Loading story…
Researchers reported an active campaign compromising NGINX servers to hijack and redirect legitimate user traffic through attacker-controlled backend infrastructure. The activity targets NGINX installations—particularly those managed via the Baota (BT) hosting panel—with an apparent focus on sites using Asian country-code TLDs and certain government/education domains (including .in, .id, .pe, .bd, .th, plus .edu and .gov).
The attackers modify existing NGINX configuration files by injecting malicious location blocks that match selected URL paths, rewrite requests to preserve the full original URL, and then forward traffic using proxy_pass to attacker-controlled domains. To reduce suspicion, the forwarded requests retain key headers (e.g., Host, X-Real-IP, User-Agent, Referer) so traffic appears legitimate, and the tooling reloads NGINX to avoid downtime. Datadog Security Labs described a scripted, multi-stage toolkit used to automate the configuration injection (including an initial controller with fallback download methods and a stage that enumerates common NGINX config locations) and published indicators of compromise to help defenders validate whether NGINX configurations have been tampered with.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Datadog Security Labs publicly reported the campaign, describing the multi-stage shell-script toolkit used to find targets, modify and validate NGINX configurations, reload services, and exfiltrate hijacked rule mappings to C2 server 158.94.210.227. The report also highlighted targeting of several Asian TLDs, plus .gov and .edu domains, and provided detection guidance.
An active campaign compromised NGINX servers, especially Baota (BT) Panel-managed deployments and common Linux/container layouts, by injecting malicious location blocks and proxy_pass directives into configuration files. The changes proxied selected legitimate requests through attacker-controlled backend servers while preserving headers to reduce detection.
In the months following disclosure, threat actors exploited React2Shell and used different post-exploitation payloads, including cryptomining retrieval and reverse shells. GreyNoise reported that two IP addresses accounted for most observed exploitation attempts.
The React2Shell vulnerability, tracked as CVE-2025-55182, was disclosed in late 2025. Later reporting tied the NGINX traffic-hijacking activity to threat actors associated with exploiting this flaw.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcesecuritylabs.datadoghq.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-27654**, a heap buffer overflow in NGINX's `ngx_http_dav_copy_move_handler()` that affects deployments compiled with `ngx_http_dav_module` and configured with `alias` alongside WebDAV `COPY` or `MOVE` methods. The bug stems from an unsigned underflow in `ngx_http_map_uri_to_path()` when a `Destination` header is shorter than the location prefix, allowing WebDAV root escape and arbitrary file read or write within the worker process's filesystem permissions. Calif.io said it developed multiple proof-of-concept exploits with AI assistance, including variants that could copy sensitive files such as `/etc/passwd` into attacker-accessible locations and write files through `PUT` and `COPY`, while noting that human researchers were needed to turn the initial AI-generated crash into a practical exploit chain. F5 and the NGINX security team were notified in March and released a fix in **NGINX 1.29.7** with advisory `K000160382`, while Calif later published PoC materials on GitHub describing the work as AI-generated and human-verified. Separately, Nebula Security reported a distinct NGINX zero-day dubbed **nginx-poolslip**, describing remote code execution in dynamic variable parsing paths affecting **NGINX 1.31.0** and claiming its autonomous AI agent discovered the flaw; the report said technical details were initially withheld during disclosure and that **NGINX 1.31.1** was later released as the patch. Together, the disclosures underscore a rapid cycle in which AI-assisted research is producing crash reproduction, exploit development, and fresh vulnerability claims against widely deployed NGINX code.
Jun 29, 2026
A critical authentication bypass in **nginx-ui** tracked as `CVE-2026-33032` is being actively exploited to seize control of internet-exposed Nginx servers. The flaw affects nginx-ui deployments with MCP support enabled because the `POST /mcp_message` endpoint enforced only IP whitelisting, while the default empty whitelist behaved as allow-all, leaving the endpoint reachable without authentication. Researchers said attackers can exploit the bug in seconds with minimal HTTP requests, then invoke MCP management functions to modify or delete Nginx configuration files, reload or restart services, redirect or intercept traffic, disrupt applications, and steal administrator credentials and other secrets. Pluto Security reported the issue in March, and multiple security outlets said threat actors began exploiting it in the wild after technical details emerged. The vulnerability carries a **CVSS 9.8** rating and impacts nginx-ui **2.3.5 and earlier**, with fixes released starting in version **2.3.4** and later secure releases also available. Public reporting estimated roughly **2,600 to 2,700** exposed nginx-ui instances online, and Recorded Future and VulnCheck both flagged the bug as under active exploitation. Administrators have been urged to upgrade immediately, disable or restrict MCP access if patching is delayed, populate the IP whitelist with trusted hosts, and review logs for suspicious configuration changes or unauthorized reload activity.
Jun 29, 2026
F5 disclosed multiple NGINX vulnerabilities across modules, with the most serious issues centered on the `ngx_http_rewrite_module`, including **CVE-2026-42945** and **CVE-2026-9256**. The flaw dubbed **NGINX Rift** is a long-standing heap buffer overflow in the rewrite engine that can be triggered remotely through crafted HTTP requests, leading to worker crashes, repeated restarts, and denial of service; under some conditions, including disabled ASLR, remote code execution is possible. CSIRT.SK reported active exploitation of **CVE-2026-42945** and said the bug affects both NGINX Open Source and F5/NGINX-related products, while F5 also published advisories for additional bugs in `ngx_http_proxy_v2_module`, `ngx_http_charset_module`, and `ngx_http_js_module`. Independent analysis of the two rewrite-engine RCE bugs found that exploitation depends on specific rewrite patterns involving `rewrite`, `if`, `set`, positional captures, and question-mark handling in PCRE-based rules. Researchers behind the **ngxray** scanner reviewed 35,633 public NGINX configurations from GitHub and found only one confirmed real-world vulnerable configuration after triage, suggesting the bugs are severe but uncommon in exposed public configs. Defenders were urged to upgrade to fixed releases, including **NGINX Open Source 1.30.1 or 1.31.0** and **NGINX Plus R32 P6 or R36 P4**, and to review or mitigate risky rewrite directives where patches were not yet available.
Jul 30, 2026