NGINX Rift: Critical 18-Year-Old Flaw CVE-2026-42945 Actively Exploited to Crash Servers

NGINX disclosed a critical vulnerability (CVE-2026-42945, 9.2) present since 2008 and patched in 1.30.1/1.31.0; threat actors are actively probing and some exploitation has been observed in honeypots. Successful RCE requires specific configuration conditions including ASLR disabled, but a DoS that crashes worker processes is easily executed; approximately 5.7 million unpatched instances remain exposed, so administrators are urged to apply updates immediately.