AI agent finds 18-year-old remote code execution flaw in Nginx
Summary
Researchers using an AI model discovered a critical 18-year-old flaw in Nginx (a web server that powers about one-third of all websites) called a heap buffer overflow (a type of memory corruption bug where data overwrites adjacent memory). The vulnerability, tracked as CVE-2026-42945 with a 9.2 severity score, can crash servers or potentially allow attackers to run malicious code, especially on systems with ASLR (Address Space Layout Randomization, a security feature that randomizes memory locations) disabled.
Solution / Mitigation
Upgrade to patched versions: Nginx 1.31.0 or 1.30.1 for the open-source version, or Nginx Plus versions R36 P4, R32 P6, or 37.0.0 for the commercial product. The source notes that users should 'upgrade to a patched version as soon as possible' since exploit code has been published publicly and past Nginx vulnerabilities have been actively exploited by attackers.
Classification
Affected Vendors
Original source: https://www.csoonline.com/article/4171437/ai-agent-finds-18-year-old-remote-code-execution-flaw-in-nginx.html
First tracked: May 14, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 75%