Critical Exim RCE Flaw CVE-2026-45185 Lets Attackers Hijack Mail Servers Remotely

·1 views

A critical use-after-free vulnerability, CVE-2026-45185, was disclosed on May 12, 2026, affecting Exim mail transfer agent versions 4.97 through 4.99.2 built with GnuTLS. The flaw, dubbed 'Dead.Letter,' allows unauthenticated remote attackers to achieve arbitrary code execution by sending a specially crafted BDAT sequence over an SMTP connection. Exim is the default mail server on Debian, Ubuntu, and many other Linux distributions, making the potential attack surface extremely large. The vulnerability was discovered by the XBOW research team, who used AI assistance to develop a working exploit — raising concerns about how quickly similar attacks could be replicated. Exim has released version 4.99.3 to fully address the issue, and administrators are urged to upgrade immediately; systems using OpenSSL instead of GnuTLS are not affected.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How NGINX Acts as a Gateway to Route Traffic Between Docker Containers

In a typical containerised web application, NGINX serves as the sole internet-facing entry point, routing incoming browser requests to the appropriate internal Docker containers. When a user visits a site, DNS resolves the domain to the server's public IP, and NGINX receives the request before any other service does. Requests to the root path are forwarded to the frontend container, while paths beginning with '/api' are directed to the backend service. The backend processes logic and queries a PostgreSQL database, which remains entirely hidden from the public internet. This architecture keeps internal services isolated within Docker's private network, improving both security and maintainability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a 10-Minute Post-Call Follow-Up Can Help Freelancers Win Client Renewals

A structured follow-up sent within an hour of a client call can significantly improve a freelancer's chances of contract renewal, according to a piece published on DEV Community. The recommended format includes a three-line call recap, a simple action table listing tasks with owners and deadlines, and a single clear next step. The rationale is that clients rarely leave over poor work quality — they leave because they feel uninformed and anxious about project progress. A concise follow-up addresses that anxiety by demonstrating organization and clarity. The author also notes that automating this process can help freelancers stay consistent, especially during busy periods.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Tools: Fundamentals of Optimizing Expenditures

Liquid syntax error: Unknown tag 'endraw'

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free browser-based subtitle tools let you convert and edit SRT/VTT files privately

A developer has launched a free suite of subtitle utilities under the project Lazyblink, designed to run entirely in the browser without uploading files to any server. The toolset supports SRT and VTT format conversion, plain-text transcript extraction, and caption timing adjustments to fix sync issues. Because all processing is handled client-side via JavaScript, no backend infrastructure is required and files never leave the user's device. The developer built the tools to address common frustrations with existing online subtitle services, which often require signups, add watermarks, or store user files remotely. The tools are available at lazyblink.com/subtitle-tools with no registration or cost required.

0 comments Read more at DEV Community