May 2026 was one of the most intense cybersecurity months in recent memory: an 18-year-old NGINX rewrite-module RCE (CVE-2026-42945), Microsoft’s 138-flaw Patch Tuesday with 16 bugs found by its own MDASH AI, an Exim BDAT vulnerability, a BitLocker zero-day PoC, and the 150-package GemStuffer RubyGems campaign. This roundup covers what happened and what to patch first.
Patch in this order: (1) NGINX rewrite-module RCE CVE-2026-42945 — unauthenticated, present since 0.7.x, trivially exploitable; (2) Microsoft May Patch Tuesday — 138 CVEs including critical DNS and Netlogon RCE, 16 found by Microsoft’s own MDASH AI; (3) Exim BDAT flaw — remote code execution risk on GnuTLS builds; (4) BitLocker zero-day PoC — fix is Windows 11 only, so Win10 BitLocker users must upgrade. Also audit RubyGems deps for GemStuffer’s 150+ malicious packages.
Introduction
May 2026 has been one of the most intense months for cybersecurity in recent memory. From a critical 18-year-old NGINX vulnerability enabling unauthenticated remote code execution to Microsoft’s massive Patch Tuesday fixing 138 flaws, security teams worldwide are scrambling. This roundup covers the most significant threats, vulnerabilities, and incidents you need to know about.
Critical Vulnerabilities
NGINX Rewrite Module RCE (CVE-2026-42945)
An 18-year-old vulnerability in NGINX’s rewrite module was disclosed on May 14, 2026, enabling unauthenticated remote code execution. The flaw, present since NGINX 0.7.x, allows attackers to execute arbitrary code through specially crafted requests that exploit how the rewrite engine processes certain directives. If you’re running NGINX — and statistically, you probably are — patch immediately.
Microsoft Patch Tuesday: 138 Vulnerabilities Fixed
Microsoft’s May 2026 Patch Tuesday addressed a staggering 138 vulnerabilities, including critical remote code execution flaws in DNS services and Netlogon protocols. Notably, Microsoft’s own MDASH AI system identified 16 of these Windows flaws before they were reported through traditional channels — a watershed moment for AI-assisted vulnerability discovery, and the defensive flip side of the AI Inversion.
Exim Mail Server BDAT Vulnerability
A newly discovered vulnerability in the Exim mail server’s BDAT command implementation exposes GnuTLS builds to potential remote code execution. Exim powers a significant portion of the world’s email infrastructure, making this a high-priority patch for mail server administrators.
Windows BitLocker Zero-Day
A proof-of-concept exploit was released for a Windows BitLocker zero-day that grants attackers access to encrypted drives. What makes this particularly concerning is that Microsoft’s fix only applies to Windows 11 — Windows 10 users remain vulnerable unless they upgrade.
Active Threat Campaigns
Azerbaijani Energy Firm Targeted
An Azerbaijani energy company was hit by repeated exploitation of Microsoft Exchange vulnerabilities, highlighting that older Exchange Server flaws continue to be weaponized despite available patches. Organizations running on-premises Exchange should verify their patching status immediately.
Foxconn Confirms Ransomware Attack
Foxconn confirmed a cyberattack claimed by the Nitrogen ransomware gang. The electronics manufacturing giant joins a growing list of critical infrastructure and supply chain targets, underscoring that manufacturing remains a prime target for ransomware operators.
Iranian Hackers Target South Korean Electronics
Iranian state-sponsored threat actors were detected targeting a major South Korean electronics manufacturer. This campaign demonstrates the continued geopolitical dimension of cyber threats and the expanding scope of nation-state operations.
West Pharmaceutical Data Breach
West Pharmaceutical Services confirmed that hackers both stole data and encrypted systems in a dual-extortion attack. The healthcare and pharmaceutical supply chain remains under sustained pressure from ransomware operators.
Supply Chain Security
GemStuffer Campaign: 150+ Malicious RubyGems
A supply chain attack campaign dubbed “GemStuffer” was uncovered, involving over 150 malicious RubyGem packages designed to exfiltrate data scraped from U.K. council portal systems. RubyGems subsequently suspended new package signups in response to the mass upload of malicious packages.
