BitLocker Full-Volume Bypass PoC Drops, Exchange Zero-Day Mid-Patch-Cycle, and the NGINX Rewrite Bug That Lurked for 18 Years

Events

Pwn2Own Berlin Crowns Its Master After $1.3M and 47 Zero-Days Across Every Major Platform

Day 3 closed with targeted attacks on Red Hat, VMware vSphere, Linux desktop, and automotive stacks, pushing the total to 119 exploits. The vendor diversity shows Pwn2Own is no longer just a browser and hypervisor showcase. Automotive winners in particular signal that connected-vehicle attack surfaces are finally getting the researcher attention they deserve.

Zero-Day

BitLocker Full-Volume Encryption Bypass PoC Released, Unpatched

A logic flaw lets an attacker with physical access decrypt the entire BitLocker volume by manipulating NTFS structures during boot, no TPM bypass required. If you rely on BitLocker as your data-at-rest backstop, that assumption is officially under water until Microsoft ships a fix. Encrypt anything sensitive at the file level too, and watch for the next Patch Tuesday.

Microsoft Exchange Server Zero-Day Actively Exploited Mid-Patch-Cycle

Microsoft confirmed in-the-wild exploitation of a new Exchange Server zero-day and issued guidance ahead of the next patch release. Exchange zero-days have a long tail for on-prem shops that can't move at cloud speed, so treat this as a blocker and apply mitigations now rather than waiting for Tuesday.

18-Year-Old NGINX Rewrite Module Bug Exposes a Third of the Web, No Fix Yet

A heap buffer overflow in the Rewrite module's initialization code has sat in NGINX's codebase since 2008, and a proof-of-concept is now public. Exploitation requires a specific Rewrite configuration, but given NGINX's footprint, even a narrow path means millions of servers are theoretically exposed. Check your configs, test the PoC against staging, and wait for an upstream fix.

Supply Chain

RubyGems Suspends New Signups After Account Hijack Attacks Target Popular Packages

Attackers were using typo-squatting and credential stuffing to take over trusted maintainer accounts and push malicious gem versions, a playbook identical to what has hammered npm for months. RubyGems' freeze buys time but doesn't solve the underlying trust model problem. If you run Ruby in production, audit your lockfile and pin checksums now.