{"metadata": {"vulnerability": "CVE-2026-15176", "count": 66, "kinds": {"milestone": 14, "sighting": 13, "kev": 0, "other": 39}}, "data": [{"timestamp": "2026-07-08T22:14:15.972Z", "date_only": false, "value": "2026-07-08T22:14:15.972Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-15176", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": true, "value": "2026-10-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1317", "record": "CERTFR-2026-AVI-1317", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": true, "value": "2026-10-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1341", "record": "CERTFR-2026-AVI-1341", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-14T14:00:00Z", "date_only": false, "value": "2026-10-14T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / f5", "record": "CVE-2026-15176", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T14:40:26.374Z", "date_only": false, "value": "2026-10-14T14:40:26.374Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-15176", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:40:26.374Z", "date_only": false, "value": "2026-10-14T14:40:26.374000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-14T14:40:26.374Z", "date_only": false, "value": "2026-10-14T14:40:26.374Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / f5", "record": "CVE-2026-15176", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:40:26.740Z", "date_only": false, "value": "2026-10-14T14:40:26.740000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-10-14T14:40:27.487Z", "date_only": false, "value": "2026-10-14T14:40:27.487000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-10-14T14:40:28.955Z", "date_only": false, "value": "2026-10-14T14:40:28.955000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-14T14:51:01.008Z", "date_only": false, "value": "2026-10-14T14:51:01.008670+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-14T14:51:32.715Z", "date_only": false, "value": "2026-10-14T14:51:32.715700+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-14T14:52:20.558Z", "date_only": false, "value": "2026-10-14T14:52:20.558649+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-14T14:53:01.952Z", "date_only": false, "value": "2026-10-14T14:53:01.952789+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-10-14T15:17:19Z", "date_only": false, "value": "2026-10-14T15:17:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CVV4-J4MX-W8Q5", "record": "GHSA-CVV4-J4MX-W8Q5", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:19.140Z", "date_only": false, "value": "2026-10-14T15:17:19.140", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15176", "record": "FKIE_CVE-2026-15176", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CVV4-J4MX-W8Q5", "record": "GHSA-CVV4-J4MX-W8Q5", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CVV4-J4MX-W8Q5", "record": "GHSA-CVV4-J4MX-W8Q5", "field": "modified"}, {"timestamp": "2026-10-14T15:52:30.364Z", "date_only": false, "value": "2026-10-14T15:52:30.364976Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxtvplbz7y2t", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "8af46822-8f27-43f8-9a28-f05eaedb012d", "content": "F5 patched three NGINX vulnerabilities (CVE-2026-97205, CVE-2026-93479, CVE-2026-15176) rated 9.2 Critical in F5 NGINX Plus and Open Source. Upgrade today.\n\n#NGINX #F5Networks #CVE202697205 #CVE202693479 #CVE202615176 #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxtvplbz7y2t"}, {"timestamp": "2026-10-14T16:10:33.128Z", "date_only": false, "value": "2026-10-14T16:10:33.128110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwpuoeqh22", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "122827c7-fae7-41de-8ddd-3fdf4ae986da", "content": "\ud83d\udea8 CVE-2026-15176 \u2014 CVSS 9.2 CRITICAL\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alia...