Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945


Experts warn of active exploitation of critical NGINX flaw CVE-2026-42945

Pierluigi Paganini
May 18, 2026

A critical NGINX flaw (CVE-2026-42945) is actively exploited, allowing crashes or possible code execution via malicious HTTP requests.

A critical vulnerability in NGINX Plus and NGINX Open, tracked as CVE-2026-42945 (CVSS v4 score of 9.2), is already being actively exploited shortly after disclosure.

“We’re seeing active exploitation of CVE-2026-42945 in F5 NGINX, a heap buffer overflow affecting both NGINX Plus and NGINX Open Source on VulnCheck Canaries just days after the CVE was published.” reported VulnCheck.

NGINX CVE-2026-42945

Last week, security researchers at depthfirst disclosed the critical heap buffer overflow vulnerability CVE-2026-42945 that impacts both NGINX Plus and NGINX Open Source. The flaw carries the name NGINX Rift, and its implications extend well beyond a routine patch cycle.

NGINX powers a substantial share of the public internet, reverse proxies, load balancers, ingress controllers, application delivery platforms, making the attack surface here unusually broad. The vulnerability lives in ngx_http_rewrite_module, a component included in every standard NGINX build, and the trigger is a configuration pattern common enough that a significant portion of real-world deployments may be affected without anyone knowing it.

The root of the problem lies in how NGINX handles rewrite directives that combine unnamed PCRE capture groups, the familiar $1, $2 syntax, with a replacement string containing a question mark, when followed by another rewrite, if, or set directive in the same scope.

The mechanics are subtle, but the outcome is not. When a question mark appears in the replacement, an internal flag on the script engine is set and never cleared. A subsequent length calculation uses a fresh sub-engine that does not account for URI escaping, producing a buffer sized for raw bytes. The actual write, however, runs on the original engine where the escaping flag is still active, and characters like +, %, and & each expand by two bytes during the copy. The result is a write that runs deterministically past the end of the allocated buffer, a heap overflow controlled in shape by the contents of the attacker’s URI.

Cyber security researcher Kevin Beaumont Beaumont noted that while CVE-2026-42945 in NGINX is a real vulnerability, remote code execution is unlikely in real-world environments because modern Linux distributions enable ASLR by default. The public proof-of-concept exploit only works after manually disabling ASLR using the setarch -R command. Experts say the flaw is technically valid, but fears of widespread RCE attacks are overstated.

“It relies on a specific Nginx config to be vulnerable, and for attacker to know or discover the config to exploit it. To reach RCE, also ASLR needs to have been disabled on the box.” the popular cyber security researcher Kevin Beaumont explained.

The PoC they’ve built specifically disabled ASLR, deploys a specifically vulnerable config and the exploit knows about the vulnerable config endpoint.”It relies on a specific NGINX config to be vulnerable, and for an attacker to know or discover the config to exploit it,” Beaumont said. “To reach RCE [remote code execution], also ASLR needs to have been disabled on the box.”

Pierluigi Paganini

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

(SecurityAffairs – hacking, CVE-2026-42945)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


An analysis of the praxis of human intelligence versus artificial intelligence, exploring embodiment, intentionality, ethics, and meaning in the age of AI.

Conceptual illustration contrasting human intelligence and artificial intelligence, showing a human brain and a robotic AI head representing the praxis of human cognition versus machine computation

Human Intelligence vs. Artificial Intelligence

The rapid evolution of artificial intelligence (AI) has intensified one of the central philosophical and technological questions of the twenty-first century: what distinguishes human intelligence from artificial intelligence in practice? While AI systems demonstrate remarkable capabilities in pattern recognition, optimization, and prediction, their operation differs fundamentally from the embodied, experiential, and purposive nature of human cognition.

The concept of praxis provides a useful framework for exploring this distinction. Originating in Aristotelian philosophy and later developed by thinkers such as Karl Marx and Paulo Freire, praxis refers to the integration of theory and action through reflective practice (Freire, 1970). Human intelligence operates not merely as abstract reasoning but as a dynamic process of perception, judgment, intention, and lived action within the world.

Artificial intelligence, by contrast, functions through computational processes grounded in statistical inference, algorithmic architecture, and large-scale data training. Even the most advanced machine learning systems remain fundamentally different from human cognition because they lack subjective experience, embodied awareness, and existential intentionality.

This essay examines the praxis of human intelligence in contrast with artificial intelligence, focusing on five dimensions: embodiment, intentionality, experiential learning, ethical judgment, and meaning-making. Through this analysis, it becomes clear that while AI can replicate certain cognitive functions, it does not participate in the same praxis-driven structure of intelligence that characterizes human beings.

Understanding Praxis: Action Informed by Conscious Reflection

The term praxis originates from Aristotle’s distinction between theoria (contemplation), poiesis (production), and praxis (action informed by moral and practical reasoning) (Aristotle, trans. 2009). Praxis describes a form of activity in which knowledge is enacted through deliberate engagement with the world.

