Cybersecurity researchers are warning that attackers have already started exploiting a newly disclosed NGINX vulnerability, tracked as CVE-2026-42945, just days after technical details and proof-of-concept code became public. The flaw, also referred to as NGINX Rift, affects millions of potentially exposed servers and has raised concerns across the security community due to its potential impact on core internet infrastructure.
Security researcher Patrick Garrity of VulnCheck revealed on Satu
Cybersecurity researchers are warning that attackers have already started exploiting a newly disclosed NGINX vulnerability, tracked as CVE-2026-42945, just days after technical details and proof-of-concept code became public. The flaw, also referred to as NGINX Rift, affects millions of potentially exposed servers and has raised concerns across the security community due to its potential impact on core internet infrastructure.Security researcher Patrick Garrity of VulnCheck revealed on Saturday that exploitation attempts targeting CVE-2026-42945 were detected shortly after disclosure. The vulnerability was publicly announced the previous week and is considered critical because it can be abused to trigger denial-of-service conditions and may also enable unauthenticated remote code execution under specific circumstances.
What Is NGINX and Why the Vulnerability Matters
NGINX is one of the most widely used web servers in the world and serves as a foundational component of modern internet infrastructure. In addition to functioning as a web server, it is commonly deployed as a load balancer, reverse proxy, and HTTP cache.The software is maintained by application delivery and networking company F5, which oversees the development of both the open-source edition, known as NGINX Open Source, and the commercial offering, NGINX Plus. The company has also integrated NGINX into several of its security and application delivery products.Because of NGINX’s extensive global deployment, the discovery of NGINX Rift and the rapid emergence of exploitation attempts have intensified concerns about large-scale exposure.
Technical Details Behind CVE-2026-42945
The NGINX vulnerability CVE-2026-42945 is classified as a memory corruption flaw affecting NGINX Open Source versions 0.6.27 through 1.30.0 and NGINX Plus versions R32 through R36. Several F5 products that incorporate NGINX are also impacted, including NGINX Ingress Controller and F5 WAF for NGINX.Researchers explained that the flaw originates in the ngx_http_rewrite_module. According to the disclosure, a remote and unauthenticated attacker can corrupt heap memory within an NGINX worker process by sending a specially crafted HTTP request.The vulnerability is triggered through a relatively common configuration pattern involving rewrite directives that use unnamed regular expression captures such as $1 or $2, combined with a replacement string containing a question mark and followed by another rewrite, if, or set directive.Researchers who uncovered the flaw stated:“A bug in the ngx_http_rewrite_module lets a remote, unauthenticated attacker corrupt the heap of an NGINX worker process by sending crafted URI.”They further explained that NGINX calculates a destination buffer using one set of escaping assumptions but writes data using another, ultimately causing writes beyond the allocated memory region.According to the researchers:“The write runs past the allocated buffer, producing deterministic memory corruption. The bytes written past the allocation are derived from the attacker’s URI, so the corruption is shaped by the attacker rather than random.”The researchers also warned that repeated malicious requests could force NGINX workers into continuous crash loops, severely affecting the availability of websites and applications hosted on vulnerable systems.
Patches and Mitigation Measures Released
F5 has already released fixes for the NGINX vulnerability CVE-2026-42945 across multiple products. The issue has been addressed in:
NGINX Open Source versions 1.31.0 and 1.30.1
NGINX Plus versions R36 P4 and R32 P6
F5 WAF for NGINX v5.13.0
F5 DoS for NGINX v4.9.0
In addition to software updates, F5 recommended a mitigation strategy for organizations unable to patch immediately. The company advised administrators to replace unnamed regex captures in rewrite rules with named captures to reduce exposure to NGINX Rift attacks.Meanwhile, Linux distribution maintainers, including AlmaLinux, Ubuntu, and Debian developers, have started rolling out patched NGINX packages to address CVE-2026-42945.With exploitation attempts already underway, security experts are urging organizations to review their NGINX configurations, apply available patches immediately, and audit rewrite rules that may expose systems to the NGINX vulnerability.
