NGINX Rift: The 18-Year-Old Web Server Vulnerability That Hands Attackers Code Execution on Most UK SME Websites — The 14-Day Network Admin Audit
On 14 May 2026 F5 and depthfirst disclosed CVE-2026-42945 — codenamed NGINX Rift — an unauthenticated remote-code-execution flaw in the NGINX rewrite module that has sat undetected since 2008. CVSS v4 9.2, three more new CVEs released alongside it, and reachable with a single crafted HTTP request. NGINX powers the front of nearly every modern UK SME website. Here is the full Network Admin decode: where NGINX hides in a typical UK SME stack, the realistic cost of getting this wrong, the 14-day Cyber Essentials v3.3 patching window, and the 10-step controlled-remediation programme.
