Topic
NGINX
Developer Exposes 12 Vulnerabilities in FastAPI Todo App After 176 Bots Bypass Protections
Vulnerabilities & Exploits
telEgo Combines MTProxy and WEB Proxy on Single Port 443 with TLS Fronting
Privacy & Surveillance
From Root CA to User Authorization in nginx and Apache: Client Certificate Login Explained
OtherNginx Leaves Dynamic Tables Unused in HTTP/2 and HTTP/3 Responses
Nginx implements one-way header compression for both HTTP/2 and HTTP/3: clients compress repeated headers using HPACK or QPACK dynamic tables, but the server never writes to its own dynamic table when sending responses. Code analysis of release-1.31.3 shows every call to ngx_http_v3_encode_field_ri and ngx_http_v3_encode_field_lri passes dynamic=0, and the server encoder stream (NGX_HTTP_V3_STREAM_SERVER_ENCODER) is never created. The same pattern exists in the HPACK filter module, which explicitly sends a table-size update of zero and never calls ngx_http_v2_hpack_t structures. The receiving side fully supports dynamic tables up to the default 4096-byte limit and correctly processes insertions from clients such as aioquic. This asymmetry is permitted by RFC 9204 §4.2 yet removes the compression benefit the binary protocols were designed to provide. The unused encoder path contributed to a use-after-free vulnerability (CVSS 9.2) discovered earlier this year in the QPACK decoder.
TSPU Filtering Disrupts Timeweb Cloud Servers: Diagnosis, CDN Failures, and Reverse Proxy Bypass
Russian hosting provider Timeweb Cloud experienced widespread TSPU-based DPI filtering starting in early June that selectively blocked TLS handshakes on port 443 while leaving SSH, ICMP, and TCP connectivity intact. The issue affected multiple providers including Beget and Selectel, was publicly acknowledged by Timeweb on June 5, and proved highly variable by region, operator, and time of day. Attempts to mitigate via new IP addresses or Timeweb's own CDN failed due to poisoned caches and platform outages, while Yandex Cloud CDN blocked all POST requests required for WordPress functionality. A working solution involved deploying a minimal nginx reverse proxy on another Russian cloud VPS that preserves full HTTP methods, handles certificate synchronization, and routes ACME challenges correctly. Timeweb support later closed tickets without resolution after requesting ineffective mtr traces that cannot detect DPI behavior. The case highlights systemic challenges in diagnosing state-mandated filtering and the limitations of standard network diagnostics against selective TLS interference.
Secure Error Logging Practices to Prevent Information Leaks Across Java, Kotlin, JavaScript and Python
The article examines how improper error logging can expose sensitive details such as stack traces, file paths, library versions and database structures, enabling attackers to map applications and craft targeted exploits. It covers core logging levels from DEBUG to FATAL, mechanisms including text files, binary logs and databases, plus the roles of Trace ID and Correlation ID in tracing requests across microservices. Real-world vulnerable code examples in Flask and SQLite demonstrate direct exception output, manual traceback exposure and SQL error leakage that confirm technologies like Python 3.10 or SQLite usage. CWE categories including CWE-209, CWE-532, CWE-538 and CWE-1295 are referenced to classify risks of information disclosure through logs. Mitigation steps include stripping version headers in Nginx, sanitizing inputs with regular expressions, using OpenTelemetry for structured JSON logging and avoiding debug modes in production. The guidance stresses balancing detailed logs for incident response with protections against injection and reconnaissance.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
OpenSSL Patches HollowByte Vulnerability That Enables Denial-of-Service Attacks on TLS Connections with Just 11 Bytes
OpenSSL has released fixes for a vulnerability dubbed HollowByte that allows denial-of-service attacks against servers using unpatched versions of the library. The flaw can be triggered by a malicious TLS request as small as 11 bytes and was addressed without a CVE or formal security advisory because it was classified as a hardening improvement. Researchers from Okta warn that the operational impact can be significant on internet-facing servers, as the issue occurs during the initial TLS handshake when vulnerable OpenSSL versions reserve memory based on the client-declared size before verifying actual data delivery. Attackers can open connections, claim they will send a large message, and then deliver only a tiny portion, leaving the server waiting indefinitely with reserved memory. In tests with NGINX, low-memory servers could be completely taken down while more powerful machines suffered substantial capacity loss without triggering abnormal traffic volumes. The patches are included in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, and administrators are advised to update packages, restart affected services, and monitor for unusual memory growth.