June 19, 2026
Patch first, panic second
Tell HN: A new Nginx 0-day just dropped
Server admins are sweating, but the comments say it’s not full apocalypse yet
TLDR: Nebula says a newly revealed Nginx bug could let attackers remotely seize vulnerable servers, but only certain newer setups appear affected. In the comments, some users treated it like an active fire drill, while others insisted the risk is narrower because the feature involved is not turned on by default.
A fresh security scare just hit the internet’s favorite workhorse: Nginx, the web server software that helps power a huge chunk of the web. Security firm Nebula says it found a bug so nasty it could let attackers take over affected servers from afar, and warned that some Fortune 500 companies could be exposed. The catch, as quickly pointed out in the Hacker News discussion, is that this isn’t a everyone-panic-right-now situation for every Nginx user. According to the post, you’re mainly in danger if you’re running the newest versions and have a newer speed feature called HTTP/3 turned on.
That nuance is exactly where the comment drama kicked in. One commenter went straight to full disaster mode, saying they’d assume the bug is already being actively exploited, which is the kind of sentence that makes sleep schedules vanish instantly. Another pushed back with the cold-water reply that “QUIC isn’t enabled by default,” basically translating to: yes, this is bad, but no, the sky is not falling for everybody. That split became the whole vibe of the thread: one side sounding the alarm, the other trying to stop admins from sprinting in circles.
And then there’s the quiet subplot: Nebula casually mentioning this is the second Nginx remote-takeover bug it found in a month, plus a plug for its own tool. So the comments read like a mix of emergency dispatch, fact-check squad, and side-eye at startup launch timing.
Key Points
- •Nebula Security says it discovered and disclosed a new NGINX remote code execution 0-day.
- •The post says affected systems are running NGINX Open Source v1.31.0 or v1.31.1 with HTTP/3 / QUIC enabled.
- •The recommended fix is to upgrade to NGINX v1.31.2 or later.
- •If immediate upgrading is not possible, the post advises disabling QUIC / HTTP/3 as a temporary mitigation.
- •Nebula Security says this is the second NGINX RCE 0-day it found in a month using its VEGA security agent.