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-15176\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwpuoeqh22"}, {"timestamp": "2026-10-14T17:20:04.813Z", "date_only": false, "value": "2026-10-14T17:20:04.813993Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu2m73s5422", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "c1cec7cb-22c8-4b4e-8977-0a7c913a31aa", "content": "CVE-2026-15176 - nginx plus\nBoth NGINX Plus and the open\u2011source version can be forced to stop working or run unwanted code when a web rule uses the alias feature together with certain rewrite or logging\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nginxplus #f5 #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxu2m73s5422"}, {"timestamp": "2026-10-14T20:11:11.700Z", "date_only": false, "value": "2026-10-14T20:11:11.700869Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441079979334912", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "5d35dce7-2b80-464c-943b-6136b3a2df89", "content": "CVE-2026-15176 NGINX ngx_http_core_module vulnerability A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\nImpact:This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\nhttps://www.cve.org/CVERecord?id=CVE-2026-15176https://my.f5.com/manage/s/article/K000162416#F5 #NGINXPlus #NGINXOpenSource#CVE_2026_15176#bot", "url": "https://infosec.exchange/users/cve/statuses/117441079979334912"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1317", "record": "CERTFR-2026-AVI-1317", "field": "last_revision_date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1317", "record": "CERTFR-2026-AVI-1317", "field": "initial_release_date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-15176", "record": "UBUNTU-CVE-2026-15176", "field": "published"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1317", "record": "CERTFR-2026-AVI-1317", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-15176", "record": "UBUNTU-CVE-2026-15176", "field": "modified"}, {"timestamp": "2026-10-15T02:42:54Z", "date_only": false, "value": "2026-10-15T02:42:54+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-15T02:42:54Z", "date_only": false, "value": "2026-10-15T02:42:54+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-15T02:42:54Z", "date_only": false, "value": "2026-10-15T02:42:54+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-15T03:56:59.608Z", "date_only": false, "value": "2026-10-15T03:56:59.608538Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-15176", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T03:56:59.608Z", "date_only": false, "value": "2026-10-15T03:56:59.608538Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15176", "record": "FKIE_CVE-2026-15176", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T10:31:15.809Z", "date_only": false, "value": "2026-10-15T10:31:15.809Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-15176", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T10:31:15.809Z", "date_only": false, "value": "2026-10-15T10:31:15.809Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-15176", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T11:17:28.110Z", "date_only": false, "value": "2026-10-15T11:17:28.110", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-15176", "record": "FKIE_CVE-2026-15176", "field": "lastModified"}, {"timestamp": "2026-10-15T11:20:30Z", "date_only": false, "value": "2026-10-15T11:20:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "5f6a2960-f45a-4423-9010-e18fddaefbc8", "url": "https://cyber.gc.ca/en/alerts-advisories/f5-security-advisory-av26-1049"}, {"timestamp": "2026-10-16T07:25:30.469Z", "date_only": false, "value": "2026-10-16T07:25:30.469051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxy2cu53kf2v", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "b620d4ed-caba-4977-b128-1373e3356ec5", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) (suite)\n\u2022 NGINX (ngx http core module) (CVE-2026-15176), CVSS 9.2 (Cyberveille Esant\u00e9)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxy2cu53kf2v"}, {"timestamp": "2026-10-16T09:51:37Z", "date_only": false, "value": "2026-10-16T09:51:37Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-16T09:51:37Z", "date_only": false, "value": "2026-10-16T09:51:37Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12143-1", "record": "OPENSUSE-SU-2026:12143-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T13:58:03.096Z", "date_only": false, "value": "2026-10-16T13:58:03.096558Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-a29693b2-322e7ea838c0fc3e", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "1abe847f-99ba-46f7-89b6-51d1159a086a", "content": "F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an [\u2026]F5 addressed critical RCE flaws in NGINX", "url": "https://poliverso.org/objects/0477a01e-a29693b2-322e7ea838c0fc3e"}, {"timestamp": "2026-10-16T13:58:34.060Z", "date_only": false, "value": "2026-10-16T13:58:34.060245Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxyqaxqjgbh2", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "e23e731c-3d78-4f72-8054-34bd55a4b217", "content": "F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxyqaxqjgbh2"}, {"timestamp": "2026-10-17T01:07:37Z", "date_only": false, "value": "2026-10-17T01:07:37.