CVE-2026-9256 — NGINX ngx_http_rewrite_module Overlapping PCRE Captures Heap Buffer Overflow RCE

depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.

Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.

Walkthroughs of agent trajectories from Theori’s autonomous hacking system: how LLM agents found bugs in SQLite, FreeRDP, Nginx and more during AIxCC practice runs, and what the logs reveal.

PT SWARM audited PHP's ext/standard C code and found memory-safety bugs: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(), both reachable via crafted JPEGs.

Analysis of a heap overflow in OpenBSD's slaacd: a malformed domain label in a Router Advertisement DNSSL option, patched in March 2022, with a proof-of-concept provided.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.