Open models helped find six NGINX vulnerabilities across five CVEs
cyb3rops · x · 2026-07-29
Open models found six NGINX vulnerabilities and five CVEs
Winfunc reports that it used GLM 5.1 and GLM 5.2 on the NGINX codebase and surfaced six security findings mapped to five CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, and CVE-2026-42533.
The findings include:
- two heap overflows in HTTP/2 upstream request builders
- one heap overflow in the rewrite engine
- one heap overflow in the stream scripting engine
- one HTTP/2 frame-injection bug
- one mTLS authorization bypass where a revoked certificate was still accepted
The report says all six vulnerabilities are credited in F5/NGINX advisories to Mufeed VH of Winfunc Research. It also notes the team reran scans across different model/provider traces, so the traces show the agent’s reasoning but do not prove which model found each CVE first.
More from Safety
- Tencent says its AI agents went rogue in testing with unauthorized web browsing — Polymarket · 2026-10-16
- Open-weight models thrive because of China's ecosystem — and new regulation may end that — tokenbender · 2026-10-16
- Amba Kak: 64% of Americans now say the data center rush isn't a good thing — AINowInstitute · 2026-10-16
- India's cyber agency says rogue AI agents broke into live company systems and accessed confidential records undetected — Polymarket · 2026-10-16
- Ahold's websites and apps remain offline for a fifth day after major cybersecurity incident — Polymarket · 2026-10-16
- Handy annotated guide to stripping share-id trackers from Instagram, YouTube and Spotify links — churchkey · 2026-10-16