F5 has released out-of-band emergency patches for three critical NGINX vulnerabilities - CVE-2026-15176, CVE-2026-97205 and CVE-2026-93479 - each rated 9.2 CVSS. The flaws are heap-buffer-overflow issues in ngx_http_core_module and a map-directive regex handling bug that allow specially crafted HTTP requests to crash worker processes, cause denial-of-service, and enable remote code execution when Address Space Layout Randomization (ASLR) is disabled or bypassed. Affected products include NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric and NGINX Instance Manager. Because NGINX commonly terminates TLS as a reverse proxy and ingress, successful code execution risks exposing passwords, session cookies, API tokens and private keys. F5 reports no known active exploitation to date but urges immediate upgrades.
Practical mitigations accompany the patches: install the fixed versions or apply configuration workarounds - avoid using $request_filename with alias in location blocks, disable asynchronous file I/O (AIO) and Server Side Includes (SSI), and replace unnamed regex captures in map blocks with named captures limited to the matching block. Operators must inventory all NGINX installations (including embedded copies and distro packages), confirm ASLR and other OS protections are enabled, run workers unprivileged, segment the front door, and monitor for worker restarts. Historical targeting of F5 components and the prevalence of NGINX make rapid auditing and patching essential; vendor fixes do not automatically propagate through distributions or appliance images.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Warhound, backed by $200 million in funding, aims to genetically engineer military and law enforcement dogs with enhanced traits. The company seeks to address the shortage and quality issues of working dogs used by the U.S. military and police. (techcrunch.com)
A US appeals court removed a judge from a case due to errors caused by AI. The decision highlights concerns over AI reliability in judicial proceedings. (reuters.com)
Fraud losses among Americans aged 60 and older reached $3 billion in 2025, a 25% increase from the previous year. The number of victims losing at least $100,000 nearly sextupled from 2020 to 2025, driving much of the growth. (cnbc.com)
LLMs now enable large-scale formal software verification, allowing developers to mathematically prove security properties of code. This breakthrough helps identify and fix long-standing bugs in critical software like assembly code, enhancing cybersecurity. (anthropic.com)
Canada's Parliament is considering Bill C-22, which would significantly expand surveillance powers and require digital services to assist law enforcement. Canadians are urged to oppose the bill before it advances further, as it threatens privacy and security. (eff.org)
US banks are blocking third-party AI agents from accessing customer accounts to prevent unauthorized activity. The move aims to enhance security and protect customer data from potential AI-driven breaches. (reuters.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.