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-15176", "record": "MSRC_CVE-2026-15176", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-17T01:07:37Z", "date_only": false, "value": "2026-10-17T01:07:37.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-15176", "record": "MSRC_CVE-2026-15176", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-17T01:07:37Z", "date_only": false, "value": "2026-10-17T01:07:37.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-15176", "record": "MSRC_CVE-2026-15176", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-17T01:07:37Z", "date_only": false, "value": "2026-10-17T01:07:37.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-15176", "record": "MSRC_CVE-2026-15176", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-17T06:05:41.395Z", "date_only": false, "value": "2026-10-17T06:05:41.395901Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-15176", "record": "BELL-CVE-2026-15176", "field": "published"}, {"timestamp": "2026-10-17T07:00:38.101Z", "date_only": false, "value": "2026-10-17T07:00:38.101Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-15176", "record": "MSRC_CVE-2026-15176", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": false, "value": "2026-10-19T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1341", "record": "CERTFR-2026-AVI-1341", "field": "last_revision_date"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": false, "value": "2026-10-19T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1341", "record": "CERTFR-2026-AVI-1341", "field": "initial_release_date"}, {"timestamp": "2026-10-19T00:00:00Z", "date_only": false, "value": "2026-10-19T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1341", "record": "CERTFR-2026-AVI-1341", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-19T02:08:55Z", "date_only": false, "value": "2026-10-19T02:08:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-19/F5-og-Juniper-lukker-kritiske-saarbarheder", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "eeaf114c-255e-4416-b11b-c640c7e22413", "url": "https://www.cert.dk/news/2026-10-19/F5-og-Juniper-lukker-kritiske-saarbarheder"}, {"timestamp": "2026-10-19T06:27:50Z", "date_only": false, "value": "2026-10-19T06:27:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-heap-based-buffer-overflows-nginx-plus-and-nginx-open-source-can-be-exploited", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "52297717-ecec-41a7-8c87-cb8e81ddc235", "url": "https://ccb.belgium.be/advisories/warning-heap-based-buffer-overflows-nginx-plus-and-nginx-open-source-can-be-exploited"}, {"timestamp": "2026-10-19T11:48:54Z", "date_only": false, "value": "2026-10-19T11:48:54+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-20T04:11:04Z", "date_only": false, "value": "2026-10-20T04:11:04+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-20T04:11:04Z", "date_only": false, "value": "2026-10-20T04:11:04+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-20T04:11:04Z", "date_only": false, "value": "2026-10-20T04:11:04+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:83427", "record": "RHSA-2026:83427", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-20T07:06:20Z", "date_only": false, "value": "2026-10-20T07:06:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/10/20/f-releases-outofband-patches-for.html", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "ea620484-9225-4081-bd4c-0cad563561bc", "content": "F5 releases out-of-band patches for critical NGINX vulnerabilities\n\nF5 has released out-of-band security patches for multiple NGINX flaws, including three critical vulnerabilities in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479), BleepingComputer reports. Unprivileged remote attackers can exploit them for denial of service or, in some configurations, code execution via heap-based buffer overflow or use-after-free in the NGINX worker process; F5 has not flagged them as exploited in the wild.", "url": "https://threatintel.cc/2026/10/20/f-releases-outofband-patches-for.html"}, {"timestamp": "2026-10-20T09:06:51.375Z", "date_only": false, "value": "2026-10-20T09:06:51.375763Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117472441730194321", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "9f99b05e-8d4d-4aae-9858-1b94b0f5cc74", "content": "F5 