Live data from Hacker News

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

xbow.com

31–40 of 48 posts

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#31

Earlier quoted context omitted.

Nah I’m just sick of the melodramatic style of writing that seems to pervade all of the major tech blogs and companies now. These people write like they picture themselves as sages describing the end times to scared children.

And? then keep it for yourself. Why do i have to read your ignorant comment? You complain about their writing style, no one forced you to read, which you could summarize with an AI if you even cared for the conent but no. And i read A LOT and i do not come across this writing style at all.

>And? then keep it for yourself. Why do i have to read your ignorant comment?

On a site dedicated to commenting on articles? I think you have a misunderstanding of how HN works. People (hopefully) read the article and share uninformed^H informed opinions on the article.

That has always included critique of the way that the content is written.

In this case, very valid critique. I'm astounded you're somehow managing to read "A LOT" and not run into it regularly. At least we seem to be moving away from the absolutely awful "I'm a crazy frat bro" style of writing where it feels like half the action sentences should be appended with "because I'm crazy!" that was spreading far too far and wide (hopefully because it's hard to coax AI into that style.)

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#32
Never heard of Exim, I'm just realizing what it is:

> Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email.

what's the significance of this? do people use this in production systems?

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#33
post #32

Never heard of Exim, I'm just realizing what it is: > Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. what's the significance of this? do people use this in production systems?

I had the exact same reaction - never heard of this.

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#34
post #32

Never heard of Exim, I'm just realizing what it is: > Exim is an open-source Mail Transfer Agent (MTA) designed for Unix-like systems to receive, route, and deliver email. what's the significance of this? do people use this in production systems?

Exim is apparently the largest email server these days... it used to be postfix, but with most people using Gmail or 365, running your own email seems to be an afterthought. /shrug

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#35

Earlier quoted context omitted.

Nah I’m just sick of the melodramatic style of writing that seems to pervade all of the major tech blogs and companies now. These people write like they picture themselves as sages describing the end times to scared children.

And? then keep it for yourself. Why do i have to read your ignorant comment? You complain about their writing style, no one forced you to read, which you could summarize with an AI if you even cared for the conent but no. And i read A LOT and i do not come across this writing style at all.

Complaining about someone's comment is inconsistent with your world view, if complaining about a blogger's writing style is verboten.

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#36
post #28
post #15

Previously (2023): https://www.bleepingcomputer.com/news/security/millions-of-e... Previously (2020): https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE... Previously (2019): https://www.cvedetails.com/vulnerability-list/vendor_id-1091...

What are you actually trying to say with these links?

"No way to prevent this!" say users of only language where this regularly happens.

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#37

>The bug is a use-after-free triggered when a TLS connection is handled by GnuTLS Color me surprised. The GNU ecosystem has had more than its fair share of CVEs over the years to the point that it's now a common trope: https://soatok.blog/2020/07/08/gnu-a-heuristic-for-bad-crypt...

If you read the rest of the post, gnutls wasn't the cause.

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#38
post #10
post #9

Earlier quoted context omitted.

Many years ago I used Exim because it was default for my distro of choice back then. But after a few emergency patchings caused by yet another RCE in Exim I learned that switching to Postfix massively improved my sleep quality.

There's a weird folk belief that Exim is a secure 2nd-generation MTA, but it's not; it's a 1st generation MTA, like Sendmail and Smail. The two "secure" 2nd generation MTAs are Postfix and qmail. You shouldn't use those either, really; there is no reason to run a memory-unsafe MTA, or, for that matter, an MTA that isn't backed by a real database.

The problem with qmail is, everybody use a fork. No body use the real thing.

The official release is not standard compliance. It does not support anything modern spam filter need. It don't get new updates or features. It have funny license.

You can use a fork... but I need to ask: which fork?

Re: Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

#40
post #28
post #15

Previously (2023): https://www.bleepingcomputer.com/news/security/millions-of-e... Previously (2020): https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE... Previously (2019): https://www.cvedetails.com/vulnerability-list/vendor_id-1091...

What are you actually trying to say with these links?

That Exim seems to have a relatiely high density of RCE vulnerabilities that are being made public regularly.

(The track record is considerably worse than other widely used Unix MTAs, roughly on par with MS Exchange.)

Post reply on HN