Nx

A Zip-Slip vulnerability in the Nx self-hosted HTTP remote cache allows a malicious cache server to write files to arbitrary locations on a client machine, leading to potential remote code execution.

Nx Console contained an embedded malicious code vulnerability (CVE-2026-48027) which allowed a malicious version of the extension to be published and harvest credentials from disk and memory.

This brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.