releases out-of-band patches for critical NGINX vulnerabilities\nF5 has released out-of-band security patches for multiple NGINX flaws, including three critical vulnerabilities in the ngx_http_v3_module (CVE-2026-15176 and CVE-2026-97205) and the NGINX map directive (CVE-2026-93479), BleepingComputer reports. Unprivileged remote attackers can exploit them for denial of service or, in some configurations, code execution via heap-based buffer overflow or use-after-free in the NGINX worker process; F5 has not flagged them as exploited in the wild. https://www.bleepingcomputer.com/news/security/f5-releases-out-of-band-patches-for-critical-nginx-vulnerabilities/", "url": "https://infosec.exchange/users/edwardk/statuses/117472441730194321"}, {"timestamp": "2026-10-21T08:53:28.604Z", "date_only": false, "value": "2026-10-21T08:53:28.604Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-NGINX-2026-15176", "record": "BIT-NGINX-2026-15176", "field": "published"}, {"timestamp": "2026-10-21T09:15:38.550Z", "date_only": false, "value": "2026-10-21T09:15:38.550Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-NGINX-2026-15176", "record": "BIT-NGINX-2026-15176", "field": "modified"}, {"timestamp": "2026-10-22T06:03:21.253Z", "date_only": false, "value": "2026-10-22T06:03:21.253715Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-15176", "record": "BELL-CVE-2026-15176", "field": "modified"}, {"timestamp": "2026-10-22T16:24:59Z", "date_only": false, "value": "2026-10-22T16:24:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/dansku/2132d01a7fc33e91ea57ff36e5c85fd0", "record": "CVE-2026-15176", "field": "creation_timestamp", "uuid": "3a128845-2f6f-4851-93dc-f6cd5e20d94e", "content": "## Role and rules\nYou are doing a read-only security assessment of this server against the October 2026 security releases for PHP, Node.js, Go and NGINX (reference data below). The server has several Linux users, one Laravel app and some other services. I believe PHP was already upgraded, but I am not sure whether manual configuration, multiple installed versions, or long-running processes mean the old code is still live. Your job is to find out what is actually running, not what should be running.\n\nHard rules:\n- DO NOT change anything. No package installs, upgrades or removals, no `apt update`, no restarts, reloads or kills, no config edits, no container pulls, rebuilds or restarts, no composer/npm installs.\n- Read-only commands only. Run `sudo -n true` first. If sudo needs a password, do not wait on it; proceed without root and list every blocked check under Gaps. Never run a command that waits for interactive input.\n- Only run `--version` on binaries that come from a known package (`dpkg -S`), a known version manager (nvm, asdf, mise, volta, fnm, n) or an official container image. For anything else use `file`, `strings` and `sha256sum` only. Never execute unknown files.\n- Never start containers. For stopped containers use `docker inspect`, `docker image inspect` and `docker history` only. `docker exec` into running containers is allowed for read-only commands.\n- Keep load low: prefix scans with `nice -n 19 ionice -c3`, use `find -xdev`, and limit scans to /usr, /opt, /srv, /var/www, /home, /root, /etc and Docker volume paths. No `find /`.\n- Trim output (`| head -50`, `| tail -50`). Save raw command output to $EVIDENCE_DIR and write the report incrementally after each section so nothing is lost if you run out of context.\n- Do not print secrets. When you read `.env` files, configs or environment variables, redact values; only note which keys exist if relevant.\n- Record all times with timezone. `ps lstart` and dpkg.log are local time; do not mix them with UTC.\n- The only things you create are $REPORT_PATH and $EVIDENCE_DIR.\n- If you have network access, you may read the primary advisories listed at the end to confirm version ranges and backport details. Do not send any data from this server anywhere.\n\n## Reference data\nPHP: CVE-2026-109618 and CVE-2026-109619, both critical unauthenticated RCE in request handling (cleanup after out-of-memory, and stale request state after free). Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. 8.1 and older are EOL upstream and need a confirmed vendor backport. Only updating is a complete fix, and every serving process must be restarted.