F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution

Multiple high-impact vulnerabilities and active exploitation campaigns reported: F5 released fixes for two critical NGINX Open Source flaws (including CVE-2026-42530, a use-after-free in ngx_http_v3_module enabling remote code execution). Microsoft confirmed a Microsoft Defender zero-day (RoguePlanet) tracked as CVE-2026-50656 (privilege escalation, patch in development). CISA added the Joomla JCE flaw CVE-2026-48907 (CVSS 10.0) to its KEV list due to active exploitation. Threat actors are actively exploiting multiple Fortinet FortiSandbox bugs (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089);