The Latest

A critical NGINX vulnerability (CVE-2026-42945) disclosed last week is being exploited by attackers, VulnCheck security researcher Patrick Garrity revealed on Saturday.

NGINX vulnerability exploited CVE-2026-42945

The vulnerability, dubbed NGINX Rift, can be reliably exploited to trigger a denial-of-service condition and can potentially allow for unauthenticated remote code execution, all achievable by sending a specially crafted HTTP request to a vulnerable NGINX instance.

What is NGINX?

NGINX is the most widely deployed web server and, as such, it’s one of the fundamental pieces of modern web infrastructure. It can also play other roles: load balancer, reverse proxy, and HTTP cache.

Its development is overseen by the networking and application delivery company F5, which maintains and releases the open-source version (NGINX Open Source), offers the commercial NGINX Plus version, and has integrated NGINX into its various application delivery and security solutions.

About CVE-2026-42945

CVE-2026-42945 is a memory corruption vulnerability that affects NGINX Open Source (versions 0.6.27 through 1.30.0) and NGINX Plus (vR32 through R36). It also affects some of F5’s products that incorporate the software, such as NGINX Ingress Controller, F5 WAF for NGINX, and others.

“A bug in the ngx_http_rewrite_module lets a remote, unauthenticated attacker corrupt the heap of an NGINX worker process by sending crafted URI. The trigger is a common configuration pattern: a rewrite directive with an unnamed regex capture ($1, $2) and a replacement string that contains a question mark, followed by another rewrite, if, or set directive,” the researchers who unearthed the vulnerability explained.

“When that pattern is present, NGINX computes the destination buffer using one set of escaping assumptions and then writes to it using another. The write runs past the allocated buffer, producing deterministic memory corruption. The bytes written past the allocation are derived from the attacker’s URI, so the corruption is shaped by the attacker rather than random. Repeated requests can also be used to keep workers in a crash loop and degrade availability for every site served by the instance.”

PoC and exploitation

CVE-2026-42945, along with four other security issues, was discovered by Depthfirst researchers with the help of the company’s AI-native vulnerability detection platform. Of the five, CVE-2026-42945 was the most critical.

Once F5 released fixes and the security advisory, Depthfirst researchers published technical details and a proof-of-concept (PoC) exploit.

According to Garrity, VulnCheck’s canary systems began flagging exploitiation attempts on May 16, three days after the vulnerability and the PoC had been made public.

The effectiveness of these attempts depends on the targeted system.

While DoS can be achieved on default NGINX configurations, both VulnCheck and security researcher Kevin Beaumont pointed out that attackers can achieve code execution if they manage to disable address space layout randomization (ASLR) on the target server.

“A further caveat is that the target server has to be running a specific rewrite configuration to be vulnerable, so not every NGINX instance is exploitable. Our Censys query surfaces roughly 5.7M internet-exposed NGINX servers running a potentially vulnerable version, though the truly exploitable population is likely to be a much smaller subset of those,” the VulnCheck Initial Access team noted.

Fixes

So far, F5 fixed the vulnerability in:

  • NGINX Open Source – versions 1.31.0 and 1.30.1
  • NGINX Plus – versions R36 P4 and R32 P6
  • F5 WAF for NGINX v5.13.0
  • F5 DoS for NGINX v4.9.0

It has also provided a mitigation: using named captures instead of unnamed captures in rewrite definitions.

AlmaLinux, Ubuntu and Debian developers have begun releasing patched nginx packages.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!


from Help Net Security https://ift.tt/V1wXrCP

You need to use a lot of quotation when discussing AI. There's "intelligence," of course, but also "thinking," which these days usually refers to a specific type of model that breaks requests into multiple steps and takes longer to process (or "think through") them. Thinking models are nothing new, but if you use Gemini, you do have new thinking "levels" to choose from when using non-thinking models. Here's how it works.

As spotted by 9to5Google, there's a new "Thinking level" option at the bottom of the model selector in Google's Gemini app for iOS and Android. To be clear, this isn't the "Thinking" model listed under "Gemini 3," as this model has been available for some time. Instead, "Thinking level" appears when using either Fast (which uses Gemini 3 Flash), or Gemini 3.1 Pro, when you aren't using Thinking. When "Thinking level" does show up on your end, you'll see two options: "Standard" and "Extended." Google says that Standard is best for most problems, while Extended offers more time for "complex topics."

It seems that Google is giving users more processing options when using non-thinking models in Gemini. If you're using the Fast option, for example, you might not get the answer (or the quality of answer) you're looking for, since the model is designed to produce a response as quickly as possible. Therefore, you may want to dive into the Thinking level menu to switch to Extended: It may take a bit longer than usual, but you may boost your chance of getting the response you're expecting—all without having to use the actual Thinking model, which may take too long altogether.

