New NGINX 0-Day RCE “nginx-poolslip” Threatens Millions of Servers

A newly disclosed zero-day dubbed **nginx-poolslip** affects NGINX 1.31.0, enabling unauthenticated remote code execution and bypassing ASLR; it potentially exposes millions of servers, has no patch or CVE yet, and NebSec is coordinating responsible disclosure while urging administrators to apply mitigations (WAF rules, ASLR checks, interface restrictions) until an official fix is released.