In contemporary philosophy and social theory, praxis refers to the cyclical process of reflection, action, and transformation. Freire (1970) described praxis as “reflection and action upon the world in order to transform it” (p. 51). Human intelligence unfolds through such iterative engagement with reality.

Human cognition therefore operates within a feedback loop:

  1. Perception of the environment
  2. Interpretation and meaning-making
  3. Intentional action
  4. Reflection on outcomes
  5. Adaptation and learning

This cycle is not merely computational but phenomenological, grounded in subjective experience. Humans perceive the world through senses, emotions, cultural frameworks, and personal histories. These factors shape how knowledge becomes action.

Artificial intelligence, however, operates differently. AI systems do not experience the world; they process representations of it. Their learning occurs through optimization algorithms adjusting statistical weights within models trained on datasets. While this process can mimic aspects of learning, it lacks the reflective and experiential dimensions central to praxis.

Embodiment: Intelligence in the Living Body

Human intelligence is fundamentally embodied. Theories of embodied cognition emphasize that cognition arises from the interaction between brain, body, and environment (Varela, Thompson, & Rosch, 1991). Perception, movement, and sensory feedback form the basis of human understanding.

For example, a photographer tracking a bird in flight relies on a complex integration of sensory perception, motor coordination, anticipatory judgment, and situational awareness. The act is not simply analytical; it is a form of embodied praxis.

The photographer reads the wind, anticipates motion, adjusts posture, and responds dynamically to environmental cues. Experience accumulated over years shapes intuitive responses. Such intelligence emerges through physical engagement with reality.

AI systems, in contrast, are typically disembodied computational entities. Even robotic systems equipped with sensors operate through programmed control architectures and machine learning models rather than lived sensory experience. Their perception is mediated by sensors and interpreted through algorithms rather than consciousness.

Research in robotics and embodied AI attempts to bridge this gap by integrating perception and action systems. However, even advanced robotic agents lack the biological, phenomenological, and experiential dimensions of human embodiment (Clark, 1997).

Thus, while machines can simulate perception-action loops, they do not participate in the same embodied praxis that defines human intelligence.

Intentionality: The Directedness of Human Thought

Another defining characteristic of human intelligence is intentionality, the philosophical concept describing the mind’s capacity to be directed toward objects, goals, or meanings (Brentano, 1874/1995).

Humans act with purpose and intention. Decisions are guided by desires, beliefs, goals, and values. Intentionality shapes how humans interpret information and engage with the world.

Consider the difference between a human writer and a language model. A writer composes text with communicative intention—perhaps to persuade, inform, inspire, or critique. The act of writing is embedded in social, cultural, and personal contexts.

AI language models, by contrast, generate text by predicting probable word sequences based on training data. Their outputs may appear purposeful, yet the system itself possesses no intrinsic intentions or goals. It does not “want” to communicate; it calculates statistical likelihoods.

Philosopher John Searle (1980) famously illustrated this distinction through the Chinese Room argument, suggesting that computational systems may manipulate symbols without understanding their meaning.

Thus, AI can simulate intentional behavior but lacks genuine intentionality. Human intelligence, grounded in subjective consciousness, directs cognition toward meaningful goals and actions.

Experiential Learning and Tacit Knowledge

Human intelligence also develops through experiential learning, a process in which individuals acquire knowledge through direct experience and reflection (Kolb, 1984).

This type of learning often produces tacit knowledge—skills and understandings that are difficult to formalize or encode. For example:

  • A musician sensing subtle timing variations in performance
  • A surgeon adjusting technique during a complex operation
  • A wildlife photographer predicting bird flight patterns

Such expertise develops through repeated interaction with real-world situations. Over time, individuals internalize patterns and responses that operate below the level of conscious analysis.

AI systems learn through data-driven training processes. Machine learning models extract patterns from large datasets by adjusting parameters within mathematical architectures. While this can produce impressive predictive performance, it differs fundamentally from experiential learning.

AI does not possess personal experience, nor does it engage in reflective learning. Its knowledge is derived from statistical correlations within data rather than lived encounters with the world.

Furthermore, AI models often struggle when confronted with novel situations outside their training distribution. Humans, by contrast, can adapt creatively to new contexts because their intelligence is grounded in flexible experiential frameworks.

Ethical Judgment and Moral Agency

Human praxis also includes ethical reflection. Individuals evaluate actions in terms of moral principles, social norms, and personal responsibility.

Ethical judgment involves deliberation about right and wrong, fairness, and the consequences of decisions. Philosophers from Aristotle to Kant have emphasized that moral reasoning is a central component of human rationality (Kant, 1785/1993).

Artificial intelligence systems lack moral agency. They cannot experience responsibility, empathy, or moral concern. Instead, AI operates according to programmed objectives or optimization criteria defined by human designers.

For example, an AI algorithm used in hiring may optimize candidate selection based on patterns in historical data. However, if the data reflects social biases, the algorithm may perpetuate discriminatory outcomes.

