[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6Wc4iIHlOoL4W2lSDydmfE2wZpoP-qc2YbDTsuhkXKg":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b2fb8136-707c-432c-9c11-d254d579c62c","Critical flaw in software powering a third of the internet is already being exploited – free checker now available","critical-flaw-in-software-powering-a-third-of-the-internet-is-already-being-expl-9bb7cc","A critical security vulnerability in NGINX, the web server software underpinning more than 30% of all websites globally, has been confirmed as actively exploited in the wild, less than a week after its public disclosure. The flaw, tracked as CVE-2026-42945 and dubbed ‘NGINX Rift’, carries a severity score of 9.8 out of 10. It affects […] The post Critical flaw in software powering a third of the internet is already being exploited – free checker now available appeared first on IT Security Guru.","A critical vulnerability (CVE-2026-42945, severity 9.8) in NGINX's URL rewriting module is being actively exploited in the wild, less than a week after public disclosure. The flaw affects virtually every standard NGINX build from 2008 to May 2026 and can cause denial of service or remote code execution. F5 released emergency patches and a free detection scanner is now available, but patching is complicated for organizations using containerized deployments and Kubernetes ingress controllers.","NGINX critical flaw CVE-2026-42945 actively exploited days after disclosure; affects 30% of internet","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F05\u002F20\u002Fcritical-flaw-in-software-powering-a-third-of-the-internet-is-already-being-exploited-free-checker-now-available\u002F?utm_source=rss&utm_medium=rss&utm_campaign=critical-flaw-in-software-powering-a-third-of-the-internet-is-already-being-exploited-free-checker-now-available","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FChatGPT-Image-May-20-2026-03_03_38-PM.png","2026-05-20T14:04:36+00:00","2026-05-20T16:00:29.422738+00:00",10,[17,20,23,25,28],{"name":18,"type":19},"NGINX","product",{"name":21,"type":22},"F5","vendor",{"name":24,"type":19},"NGINX Plus",{"name":26,"type":27},"Kubernetes","technology",{"name":29,"type":22},"Pentest-Tools.com","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[52],{"type":53,"value":54,"context":55},"cve","CVE-2026-42945","Critical NGINX vulnerability in ngx_http_rewrite_module, actively exploited, CVSS 9.8",[21,29,18],{"controls":58,"vendors":141},[59,88,113],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,105],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":89,"product_name":102,"url":103,"description":104},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":114,"name":115,"problem":116,"products":117},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[118,126,133],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":127,"vendor_name":21,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"f5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[142],{"slug":127,"name":21,"logo_path":128,"roles":143},[144,145],"affected","reported_by"]