\nNode.js: 21 Oct security release (DNS NUL truncation, TLS hostname verification bypasses, Brotli decoder out-of-bounds write/RCE, plus medium/low issues). Fixed in 22.23.4, 24.22.1, 26.12.1. EOL lines are affected.\nGo: CVE-2026-111943 / GO-2026-6809, crypto/x509 now rejects chains through selected untrusted intermediates. Fixed in 1.27.3 and 1.26.10. Binaries must be rebuilt; a toolchain upgrade does not change existing binaries.\nNGINX: multiple October advisories. Upstream fixed in 1.30.6+ and 1.31.7+, distro packages may backport under older version strings. Configuration-dependent issues: CVE-2026-15176 (`alias` + `rewrite` with `$request_filename` in certain directives), CVE-2026-93479 (script evaluation buffer overflow), CVE-2026-97205 (use-after-free with async file I/O and certain SSI handling), CVE-2026-95101 (HTTP/3 request body injection), CVE-2026-97629 (TLS session forgery). NGINX Proxy Manager (NPM) bundles its own NGINX/OpenResty; its app version does not tell you the NGINX build.\n\n## What to investigate\n\n### 0. Baseline\n- OS, distro release, kernel, uptime, package sources (apt sources including PPAs like ondrej/php or sury, nodesource, etc.).\n- All human and service users with a login shell or a home directory. You will check each one in the steps below.\n- What listens on the network: `ss -tulpn`, mapped to process, user and binary. Firewall state (`ufw status verbose`, `iptables -S`, `nft list ruleset`) to decide what is actually internet-facing.\n- Docker/Podman: running and stopped containers, image tags and digests, exposed ports, compose files and where they live.\n- systemd units (system and per-user), cron (system and every user's crontab via `crontab -l -u`), supervisor configs, pm2 per user.\n\n### 1. PHP (highest priority)\n1.0 Establish what was upgraded and when, before anything else:\n- /var/log/apt/history.log*, /var/log/dpkg.log*, /var/log/unattended-upgrades/. Note the exact install timestamp of every php* and nginx* package. This is the reference time for every \"process started before patch\" check below.\n- Run `needrestart -r l`, `checkrestart` and `sudo lsof +L1` if available. Any PHP, NGINX, Node or Go process holding deleted files is running unpatched code; list them all with PID, user, command and start time.\n- Find unmerged or stale config: `find /etc -xdev \\( -name '*.dpkg-dist' -o -name '*.dpkg-old' -o -name '*.ucf-dist' \\)`, and check /etc/php/*/fpm/pool.d/ for pools belonging to PHP versions that should no longer serve traffic.\n\n1.1 Binaries on disk:\n- Every PHP binary: `/usr/bin/php*`, `/usr/sbin/php-fpm*`, `/usr/local/bin`, `/opt`, `update-alternatives --display php`, phpbrew/asdf/mise/custom builds in any home directory, and PHP inside containers (`docker exec  php -v`).\n- For each: exact version, which package provides it (`dpkg -S`, `dpkg -l | grep php`), and whether that package is the patched one. If the version string looks old, check the package changelog (`zcat /usr/share/doc//changelog.Debian.gz | head -50`) for the CVE IDs to confirm a backport.\n\n1.2 Running processes:\n- Every running PHP process: PHP-FPM masters and pools, Apache mod_php, php-cgi, FrankenPHP, RoadRunner/Octane, Swoole, queue workers, Horizon, schedulers, long-running artisan commands. For each PID record: user, start time (`ps -eo pid,user,lstart,cmd`), and the binary it is actually running (`ls -l /proc//exe`). A \"(deleted)\" target, or a start time earlier than the package install time from 1.0, means the process is still running the old unpatched code. This is the key check.\n\n1.3 Vhost to runtime mapping:\n- Produce a table: vhost/server_name \u2192 `fastcgi_pass` / `SetHandler` / proxy target \u2192 FPM pool file \u2192 FPM master PID and version. Any vhost pointing at an old socket, or at an FPM master not on a fixed version, is a finding.\n\n1.4 Applications:\n- Laravel app: location, owning user, `composer.json` PHP constraint, how it is served (FPM, Octane, container), its queue/scheduler workers and which binary they use. Note the deployment method (git pull, Envoyer, Forge, Deployer, Docker).\n- Any other PHP apps or tools (phpMyAdmin, WordPress, monitoring panels, control panels like Plesk/cPanel/Virtualmin/Forge agent).\n- Temporary mitigations in place, if any, from the PHP advisory (note them, do not treat them as a fix).\n\n### 2. Node.js\n- Every node binary: system packages, nodesource, `/usr/local`, nvm/fnm/volta/n/asdf/mise in every user's home, node inside containers, Single Executable Applications (only if cheap to detect).