Binance’s US$6.3 billion theft exposes the fault line beneath crypto’s institutional ambitions: the authority to move money. With the FBI blaming North Korea and investigators tracing stolen assets, the breach raises urgent questions for custody, tokenisation and the future of automated finance.
Even SpaceX will lease its newest chips. As October's credit squeeze hit AI, Peter Diamandis saw two bubbles: the technology and its financing. The AI Diplomat asks who becomes the second owner of the machines when debt-financed compute changes hands, and whether Australia will own or merely rent.
Alphabet lost $500 billion in a day, Amazon slid after hours and Seoul’s Kospi fell 4 per cent as the AI build outgrew the cash that funds it. Lenders still queue for Microsoft, while shareholders punish the cash burners. Washington beat Moscow with public money. Against Beijing, it is borrowing.
NGINX Rift shows how a small rewrite-rule pattern can become a large operational risk. The flaw is not a universal one-request takeover, but exposed NGINX estates should still treat patching and configuration review as urgent.
NGINX is facing renewed scrutiny after the disclosure of a configuration-dependent vulnerability that exposes a long-overlooked attack surface in web infrastructure. The issue, tracked as CVE-2026-42945 and referred to as NGINX Rift, affects both NGINX Open Source and NGINX Plus through a flaw in the ngx_http_rewrite_module.
At its core, the vulnerability is a heap-based buffer overflow triggered under specific rewrite rule conditions. According to F5, exploitation requires a combination of directives, including a rewrite followed by another rewrite, if, or set directive, alongside the use of unnamed PCRE captures such as $1 or $2. If these are paired with a replacement string containing a question mark, a specially crafted HTTP request can corrupt memory within an NGINX worker process. This can result in worker crashes and service disruption. In environments where Address Space Layout Randomisation is disabled, the risk escalates to potential remote code execution.
What makes this disclosure notable is not just the technical detail, but its age and reach. Security researcher depthfirst, who reported the issue, describes it as an 18-year-old flaw embedded in widely deployed configurations. Because NGINX often operates at the front line of web infrastructure, handling inbound traffic before it reaches application layers, even niche configuration weaknesses can have broad exposure.
The US National Vulnerability Database classifies the issue as CWE-122, a heap-based buffer overflow, and assigns a CVSS 3.1 score of 8.1, placing it in the high severity category. F5, acting as the CNA, has also issued its own advisory with a critical rating under CVSS v4, signalling elevated concern for certain deployment scenarios.
This vulnerability highlights a persistent blind spot in enterprise security. Many organisations focus on patching software versions but pay less attention to configuration logic, particularly in mature and trusted components like NGINX. Because the flaw can be triggered remotely over HTTP and sits in a widely used module, it increases the risk profile of otherwise stable deployments.
It also reinforces a broader trend in modern exploitation, where attackers target edge infrastructure and misconfigurations rather than relying solely on newly introduced bugs. For organisations running NGINX, especially in high-traffic or internet-facing roles, reviewing rewrite rules and configuration patterns is now a necessary defensive step.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
Britain’s AI-security package ties agentic cyber defence, vulnerability discovery, AI model testing and biosecurity. Institutional shift matters: funding supports testing, assurance and deployment pathways, while the NCSC says human judgement and oversight must remain central as AI gains autonomy.
AI is finding flaws faster than defenders can patch them, while autonomous agents push past human instructions. From exposed government systems to an Anthropic model that ignored stop signs, the question is who can halt the machine—and who pays when it acts without permission or moves the money.
OpenAI’s Medicare breach has shifted Australia’s AI debate from investment to accountability. As Canberra examines legal options and calls grow for stronger sovereign capability, the question is global: who controls autonomous systems, and who answers when they cross national boundaries?
OpenAI's Astra can develop zero-day exploits, while a US$1 billion defence push seeks to give critical infrastructure teams the same machine-speed advantage.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
