The Hacker News

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX 1.30.6 and 1.31.7 fix five configuration-dependent flaws, including three memory bugs that could crash workers or enable code execution.
Hosted on MSN

NGINX map regex RCE gets public scanner: Patch now, full exploit due August

A security researcher released a public static config scanner Monday for a critical heap buffer overflow in NGINX that has existed since 2011, and the full proof-of-concept exploit that can deliver ...
Hosted on MSN

A remote denial-of-service exploit affects every major web server — NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora — researchers warn

Security researchers have identified a remote denial-of-service attack technique that targets HTTP/2 compression handling across five of the most widely deployed web servers: NGINX, Apache HTTPD, ...
Dark Reading

Critical MCP Integration Flaw Puts NGINX at Risk

Attackers are actively exploiting a critical flaw in the widely used nginx-ui interface for managing NGINX web servers. The flaw, tracked as CVE-2026-33032, (CVSS: 9.8) stems from nginx-ui's insecure ...
Help Net Security

Ingress-nginx vulnerabilities can lead to Kubernetes cluster takeover

Wiz researchers have unearthed several critical vulnerabilities affecting Ingress NGINX Controller for Kubernetes (ingress-nginx) that may allow attackers to take over Kubernetes clusters. “Based on ...