Loading story…
JetBrains published a security advisory for a vulnerability affecting GoLand versions prior to 2026.1.3, prompting the Canadian Centre for Cyber Security to issue advisory AV26-606 and urge users and administrators to apply the vendor’s update. Public reporting on the notice did not include a CVE identifier, severity rating, or evidence of active exploitation, but it confirmed that systems running older GoLand releases require remediation.
F5 also released product advisories for two separate NGINX issues: NGINX Gateway Fabric vulnerability CVE-2026-11311 and an ngx_http_charset_module vulnerability tracked as CVE-2026-48142. While the available summaries did not provide technical impact details, the disclosures indicate newly published vendor guidance for organizations using these products and reinforce the need to review affected versions and deploy fixes or mitigations.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On June 17, 2026, the Canadian Centre for Cyber Security issued advisory AV26-606 بشأن the JetBrains GoLand vulnerability. It advised users and administrators to review JetBrains' notice and apply the necessary updates.
JetBrains published a security advisory on June 16, 2026 addressing a vulnerability in GoLand. The issue affects JetBrains GoLand versions prior to 2026.1.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecyber.gc.ca
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 released patches for two critical remote code execution vulnerabilities in **NGINX Open Source** and **NGINX Plus**: `CVE-2026-42530`, a use-after-free flaw in the HTTP/3 QUIC module, and `CVE-2026-42055`, a heap-based buffer overflow in HTTP/2 proxy modules. Both issues carry a **CVSS 9.2** rating and can be exploited remotely without authentication under specific configurations, potentially affecting a broad set of F5 NGINX products including **NGINX Plus, Ingress Controller, Gateway Fabric, Instance Manager, and App Protect WAF**. F5 said the flaws were fixed in **NGINX Open Source 1.31.2 and 1.30.3** and published mitigations for organizations that cannot patch immediately, including disabling HTTP/3, restoring `ignore_invalid_headers` to its default behavior, and reducing `large_client_header_buffers` sizes. A related Apache HTTP Server security update was also issued by EG-FinCIRT, underscoring continued patching activity around widely deployed web server infrastructure, although no active exploitation of the NGINX flaws had been confirmed at the time of reporting.
Jul 7, 2026
F5 has disclosed multiple vulnerabilities affecting **NGINX** product lines, including **NGINX Open Source**, **NGINX Plus**, **NGINX Gateway Fabric**, and **NGINX Ingress Controller**, with the most serious issue tracked as **`CVE-2026-42533`**. The flaw can lead to **remote code execution**, while additional reported weaknesses include **information disclosure** and **security restriction bypass** across several version ranges. National cybersecurity authorities in Europe have highlighted the breadth of affected products and the severity of the exposure. F5 released fixes on **2026-07-15** and urged customers to update immediately, warning that the vulnerable configuration is considered typical even if not every deployment is affected. Authorities also noted that **proof-of-concept exploit code** is already public, raising the likelihood of opportunistic attacks despite no confirmed large-scale exploitation so far. Where immediate patching is not possible, temporary mitigations are available, but vendor-recommended upgrades to fixed versions remain the primary remediation step.
Jul 30, 2026
F5 disclosed multiple high-severity vulnerabilities affecting **NGINX Open Source**, **NGINX Plus**, and related products, including a critical heap-based buffer overflow in `ngx_http_proxy_v2_module` and `ngx_http_grpc_module` tracked as **CVE-2026-42055**. The flaw can be triggered remotely without authentication when HTTP/2 proxying or `grpc_pass` is enabled, `ignore_invalid_headers` is set to `off`, and `large_client_header_buffers` exceeds 2 MB, allowing oversized headers to crash worker processes and potentially enable code execution if ASLR is bypassed. F5 also disclosed **CVE-2026-42530**, a critical use-after-free in the open-source `ngx_http_v3_module` that can be exploited through a crafted HTTP/3 QUIC session to reopen a QPACK encoder stream, again causing worker restarts and possible code execution. A separate issue, **CVE-2026-11311**, affects **NGINX Gateway Fabric** when **NGINX Plus** is used as the data plane, allowing authenticated users with permission to modify relevant CRDs to inject arbitrary NGINX directives through unsanitized values in `NginxProxy.serverTokens` and `AuthenticationFilter.extraAuthArgs`. F5's out-of-band advisory said the exposure spans a broad set of products, including **NGINX Ingress Controller**, **NGINX Instance Manager**, **NGINX App Protect WAF**, **NGINX App Protect DoS**, **F5 WAF for NGINX Instance Manager**, and **F5 DoS for NGINX**. Updated releases, including **nginx 1.31.2** and the stable branch **1.30.3**, were published to address the core NGINX flaws, and defenders were urged to patch affected versions or disable HTTP/3 QUIC where immediate updates are not possible.
Jul 23, 2026