Addressing such issues requires human ethical oversight, highlighting the limits of AI in moral decision-making. Machines can assist in analyzing ethical dilemmas, but they cannot independently determine moral principles.

Thus, the praxis of human intelligence includes not only action and reflection but also ethical accountability, a dimension absent from artificial systems.

Meaning-Making and the Human Search for Significance

Perhaps the most profound difference between human intelligence and artificial intelligence lies in the capacity for meaning-making.

Humans interpret experiences within frameworks of culture, identity, and existential reflection. Activities such as art, religion, philosophy, and storytelling arise from the human drive to understand the significance of existence.

Meaning-making involves questions such as:

  • Why does this matter?
  • What does this experience signify?
  • How should I live?

Artificial intelligence does not engage in such inquiries. It processes information but does not seek meaning or purpose.

Existential philosophers such as Jean-Paul Sartre and Martin Heidegger argued that human existence is defined by the capacity to reflect upon one’s being and to shape one’s life through choices (Heidegger, 1927/2010; Sartre, 1943/2007).

This existential dimension forms the deepest layer of human praxis. Intelligence becomes not merely a problem-solving tool but a means of navigating the human condition.

AI systems, lacking consciousness and existential awareness, remain fundamentally outside this domain.

Collaboration Rather Than Replacement

Recognizing these distinctions does not diminish the extraordinary capabilities of artificial intelligence. Instead, it clarifies the complementary roles of human and machine intelligence.

AI excels in areas such as:

  • Large-scale data analysis
  • Pattern recognition
  • Optimization and prediction
  • Automation of repetitive tasks

Human intelligence remains superior in domains involving:

  • Creativity and originality
  • Ethical judgment
  • Contextual interpretation
  • Embodied expertise
  • Meaning-making

The most productive future may therefore lie in human–AI collaboration, where computational systems augment human praxis rather than replace it.

For example, in medicine AI can assist doctors by identifying patterns in medical images or patient data. However, diagnosis and treatment decisions ultimately rely on human judgment informed by empathy, ethical reasoning, and experiential knowledge.

Similarly, in fields such as photography, journalism, and art, AI tools can assist with technical processes, but the creative vision and interpretive meaning remain human contributions.

The Limits of Artificial General Intelligence

Debates about artificial general intelligence (AGI) often assume that sufficiently advanced machines could replicate human intelligence entirely. However, the praxis perspective suggests important limitations to this assumption.

Even if AI systems achieve human-level performance across many cognitive tasks, they may still lack the phenomenological and existential dimensions of intelligence.

Without consciousness, subjective experience, and embodied engagement with the world, artificial systems remain fundamentally different from human agents.

Some researchers propose that consciousness could emerge from sufficiently complex computational systems. Yet this remains a speculative hypothesis with no empirical confirmation.

For now, the evidence suggests that AI represents a powerful form of computational intelligence, not a replacement for the full spectrum of human cognitive praxis.

Conclusion

The comparison between human intelligence and artificial intelligence often focuses on performance metrics: speed, accuracy, or problem-solving ability. However, examining intelligence through the lens of praxis reveals deeper distinctions.

Human intelligence operates as an embodied, intentional, experiential, ethical, and meaning-oriented process. It unfolds through continuous interaction with the world, guided by reflection and shaped by lived experience.

Artificial intelligence, by contrast, functions as a computational system optimized for pattern recognition and prediction. While it can simulate certain aspects of cognition, it lacks the subjective awareness and existential orientation that define human praxis.

The future relationship between humans and AI will likely depend on recognizing these differences. Rather than viewing AI as a replacement for human intelligence, it may be more accurate to understand it as a powerful technological extension of human capabilities.

Ultimately, the praxis of human intelligence remains rooted in consciousness, experience, and meaning—qualities that machines, at least for now, do not possess.

References

Aristotle. (2009). The Nicomachean ethics (W. D. Ross, Trans.). Oxford University Press. (Original work published ca. 350 BCE)

Brentano, F. (1995). Psychology from an empirical standpoint (A. C. Rancurello, D. B. Terrell, & L. L. McAlister, Trans.). Routledge. (Original work published 1874)

Clark, A. (1997). Being there: Putting brain, body, and world together again. MIT Press.

Freire, P. (1970). Pedagogy of the oppressed. Continuum.

Heidegger, M. (2010). Being and time (J. Stambaugh, Trans.). SUNY Press. (Original work published 1927)

Kant, I. (1993). Grounding for the metaphysics of morals (J. W. Ellington, Trans.). Hackett. (Original work published 1785)

Kolb, D. A. (1984). Experiential learning: Experience as the source of learning and development. Prentice-Hall.

Sartre, J.-P. (2007). Being and nothingness. Routledge. (Original work published 1943)

Searle, J. R. (1980). Minds, brains, and programs. Behavioral and Brain Sciences, 3(3), 417–457.

Varela, F. J., Thompson, E., & Rosch, E. (1991). The embodied mind: Cognitive science and human experience. MIT Press.



Source link