Key Takeaway for Developers
The GemStuffer campaign reinforces a critical lesson: supply chain attacks aren’t slowing down. Whether you’re consuming npm packages, Python wheels, Ruby gems, or Docker images, your dependency pipeline needs robust verification — the same discipline we outlined for dependency and build security. Use lock files, verify package signatures, and implement software composition analysis (SCA) tools.
AI in Security: A Turning Point
Microsoft’s MDASH AI System
The most significant development this month may be Microsoft’s MDASH AI system, which independently discovered 16 Windows vulnerabilities that were then fixed in Patch Tuesday. This represents a paradigm shift — AI systems are now finding real-world security bugs at scale, not just in research environments. It mirrors what OpenAI is doing with Daybreak on the defensive side.
Android Spyware Detection
Google added intrusion logging capabilities to Android specifically for sophisticated spyware forensics. This defensive enhancement gives security researchers and users better visibility into advanced persistent threats on mobile devices.
May 2026 at a Glance
| Event | Class | Urgency |
|---|---|---|
| NGINX rewrite RCE (CVE-2026-42945) | 18-year-old unauthenticated RCE | Patch now |
| Microsoft Patch Tuesday (138 CVEs) | DNS/Netlogon RCE, 16 AI-found | Patch now |
| Exim BDAT flaw | RCE on GnuTLS builds | High |
| BitLocker zero-day PoC | Encrypted-drive access; Win11-only fix | Upgrade Win10 |
| GemStuffer RubyGems | 150+ malicious packages | Audit deps |
| Foxconn / West Pharma | Ransomware + dual extortion | Monitor |
What You Should Do Right Now
- Patch NGINX immediately — the rewrite module RCE is trivially exploitable and affects nearly all installations
- Apply Microsoft’s May patches — 138 vulnerabilities, including critical DNS and Netlogon RCE flaws
- Update Exim mail servers — the BDAT vulnerability is remotely exploitable
- Upgrade from Windows 10 if you rely on BitLocker — the zero-day fix doesn’t apply to Win10
- Audit your Exchange Server — ensure all patches are current, especially for on-prem installations
- Review your dependency pipeline — implement SCA tools and verify package integrity
- Check your RubyGem dependencies — audit for any of the 150+ malicious packages from GemStuffer
Conclusion
May 2026 serves as a stark reminder that the threat landscape continues to evolve at breakneck speed. Legacy vulnerabilities like the 18-year-old NGINX flaw coexist with cutting-edge AI-driven attacks and supply chain compromises. The common thread: proactive security hygiene — patching, monitoring, and verification — remains your strongest defense. Stay vigilant, stay updated, and most importantly, stay ahead of the threats.
Frequently Asked Questions
What is CVE-2026-42945?
An 18-year-old unauthenticated remote code execution vulnerability in NGINX’s rewrite module, disclosed May 14, 2026. Present since NGINX 0.7.x, it lets attackers run arbitrary code via specially crafted requests that abuse how the rewrite engine processes certain directives. Patch immediately — it affects nearly every unpatched installation.
How many vulnerabilities did Microsoft fix in May 2026 Patch Tuesday?
138 vulnerabilities, including critical RCE flaws in DNS services and Netlogon. Sixteen of the Windows flaws were independently discovered by Microsoft’s MDASH AI system before traditional reporting — a first-at-scale for AI-assisted vulnerability discovery.
Why does the BitLocker zero-day matter for Windows 10 users?
A public proof-of-concept grants attackers access to BitLocker-encrypted drives, but Microsoft’s fix applies only to Windows 11. Windows 10 systems relying on BitLocker remain exposed unless they upgrade to a patched OS.
What was the GemStuffer campaign?
A RubyGems supply chain attack comprising 150+ malicious packages built to exfiltrate data scraped from U.K. council portal systems. RubyGems suspended new package signups in response. Audit dependencies and adopt SCA tooling.
References
- NGINX — CVE-2026-42945 rewrite module RCE advisory (May 14, 2026)
- Microsoft — May 2026 Patch Tuesday release notes (138 CVEs)
- Microsoft — MDASH AI vulnerability discovery announcement
- Exim — BDAT command vulnerability advisory
- RubyGems / researchers — GemStuffer campaign report
- Hmmnm — The AI Inversion: 6 Real Incidents
- Hmmnm — OpenAI Daybreak: AI Vulnerability Detection
- Hmmnm — Software Supply Chain Security
