Pwn2Own Berlin Wraps at $1.3M, NGINX Rift Drops After 18 Years, TanStack Worm Hits OpenAI, and Cisco SD-WAN Hits KEV Deadline
Events
Pwn2Own Berlin 2026 Closes at $1.3M: 47 Unique Zero-Days, DEVCORE Takes Master of Pwn
The contest wrapped with $1,298,250 paid across 47 confirmed zero-days over three days, with DEVCORE's Orange Tsai alone accounting for $505,000 after chaining bugs to get SYSTEM on both Edge and Exchange. The real headline is structural: the event hit maximum capacity for the first time in 19 years, and 150-plus rejected researchers started dropping working zero-days publicly rather than waiting for next year's slots.
Vulnerability
A critical CVSS 9.2 heap buffer overflow hiding in NGINX's rewrite module since 2008 was found by an AI-driven analysis system in about six hours and disclosed May 13 with a working public PoC. Any NGINX install using rewrite rules with unnamed captures is potentially exploitable right now with a single crafted HTTP request, no auth required. Patch to 1.30.1 or 1.31.0 immediately.
Microsoft Exchange CVE-2026-42897 Confirmed Exploited in the Wild, No Patch Yet
Microsoft confirmed active exploitation of this XSS spoofing zero-day in Exchange OWA just 48 hours after Patch Tuesday. An attacker sends a crafted email, the victim opens it in OWA, and arbitrary JavaScript runs in the browser context. The EM Service auto-mitigation covers most orgs if EEMS is enabled by default, but on-prem shops running Exchange 2016, 2019, or SE with EEMS disabled are exposed until a patch ships.
Supply Chain
TeamPCP's TanStack Worm Breaches Two OpenAI Employee Devices, Forces macOS Certificate Rotation
The ongoing Mini Shai-Hulud campaign hit TanStack's release pipeline on May 11 by chaining three GitHub Actions flaws, poisoning the cache and hijacking OIDC tokens to publish 84 malicious npm artifacts with valid SLSA provenance. OpenAI confirmed two employee devices were compromised and is rotating macOS code-signing certs, requiring all Mac users to update ChatGPT and Codex apps by June 12. If you installed any @tanstack/* package on May 11, treat that machine as fully compromised and rotate every credential accessible from it.
News
Today is the hard CISA deadline for federal agencies to remediate CVE-2026-20182, a perfect 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller that UAT-8616 has been actively exploiting to gain admin access. This is the sixth exploited SD-WAN vulnerability in 2026, and CISA issued Emergency Directive ED-26-03 with supplemental hunt-and-hardening guidance alongside the KEV addition. If you are running Cisco SD-WAN and are not yet patched, you are now definitively behind.
Analysis
NGINX Rift Technical Deep-Dive: How an AI Found in 6 Hours What Human Reviewers Missed for 18 Years
This is the primary researcher writeup from depthfirst on CVE-2026-42945, including the exact configuration trigger pattern and the full affected product list across NGINX Plus, Gateway Fabric, Ingress Controller, App Protect WAF, and Instance Manager. The broader signal here is important: an autonomous AI code analysis platform found a critical RCE in one of the most-audited open source projects in existence in under six hours, which should reshape how every team thinks about legacy infrastructure risk.
Stay Ahead
Delivered each morning.