Per 9to5Google's coverage, this doesn't appear to be exclusive to Google AI Plus subscribers. In the outlet's screenshots showing the feature, there's still an option to upgrade to the subscription plan, so free users should see "Thinking level" rolling out on their end. (As of this article, I don't see it yet.)

These changes come on the eve of Google I/O, where Google will undoubtedly announce many new Gemini features and AI updates in general. Last week, the company hosted The Android Show: I/O Edition, which ran through a number of Android announcements ahead of I/O. This was the second year in a row Google decided to break out Android news into its own segment, likely because it wants to dedicate so much of I/O to AI.


from Lifehacker https://ift.tt/UBA1og4

It’s nasty, but it requires physical access to the computer:

The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments.

Slashdot thread. And here’s Nightmare-Eclipse’s GitHub account.


from Schneier on Security https://ift.tt/Iip0QHn

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Prime Day might be just around the corner, but if your shopping list has things like mattresses, outdoor furniture, or home appliances, you might be better off shopping during the Memorial Day sale. Lucky for you, the early sales are in full swing, even though Memorial Day isn't until May 25. These retailers have some of the best early deals so far.

Amazon's Memorial Day Sale has discounts going up to 40% off

Unsurprisingly, Amazon is one of the first retailers to start its Memorial Day sale early. They have many categories on sale, including: home and kitchen, garden and outdoors, home improvement, electronics, and more. Here are some deals that stood out to me:

Wayfair is having deals of up to 70% off

Wayfair, the furniture store that recently opened its doors for customers to physically go to their in-person stores (I went to the Atlanta one, and it was great to try their products in person), is joining the early Memorial Day sale with discounts of up to 70% off on their website. You can shop for living room seating, area rugs, bathroom vanities, mattresses, kitchen and dining furniture, bedroom furniture, outdoor furniture, home appliances, and more. You can receive an extra 10% off if you sign up for their alerts (you should get a pop-up window when you open their website). Here are some deals worth highlighting:

Woot is having a big outdoor lighting sale

Woot is very underrated, in my opinion, as a shopping editor. Many of their deals beat even the lowest prices that Amazon has ever listed them for, and you get free shipping if you have Amazon Prime. Right now, they have a big sale on outdoor lighting, making it a great opportunity to bring that aesthetic look to your front yard, porch, deck, or backyard. Check out their deals and take advantage of them.

Best deals on mattresses, bed frames, and pillows

I am an Airbnb host, so I've had to buy multiple mattresses, bed frames, pillows, etc. I did a lot of research to get quality products, and I tested all of them to make sure my guests will get good sleep. I must've done a great job because all of my guests rave about their quality sleep. Some of these products have big discounts right now for Memorial Day, so take advantage of these tested products that my guests and I have loved so much:

  • Kana Japanese Joinery Bed (Oak), $809.97 (originally $979.98). This has been the easiest bed frame I've ever set up. I didn't need any tools and it took less than five minutes. It also fit perfectly with the Japanese theme I had for that room. The material is of quality, and it looks incredible.

  • Sapira Chill Hybrid Mattress, $1,679 (originally $2,399). I paired the Kana bed frame with this Leesa mattress. It's extremely comfortable and keeps you cool with its cooling top.

  • Helix Midnight Elite, $3,278 (originally $4,370.66). For my own bed, I wanted to splurge and went with this Helix mattress. When I feel recharged every morning, I don't care how much I spent on my mattress. But luckily for you, it's 25% off right now.

  • Dream Max, $1,815 (originally $2,595). Another one of my Airbnb beds has this mattress, and it has my guests' and my own stamp of approval.

  • Eli & Elm Side Sleeper Pillow, $107.99 (originally $134.99). As a side sleeper, I know how crucial it is to have a side-sleeping pillow. This one from Eli & Elm is very comfortable, and I love that I can adjust the firmness of it easily by removing materials from inside the pillow.


from Lifehacker https://ift.tt/z5k2v1x

We may earn a commission from links on this page.

XReal and ASUS Republic of Gamers announced this morning that pre-orders are open for the ROG XREAL R1, a pair of augmented reality smart glasses designed for high-frame-rate gaming paired with a ROG control dock. First shown at CES 2026, the R1s are a wearable monitor that projects a virtual 171-inch monitor with a 0.01ms response time and 240Hz refresh rate—the fastest available in AR glasses. XReal R1s are bundled with the ROG Control Dock, and are selling for $849 at Best Buy, with a release on the XReal store to follow on May 17.

The R1 is built on the architecture of XReal One glasses (see my full XReal One review here) and is powered by the same X1 chip for three degrees of freedom (3DoF) tracking. That means you can pin your gaming display anywhere in augmented reality and it won't move when you turn your head.

