XMPP Service Operators - 2026-05-14

unauthenticated RCE in nginx, upgrade immediately https://depthfirst.com/nginx-rift

> unauthenticated RCE in nginx, upgrade immediately https://depthfirst.com/nginx-rift was this also found by anthropics new toy? ↺

Debian doesn't appear to have pushed a DSA for this yet...

https://app.opencve.io/cve/CVE-2026-42945 checking the CVE info, anything below 1.31.0 is vulnerable, Arch Linux updated the package, but Debian is still sitting at 1.26.3

icebound.dev: https://archlinux.org/packages/extra/x86_64/nginx/ shows nginx at 1.30.1-1

hmm actually that package seems to have been updated yesterday

Sunglocto (sunglocto.net), oh I must have misread the version... okay then Arch is vulnerable too :p

all the right numbers are in the string, just not in the right order >:)

good thing OpenBSD httpd isn't affected, like usual :p

nope arch is all good (I upgraded before I posted) that's the fixed version

moparisthebest, yeah sorry I missed the constaint < 1.30.1

1.31.0 is also good

iirc 1.31.0 is nginx-mainline and 1.30.1 is nginx

hence the confusion, apologies

> good thing OpenBSD httpd isn't affected, like usual :p hell ye ↺