Hackers Actively Exploiting Critical NGINX RCE Vulnerability in the Wild

Security researchers reported active exploitation of CVE-2026-42945, a heap buffer overflow affecting NGINX Open Source and NGINX Plus that can crash worker processes and, under uncommon configurations (ASLR disabled and certain rewrite rules), enable remote code execution; attackers began scanning and exploiting systems within days of disclosure, and Censys data suggests millions of potentially affected internet-facing NGINX instances, so immediate patching and configuration audits are recommended.