Post B6SEAHfl2XNChDA0gq by privateger@plasmatrap.com
 (DIR) More posts by privateger@plasmatrap.com
 (DIR) Post #B6SCsE8VLiqWYsQsK0 by beyondmachines1@infosec.exchange
       0 likes, 1 repeats
       
       Critical NGINX Heap Overflow Vulnerability Actively ExploitedF5's NGINX Open Source and NGINX Plus are facing active exploitation of a critical heap buffer overflow (CVE-2026-42945) that allows unauthenticated attackers to cause denial-of-service or remote code execution.**If you're running NGINX Open Source or NGINX Plus, make sure that  ASLR is enabled on your system. Then upgrade to a patched version (NGINX Open Source 1.30.1/1.31.0, or NGINX Plus R36 P4/R32 P6) before attackers find your server. If you can't upgrade right away, change any unnamed captures in your rewrite rules (like $1) to named captures (like (?<id>[0-9]+)) to block the attack path.**#cybersecurity #infosec #attack #activeexploithttps://beyondmachines.net/event_details/critical-nginx-heap-overflow-vulnerability-actively-exploited-q-8-4-h-o/gD2P6Ple2L
       
 (DIR) Post #B6SDr2xZW7lNYzJtKK by icedquinn@blob.cat
       0 likes, 0 repeats
       
       really need to figure out how much of a pain it is to actually run why3.RE: https://infosec.exchange/@beyondmachines1/116601131371417049
       
 (DIR) Post #B6SEAHfl2XNChDA0gq by privateger@plasmatrap.com
       0 likes, 0 repeats
       
       @icedquinn@blob.cat worth pointing out that this is a nothingburger for most people. ASLR is the default on anything worth talking about, and the path capture needed is rare as well ​:woozy_blahaj:​
       
 (DIR) Post #B6SEH1SlhlLqRyIXTc by icedquinn@blob.cat
       0 likes, 0 repeats
       
       @privateger maybe but parsing is one of those things that is super amenable to model based programming. this kind of shit shouldn't STILL be happening
       
 (DIR) Post #B6SEIW5xIjMVk9L8KW by privateger@plasmatrap.com
       0 likes, 0 repeats
       
       @icedquinn@blob.cat true!