NGINX Rift attackers waste no time targeting exposed servers

Researchers say 18-year-old flaw already being probed and exploited just days after disclosure

Exploit attempts are already hammering a newly disclosed NGINX bug dubbed "NGINX Rift," proving once again that attackers read patch notes faster than most admins.

Researchers at VulnCheck said they are seeing active exploitation tied to CVE-2026-42945, a heap buffer overflow flaw affecting both NGINX Open Source and NGINX Plus that was disclosed last week after apparently sitting unnoticed for 18 years.

VulnCheck's Patrick Garrity said the company observed exploitation activity on its canary systems "just days after the CVE was published."

"An unauthenticated attacker can crash the NGINX worker process by sending crafted HTTP requests," he said. "On servers with ASLR disabled – which, of course, is extremely unlikely – code execution is possible."

Researchers at Depthfirstdisclosed the bug last week, saying the flaw had been sitting in NGINX's rewrite module since 2008. The vulnerability,...

Copyright of this story solely belongs to theregister.com. To see the full text click HERE