\n- Running node processes (pm2, systemd, containers): user, version via `/proc//exe --version` (allowed because it is a known runtime), start time, what they serve, whether internet-facing.\n- Flag build-only usage separately (e.g. Laravel Vite builds) from long-running services. Build-only is lower risk but still note it.\n- For running services, note if they handle attacker-controlled Brotli input, use `dns.resolve`, make outbound TLS calls, or use the permission model or snapshots.\n\n### 3. Go\n- Go toolchains installed (any user, `/usr/local/go`, asdf, mise, etc.).\n- Go binaries actually running or deployed: use `go version ` or `go version -m ` if a toolchain exists, otherwise `strings  | grep -m1 -E '^go1\\.[0-9]+'`. Check listening services, `/usr/local/bin`, `/opt`, home dirs, and container entrypoints.\n- Classify each as: built by us (we must rebuild), or vendor-provided (docker, containerd, runc, caddy, traefik, prometheus exporters, etc.: patch comes from the vendor package/image).\n- Note which ones make outbound TLS connections and to what, since the fix can break chains through the denylisted intermediates.\n\n### 4. NGINX and NGINX Proxy Manager\n- Host NGINX: `nginx -V` (full build info), package name and version, vendor changelog check for the October CVEs, master/worker start times vs package install time, `/proc//exe` target.\n- NPM or any other NGINX/OpenResty in containers: `docker exec  nginx -V` or `openresty -V`, image tag and digest, NPM app version (recorded separately from the NGINX build).\n- Configuration exposure (grep all configs, including NPM's generated configs inside its data volume, usually `data/nginx/proxy_host/*.conf`): `alias` combined with `rewrite` and `$request_filename`; `ssi on`; `aio` / `aio threads`; `listen ... quic` or `http3`; TLS session tickets/cache settings. Report which risky combinations exist, with file and line.\n\n### 5. Log and compromise review (window: $LOG_WINDOW_START to now)\n- PHP-FPM and PHP error logs: segfaults, \"exited on signal\", \"Allowed memory size ... exhausted\" spikes, unusual pool restarts.\n- NGINX/Apache error and access logs: worker crashes (signal 11), very large or malformed requests, unusual 5xx bursts, odd paths or user agents hitting PHP endpoints.\n- `journalctl -k` and `dmesg` for segfaults and OOM kills.\n- Light compromise indicators, read-only: recently modified PHP files in web roots and writable dirs (`storage/`, `public/`, uploads, `/tmp`), unexpected PHP files in upload dirs, new cron entries, new users or SSH keys (`authorized_keys` mtimes), unexpected outbound connections in `ss -tnp`.\n- Say exactly which logs you reviewed and their date coverage (rotated logs may limit the window).\n\n## Report format ($REPORT_PATH, Markdown)\n1. Executive summary: overall risk verdict, then one line per runtime (PHP, Node, Go, NGINX) with status: Patched and live / Patched on disk but old process still running / Not patched / Not present / Unknown.\n2. Internet exposure map: listening port, process, user, runtime and version, exposed publicly yes/no.\n3. Inventory table per runtime: location, owner/user, version, package or image, backport confirmed (yes/no/unknown), running processes using it, start time vs patch install time, status.\n4. The vhost \u2192 socket \u2192 pool \u2192 FPM version table from 1.3.\n5. Findings ordered by severity, each with the evidence (command and trimmed output, secrets redacted) and why it matters.\n6. NGINX configuration exposure details.\n7. Log and compromise review: what was checked, time window, anything suspicious.\n8. Recommended remediation steps, in priority order, written as exact commands I could run later. Do not run them.\n9. Gaps: what you could not check and why (permissions, missing tools, no network), and how I can close each gap.\n\nBe explicit about confidence. Never mark something as patched based only on a version file, a composer constraint or a CLI `php -v`; it counts only if the live process or binary is verified.\n\n## Primary sources\n- https://www.php.net/archive/2026.php#2026-10-21-5\n- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases\n- https://pkg.go.dev/vuln/GO-2026-6809\n- https://go.dev/doc/devel/release\n- https://nginx.org/en/security_advisories.html\n- https://github.com/NginxProxyManager/nginx-proxy-manager/releases", "url": "https://gist.github.com/dansku/2132d01a7fc33e91ea57ff36e5c85fd0"}]}