A newly issued cybersecurity advisory highlights an evolution in the tactics, techniques and procedures (TTPs) employed by China-Nexus threat actors. The report, released with support from the UK Cyber League and coordinated by the National Cyber Security Centre (NCSC-UK) alongside international partners, sheds light on how Chinese threat actors are relying on large-scale covert networks of compromised devices to conduct malicious cyber operations.
A Strategic Shift in China-Nexus TTPs
In rec
A newly issued cybersecurity advisory highlights an evolution in the tactics, techniques and procedures (TTPs) employed by China-Nexus threat actors. The report, released with support from the UK Cyber League and coordinated by the National Cyber Security Centre (NCSC-UK) alongside international partners, sheds light on how Chinese threat actors are relying on large-scale covert networks of compromised devices to conduct malicious cyber operations.
A Strategic Shift in China-Nexus TTPs
In recent years, cybersecurity experts have observed a clear transition in China-Nexus TTPs. Rather than relying on dedicated, individually controlled infrastructure, Chinese threat actors are now leveraging expansive networks of compromised devices, commonly referred to as covert networks or botnets. These networks are primarily composed of Small Office/Home Office (SOHO) routers, Internet of Things (IoT) devices, and other internet-connected hardware.According to the advisory, the majority of China-Nexus actors are believed to be using such covert networks, with multiple networks operating simultaneously and often shared among different groups. These networks are continuously updated, making them highly adaptable and difficult to track.Any organization targeted by Chinese threat actors could be affected. For example, the group known as Volt Typhoon has used these covert networks to pre-position cyber capabilities within critical infrastructure, while Flax Typhoon leveraged similar methods for espionage operations.
How Covert Networks Operate
Although botnets are not new, China-Nexus actors are now deploying them at an unprecedented scale and with strategic intent. These covert networks allow attackers to mask their identity, route malicious traffic through multiple nodes, and reduce the risk of attribution.Typically, an attacker accesses the network via an entry point, or “on-ramp,” and routes activity through numerous compromised devices—called traversal nodes—before exiting near the target. This multi-hop approach obscures the origin of the attack.These networks support every stage of a cyber operation, from reconnaissance and scanning to malware delivery, command-and-control communication, and data exfiltration. They are also used for general browsing, enabling threat actors to research vulnerabilities and refine TTPs without revealing their identity. The presence of legitimate users on some networks further complicates attribution.
Real-World Examples and Scale
Evidence suggests that some covert networks used by China-Nexus actors are developed and maintained by Chinese cybersecurity firms. One notable example is the “Raptor Train” network, which infected over 200,000 devices globally in 2024. It was reportedly managed by Integrity Technology Group, a company also linked by the FBI to activities associated with Flax Typhoon.Another example includes the KV Botnet used by Volt Typhoon, which primarily exploited outdated Cisco and NetGear routers. These devices were particularly vulnerable because they had reached “end-of-life” status, meaning they no longer received security updates.The scale and adaptability of these networks present a major challenge. As Paul Chichester, NCSC Director of Operations, stated: “Botnet operations represent a significant hreat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyberattacks.”
Challenges for Network Defenders
Cybersecurity researchers have long been aware of such threats, but the evolving nature of China-Nexus TTPs introduces new difficulties. A key issue identified by Mandiant Intelligence in May 2024 is “indicator of compromise (IOC) extinction.” Traditional defenses, such as static IP blocklists, are becoming less effective because attackers can operate from vast, constantly changing pools of devices.As compromised nodes are patched or removed, new ones are quickly added, making these networks highly dynamic. This fluidity undermines conventional detection and mitigation strategies.
Defensive Measures and Best Practices
The advisory outlines several steps organizations can take to defend against China-Nexus covert networks:
For all organizations:
Maintain a clear inventory of network edge devices.
Establish baselines for normal network activity, particularly VPN access.
Monitor for unusual connections, including those from consumer broadband ranges.
Entrar
