Loading story…
F5 issued a security update for BIG-IP Next for Kubernetes to remediate multiple PostgreSQL vulnerabilities that could let an attacker execute arbitrary code as the operating system user running the database. The update highlights CVE-2026-2006, a PostgreSQL flaw involving missing validation of multibyte character length, rated CVSS 8.8, and also references CVE-2026-2005 and CVE-2026-2004.
The advisories urge organizations using the affected platform to test and deploy the patch quickly and to coordinate with vendors whose products embed the vulnerable third-party component to determine exposure. The notices were published through EG-FinCIRT and describe the issue as affecting the PostgreSQL component within F5's Kubernetes-focused application delivery platform.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On June 23, 2026, F5 released a security update to address multiple PostgreSQL vulnerabilities affecting BIG-IP Next for Kubernetes. The notice highlights CVE-2026-2006 and also references CVE-2026-2005 and CVE-2026-2004, warning that successful exploitation could allow arbitrary code execution as the operating system user running the database.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
egfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed an **integer wraparound/overflow** flaw in PostgreSQL’s *libpq* client library (tracked as **CVE-2025-12818**) that can be triggered via the `PQescapeInternal` code path used by `PQescapeLiteral` and `PQescapeIdentifier`. When a crafted input string of certain lengths includes quotes and/or backslashes, *libpq* can miscalculate the required buffer size, allocate too little memory, and then perform an **out-of-bounds write by hundreds of megabytes**, typically resulting in a **segmentation fault (DoS)** in the consuming application. F5’s product advisories state that PostgreSQL versions prior to **18.1, 17.7, 16.11, 15.15, 14.20, and 13.23** are affected by CVE-2025-12818, but report **no impact to F5 products** after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in `CREATE STATISTICS` (**CVE-2025-12817**), a curl cross-protocol redirect token-leak issue (**CVE-2025-14524**), an Apache Solr *create core* input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (**CVE-2026-22444**), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (**CVE-2025-24325**).
Jun 29, 2026
F5 has disclosed multiple vulnerabilities affecting **NGINX** product lines, including **NGINX Open Source**, **NGINX Plus**, **NGINX Gateway Fabric**, and **NGINX Ingress Controller**, with the most serious issue tracked as **`CVE-2026-42533`**. The flaw can lead to **remote code execution**, while additional reported weaknesses include **information disclosure** and **security restriction bypass** across several version ranges. National cybersecurity authorities in Europe have highlighted the breadth of affected products and the severity of the exposure. F5 released fixes on **2026-07-15** and urged customers to update immediately, warning that the vulnerable configuration is considered typical even if not every deployment is affected. Authorities also noted that **proof-of-concept exploit code** is already public, raising the likelihood of opportunistic attacks despite no confirmed large-scale exploitation so far. Where immediate patching is not possible, temporary mitigations are available, but vendor-recommended upgrades to fixed versions remain the primary remediation step.
Jul 30, 2026
F5 published product advisories covering two separate upstream security flaws affecting widely used core components: **Linux kernel** vulnerability `CVE-2025-40154` and **OpenSSL** vulnerability `CVE-2025-68160`. The notices indicate vendor tracking and assessment activity for vulnerabilities in foundational software commonly embedded in network, application delivery, and security appliances. The advisories were released through F5's product advisory channel under knowledge base articles `K000160420` and `K000160552`. While the referenced notices provide limited public synopsis text, the combined updates show F5 alerting customers to potential product impact from both an operating system kernel issue and a cryptographic library flaw, signaling the need for customers to review affected-product guidance and remediation information as it becomes available.
Jun 29, 2026