pwn.watch: nginx incident updates https://pwn.watch/t/nginx Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): Security advisories and patched releases published on nginx.org. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:Security advisories and patched releases published on nginx.org. Wed, 21 Oct 2026 00:00:00 GMT medium Status: closed, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.31.8 mainline released. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:nginx 1.31.8 mainline released. Wed, 21 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-14:nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. Wed, 14 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched [critical] IngressNightmare: unauthenticated RCE in Kubernetes ingress-nginx admission controller (CVE-2025-1974): Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare https://pwn.watch/i/ingressnightmare-ingress-nginx-cve-2025-1974 ingressnightmare-ingress-nginx-cve-2025-1974:2025-03-24:Kubernetes publishes advisory and fixed controller releases; Wiz publishes IngressNightmare Mon, 24 Mar 2025 00:00:00 GMT critical Source: https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/ Status: closed, patched [high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487): Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 http2-rapid-reset-ddos-cve-2023-44487:2023-10-10:Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV Tue, 10 Oct 2023 00:00:00 GMT high Source: https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack Status: closed, patched [high] HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487): Cloudflare starts seeing unusually large HTTP/2 attacks https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487 http2-rapid-reset-ddos-cve-2023-44487:2023-08-25:Cloudflare starts seeing unusually large HTTP/2 attacks Fri, 25 Aug 2023 00:00:00 GMT high Source: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ Status: closed, patched