Critical flaw in software powering a third of the internet is already being exploited – free checker now available

A critical security vulnerability in NGINX, the web server software underpinning more than 30% of all websites globally, has been confirmed as actively exploited in the wild, less than a week after its public disclosure. The flaw, tracked as CVE-2026-42945 and dubbed ‘NGINX Rift’, carries a severity score of 9.8 out of 10. It affects virtually every standard NGINX build released between 2008 and May 2026, an exposure window spanning 18 years.