Six Hours, Eighteen Years: What NGINX Rift Tells the Mittelstand

Fri, 15 May 2026 07:00:00 +0200

On May 13, 2026, F5 and security researcher depthfirst publish a disclosure with weight behind it. CVE-2026-42945, codenamed NGINX Rift, CVSS 9.2. Unauthenticated remote code execution in the ngx_http_rewrite_module of NGINX. Affected: all open-source versions from 0.6.27 through 1.30.0 and NGINX Plus R32 through R36. The bug has been in the code since 2008. Eighteen years.

The actual punchline sits in the disclosure footnote. The bug was not found by a human researcher. It was found by an autonomous AI analysis system. Six hours of runtime against one of the most thoroughly reviewed open-source codebases on the planet. This is the direct confirmation of the thesis I sketched on May 13 in the article on the Mythos Glasswing asymmetry as something coming. It arrived a week later.

Vulnerability on Pfisterer Consulting

Six Hours, Eighteen Years: What NGINX Rift Tells the Mittelstand