Critical flaw in software powering a third of the internet is already being exploited – free checker now available
NGINX critical flaw CVE-2026-42945 actively exploited days after disclosure; affects 30% of internet
A critical vulnerability (CVE-2026-42945, severity 9.8) in NGINX's URL rewriting module is being actively exploited in the wild, less than a week after public disclosure. The flaw affects virtually every standard NGINX build from 2008 to May 2026 and can cause denial of service or remote code execution. F5 released emergency patches and a free detection scanner is now available, but patching is complicated for organizations using containerized deployments and Kubernetes ingress controllers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run F5?
Get an email when a new story names F5, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-42945