Critical

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

The Hacker News

July 19, 2026 at 8:42 PM

Overview

F5 has released important updates to address a critical vulnerability in NGINX, identified as CVE-2026-42533. This flaw allows attackers to send specially crafted HTTP requests that can cause a heap buffer overflow in the NGINX worker process. As a result, this vulnerability could lead to the crashing or restarting of the worker, effectively denying service to legitimate users. The issue affects versions of NGINX prior to 1.30.4 and 1.31.3, as well as NGINX Plus versions before 37.0.3.1. Users running these versions should upgrade immediately to protect their systems from potential exploitation.

Key Takeaways

Affected Systems: NGINX versions prior to 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus versions before 37.0.3.1.
Action Required: Upgrade to NGINX version 1.
Timeline: Disclosed on July 15, 2023

Original Article Summary

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade. Triggering it can crash or restart the worker, causing a denial of

Impact

NGINX versions prior to 1.30.4 (stable), 1.31.3 (mainline), and NGINX Plus versions before 37.0.3.1.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on July 15, 2023

Remediation

Upgrade to NGINX version 1.30.4 or 1.31.3, or NGINX Plus version 37.0.3.1 or later.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Critical, and 2 more.

Read Original Article

Related Coverage

CISOs Feel the Heat Over AI Risk

darkreading

As companies increasingly adopt artificial intelligence technologies, Chief Information Security Officers (CISOs) are feeling the pressure. A recent survey revealed that 26% of these top security executives are contemplating leaving their roles due to the heightened demands and risks associated with AI. This shift in focus comes as organizations scramble to integrate AI tools while also managing potential vulnerabilities and security threats that could arise from their use. The concerns reflect a broader challenge in balancing innovation with security, as companies must ensure they are protecting sensitive data and maintaining compliance amidst rapid technological changes. The implications of this trend could lead to a shake-up in security leadership and strategy as organizations seek to address both the opportunities and risks presented by AI.

Jul 20, 2026

Attackers Combo Up Evasion Tactics for BEC Phishing

darkreading

A new phishing campaign, dubbed 'The TFF Trap', employs sophisticated evasion tactics to execute business email compromise (BEC) attacks. This method utilizes fileless techniques and low-detection loaders to deploy various remote access trojans (RATs) and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger. The attackers aim to infiltrate corporate networks and steal sensitive information. Organizations should be on high alert, as these tactics make it challenging for traditional security measures to detect the malicious activities. Companies must bolster their email security practices and educate employees on recognizing phishing attempts to mitigate the risks associated with this evolving threat.

Jul 20, 2026

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

The Hacker News

Researchers have identified around 7,600 malicious repositories on GitHub as part of a campaign called FakeGit. Over 800 of these repositories masquerade as AI projects or Model Context Protocol (MCP) servers, with the aim of distributing SmartLoader malware. This malware targets users by using copied projects and convincing documentation to lure them into downloading harmful files. The campaign is particularly concerning because it exploits the popularity of AI and related technologies, making it more likely for unsuspecting developers and users to fall victim. As a result, it’s crucial for individuals and organizations to be vigilant when downloading software from GitHub and to verify the authenticity of repositories before engaging with them.

Jul 20, 2026

Director of Commerce AI standards office out after three months

CyberScoop

The Director of the newly formed Center for AI Standards and Innovation, part of the Department of Commerce, has left the position after just three months. This center was established to evaluate the risks and challenges associated with artificial intelligence technologies. The sudden departure raises questions about leadership stability and the future direction of the center, which plays a pivotal role in shaping federal AI policy. With AI systems increasingly integrated into various sectors, effective oversight is crucial to mitigate potential harms. The vacancy may hinder efforts to develop comprehensive standards that ensure AI technologies are safe and beneficial for society.

Jul 20, 2026

Cruciferra Crypter Uses Process Ghosting to Evade Detection

Infosecurity Magazine

Researchers have identified a new crypter known as Cruciferra that employs advanced techniques to evade detection by security software. This crypter utilizes a method called process ghosting, along with 90 custom ciphers, to obscure malicious payloads for various cyber actors. The ability to hide effectively means that malware can be deployed without triggering alarms, making it a significant concern for cybersecurity professionals. The techniques used by Cruciferra can complicate the detection and analysis of threats, potentially allowing attackers to compromise systems more easily. As this method becomes more widespread, organizations need to enhance their defenses and monitoring to counteract these stealthy tactics.

Jul 20, 2026

ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)

Help Net Security

A critical vulnerability in the ServiceNow AI Platform, identified as CVE-2026-6875, is being actively exploited by attackers. This pre-authentication code injection flaw allows unauthenticated users to escape the platform's script sandbox and execute arbitrary code on targeted instances. Researchers from Searchlight Cyber discovered this vulnerability and reported it to ServiceNow in early April 2026. The exploitation of this vulnerability poses significant risks to organizations using the ServiceNow AI Platform, as it could lead to unauthorized access and control over sensitive workflows and data. Companies are urged to take immediate action to safeguard their systems against potential attacks.

Jul 20, 2026