---
id: 6172
title: "Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries"
source_domain: hunt.io
source_url: "https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve"
published_at: "2026-07-20T00:00:00Z"
tags: ["attack-chains", "threat-intelligence", "malware", "exploit-kit", "nginx", "cve-2026-42945", "open-directory", "ghost-cms"]
phying_url: "https://phying.com/item/6172"
lang: en
---

# Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries

## Summary

An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-07-20T00:00:00Z
- **Original:** https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve
- **Phying News:** https://phying.com/item/6172