Loading story…
Microsoft published security advisories for two NGINX vulnerabilities tracked as CVE-2026-28755 and CVE-2026-27784. The flaws affect the ngx_stream_ssl_module and ngx_http_mp4_module components, respectively, and were listed in the Microsoft Security Update Guide as NGINX-related issues.
The advisories provide limited public detail, with no synopsis included in the referenced entries, but they identify separate weaknesses in two widely used NGINX modules tied to SSL/TLS stream handling and MP4 content processing. Organizations using NGINX in Microsoft-supported environments should review the corresponding CVE entries and assess exposure in deployments where either module is enabled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-28755 to its Security Update Guide, identifying a vulnerability affecting the NGINX ngx_stream_ssl_module. The reference indicates public disclosure of the issue through Microsoft's advisory portal.
Microsoft added CVE-2026-27784 to its Security Update Guide, identifying a vulnerability affecting the NGINX ngx_http_mp4_module. The reference indicates public disclosure of the issue through Microsoft's advisory portal.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 disclosed and patched multiple NGINX vulnerabilities, including the high-severity `CVE-2026-32647` in `ngx_http_mp4_module`, which affects both **NGINX Open Source** and **NGINX Plus**. The flaw is an out-of-bounds read memory corruption issue triggered when NGINX processes a specially crafted MP4 file, allowing a local authenticated attacker to crash worker processes in the data plane and potentially achieve arbitrary code execution. F5 said the control plane is not affected and credited Xint Code and Pavel Kohout of Aisle Research with the discovery and coordinated disclosure. The vulnerable condition impacts deployments using the `mp4` directive with `ngx_http_mp4_module` enabled; the module is included by default in NGINX Plus, while NGINX Open Source requires it to be explicitly compiled and enabled. F5 also published advisories for `CVE-2026-27654` in `ngx_http_dav_module` and `CVE-2026-28755` in `ngx_stream_ssl_module`, indicating a broader set of NGINX fixes released together. The company issued patched versions for affected NGINX Plus and Open Source releases and advised organizations that cannot patch immediately to disable the MP4 module and limit media publishing to trusted users.
Jun 29, 2026
F5 published security advisories for two **NGINX mail-related vulnerabilities** affecting the `ngx_mail_auth_http_module` and `ngx_mail_smtp_module`. The issues were assigned **`CVE-2026-27651`** and **`CVE-2026-28753`**, respectively, and were disclosed through F5's product advisory channel for NGINX. The advisories identify separate flaws in components used to support mail authentication over HTTP and SMTP handling within NGINX's mail functionality. While the published entries did not include public synopses, the disclosures indicate that organizations using NGINX mail modules should review the vendor advisories, determine whether the affected modules are enabled in their environments, and apply any recommended updates or mitigations from F5.
Jun 29, 2026
Microsoft published a new set of security advisories covering multiple third-party and open-source components, led by several **Chromium** vulnerabilities affecting `WebGL`, `WebRTC`, `ANGLE`, `V8`, `PDFium`, the **Digital Credentials API**, and **Extensions**. The issues include out-of-bounds read and write, heap buffer overflow, integer overflow, and use-after-free conditions tracked as `CVE-2026-4440`, `CVE-2026-4463`, `CVE-2026-4464`, `CVE-2026-4447`, `CVE-2026-4446`, `CVE-2026-4456`, `CVE-2026-4452`, `CVE-2026-4455`, `CVE-2026-4450`, and `CVE-2026-4458`. Microsoft also listed `CVE-2026-4437`, a flaw in `gethostbyaddr` and `gethostbyaddr_r` that may incorrectly handle DNS responses. The advisory set also includes **pyOpenSSL** flaws `CVE-2026-27459`, a DTLS cookie callback buffer overflow, and `CVE-2026-27448`, which could allow TLS connection bypass through an unhandled exception in `set_tlsext_servername_callback`. Additional entries cover several **Linux kernel** issues, including a potential NULL pointer dereference in `RDMA/siw` (`CVE-2026-23242`), a refcount bug and potential use-after-free in `perf_mmap` (`CVE-2026-23248`), an infinite loop in `ntfs3` metadata handling (`CVE-2025-71265`), an `io_uring` memory-management flaw (`CVE-2026-23259`), and a divide error in `rivafb` (`CVE-2026-23266`), alongside audit subsystem updates tracked as `CVE-2025-71239` and `CVE-2026-23241`.
Jun 29, 2026