Critical Vulnerabilities Rock Next.js, macOS, MongoDB, Nginx, and More in an 'Apocalyptic' Week for Software Security

The past week has seen an alarming surge in critical software vulnerabilities, prompting urgent action across major tech ecosystems. Next.js, the popular React framework, disclosed a Server-Side Request Forgery (SSRF) vulnerability (CVSS 8.6/10) affecting all versions from 13 to 16. This flaw, described as simple to exploit, allows attackers to force the server to make internal requests, potentially leading to credential theft, API key compromise, and access to internal administration panels. Notably, no patch is available for Next.js versions 13 and 14, requiring users to upgrade to at least 15.5.16.

Apple’s M5 chips faced their first public kernel memory corruption exploit, developed in just five days by researchers using Mizo’s preview, enabling privilege escalation to root despite Apple’s hardware-assisted Memory Integrity Enforcement. While not a direct remote attack, this local exploit, similar to recent Linux vulnerabilities, underscores the ongoing challenge of kernel-level security. MongoDB also revealed a critical arbitrary code execution (RCE) vulnerability (CVSS 8.8/10) impacting versions 5 through 8.3, potentially granting attackers full server control and exposing millions of records. Microsoft Windows saw the re-emergence of a Mini Plasma zero-day, a privilege escalation flaw previously reported and patched in 2020, now seemingly re-exploitable. Perhaps most concerning, Nginx, a widely used web server and reverse proxy, disclosed an 18-year-old remote code execution vulnerability (CVSS 9.2/10) affecting versions 1.30.0 and older. This long-hidden bug, exploitable if Address Space Layout Randomization (ASLR) is disabled, presents a severe threat, with experts warning of rapid automated exploitation.

Beyond these core systems, OpenClaw, an AI agent orchestration platform, reported a chain of critical vulnerabilities (one with CVSS 9.6/10) allowing sandbox escape, access to sensitive environment variables, and persistent backdoors. This incident has fueled broader discussions about the security implications of rapid, AI-driven software development, especially given reports of the platform’s creator spending over a million dollars on OpenAI API calls in a single month. Finally, Grafana Labs confirmed a breach where an unauthorized entity obtained a GitHub access token and downloaded its Enterprise codebase. The incident, mirroring a previous attack on Tamstack, was attributed to the incorrect use of pull_request_target in GitHub Actions workflows. This common misconfiguration grants external contributors from forks unintended access to repository secrets and arbitrary code execution capabilities, highlighting a critical security best practice: avoid pull_request_target in public repositories. Grafana’s decision to primarily disclose the breach on Twitter rather than its official website also drew criticism regarding transparency in incident communication.