The ROG Control Dock lets you connect these smart glasses to consoles (Xbox, PS5) and PCs with the dock's HDMI 2.0 and DisplayPort 1.4 inputs, but they are being positioned as the ultimate companion for the ROG Ally handheld gaming PC. With these glasses, the Ally doesn't need a separate monitor to deliver a high-end PC gaming experience. The R1 and ROG Ally together are aimed at delivering a high-end PC gaming experience that's also fully portable and viewable in high definition through a pair of sunglasses.


from Lifehacker https://ift.tt/rqDXRgV

I'm always a little surprised any time I hit a dead zone. It's 2026; we've had cell phones since the '80s; modern 5G connections can rival home internet speeds; and yet, there are still way too many parts of this country that aren't covered by cellular networks. While those cellular networks might not necessarily expand to cover the entire country any time soon, it is possible that, in the near future, you'll be hard-pressed to find a part of the U.S. where you can't make a phone call.

These carriers are working to end dead zones in America

On Thursday, Verizon published a press release featuring a pretty significant announcement: The big three cellular networks (AT&T, T-Mobile, and Verizon) are pooling their resources to try to end dead zones in America. The idea is to expand satellite communications across all three networks to directly address coverage gaps across the country, especially in "unserved and underserved communities." That's particularly important for remote areas of the States where there is little to no traditional cell service.

While the press release shies away from saying the joint venture will end dead zones entirely, it does stress that the plan is to "nearly eliminate" them in the U.S. But the goal goes beyond coverage gaps, too. By increasing satellite communications and, therefore, increasing redundancy in coverage, the networks believe they'll improve reliability in emergencies: When everyone is trying to call and text across cell networks at once, they slow down or stop working entirely. By rolling out a more robust satellite network, there will be another means of communication during these high-demand situations. According to the press release, the networks will also work with rural mobile network operators to expand services to their customer bases.

Satellite communications are all the rage right now. Cellular networks, as well as smartphone manufacturers, have been rolling out expanded support in recent years. Apple, for example, now lets iPhone users text their contacts over satellite when they have no cell service, while T-Mobile offers similar services for its customers via Starlink. Of course, satellite service isn't necessarily the same as cellular service: Because the signal needs to travel all the way up to a satellite orbiting the Earth, it takes a lot longer than your standard cell signal. As such, I'm not sure that somebody tapping into satellite coverage in a rural area of the U.S. is going to have as reliable an experience as another user connecting through 4G or 5G networks.

Still, satellite communications have literally saved lives in situations where cell service was not available. If the networks want to band together to create a dedicated network of satellite communications, I'm certainly not opposed.


from Lifehacker https://ift.tt/S7WkMz6

When you share your location data with an app or service, you may assume you're sharing your exact coordinates. But that's not necessarily the case. While "precise location" sharing does indeed broadcast your literal whereabouts, "approximate location" sharing only submits your general position. It's the difference between an app knowing your home address versus seeing the neighborhood you're in, or perhaps even the town or city itself. It's a great way to balance privacy and utility: Apps that don't need all that extra location information to function simply won't get it.

Back in January, Apple introduced a new privacy setting for iPhone: Limit Precise Location. While that might sound like the existing option detailed above, this new setting lets you hide this location information from your cell carriers, too. That way, you can totally control how you share your location data from your iPhone: Apps that need precise coordinates, like your navigation app, can have it, while apps that may only need your approximate location can have that instead—including, now, your carrier.

Unfortunately, at the time of launch, support for Limit Precise Location was extremely limited. Apple only opened this option to iPhones that have its proprietary C1 or C1X chip, including the iPhone Air, iPhone 16e, and the cellular model of the M5 iPad Pro. What's more, only Boost Mobile users had access in the U.S., meaning a very small fraction of iPhone users in the States have been able to take advantage of this new privacy measure.

Apple expanded Limit Precise Location support with iOS 26.5

That changed with iOS 26.5, which Apple released this week. While the feature still only works for Boost Mobile customers in the U.S., Apple added the iPhone 17e to the list of supported devices. If you don't live in the U.S., however, the expansion is a little more generous. Apple is including another handful of carriers here, expanding the list to the following:

  • Austria: A1

  • Denmark: YouSee

  • Germany: Telekom

  • Ireland: Sky

  • Thailand: AIS and True

  • United Kingdom: EE, BT, and Sky

  • United States: Boost Mobile

Limit Precise Location is enabled by default for all supported iPhones with these carriers. If you live in the EU or UK, however, and you have one of these iPhones, you likely have the feature—even if your carrier isn't listed here. Apple says that with a SIM from an EU or UK carrier, you have the option to turn this feature on. Rumor has it that Apple is planning on rolling out its next-gen cellular modem, the C2, to the iPhone 18 Pro and iPhone Ultra. By the end of this year, the list of iPhones that support this feature should be a bit larger.

How to manage Limit Precise Location

If you have the right combination of iPhone and cellular carrier, this feature is enabled by default. However, you'll find the option in Settings > Cellular > Cellular Data Options > Limit Precise Location.


from Lifehacker https://ift.tt/06A1M7N