia Vendor Risk Watchlist Using Public Sources

Create a practical vendor risk watchlist by leveraging Nogosee’s East Asia Cyber & AI Risk Tracker to monitor public signals from Taiwan, Japan, Korea, China, Singapore, Philippines, and Thailand. Focus on structured signal review, ownership assignment, and flexible escalation based on operational relevance. Read more