A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication.

The flaw, tracked as CVE-2026-33032, is caused by nginx-ui leaving the ‘/mcp_message’ endpoint unprotected, allowing remote attackers to invoke privileged MCP actions without credentials.

Because those actions involve writing and reloading nginx configuration files, a single unauthenticated request can modify server behavior and effectively take over the web server.

“[…] any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads – achieving complete nginx service takeover,” reads NIST’s descripion of the flaw in the National Vulnerability Database (NVD).

NGNIX released a fix for the flaw in version 2.3.4 on March 15, a day after researchers at the AI workflow security company Pluto Security AI reported it. However, the vulnerability identifier, along with technical details and a proof-of-concept (PoC) exploit, emerged at the end of the month.

In the CVE Landscape report earlier this week, threat intelligence company Recorded Future notes that CVE-2026-33032 is under active exploitation.

Nginx UI is a web-based management interface for the Nginx web server. The library is very popular, with more than 11,000 stars on GitHub and 430,000 Docker pulls.

Based on Pluto Security’s internet scans using the Shodan engine, there are currently 2,600 publicly exposed instances potentially vulnerable to attacks. Most are in China, the United States, Indonesia, Germany, and Hong Kong.

In a report today, Pluto Security’s Yotam Perkal says that exploitation only requires network access and is achieved by establishing an SSE connection, opening an MCP session, and then using the returned ‘sessionID’ to send requests to the ‘/mcp_message’ endpoint.

From there, attackers can invoke MCP tools without authentication and take the following actions:

• Connect to the target nginx-ui instance
• Send requests without any authentication headers
• Gain access to all 12 MCP tools (7 destructive)
• Read nginx configuration files and exfiltrate them
• Inject a new nginx server block with malicious configuration
• Trigger automatic nginx reload

Pluto Security’s demo shows that an attacker can use the unauthenticated MCP message endpoint to execute privileged nginx management actions, perform config injection, and ultimately take control of the nginx server, all without authentication.

Given the active exploitation status and the availability of public PoCs, system administrators are recommended to apply the available security updates as soon as possible. The latest secure version of nginx-ui is 2.3.6, released last week.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now

The LCD era on Apple’s iPad Air may finally be over next year. According to a new report by the South Korean outlet ET News, Apple is gearing up to give the iPad Air the most-awaited upgrade: an OLED display.

Per the publication, Samsung Display is preparing to manufacture OLED panels for the next-generation iPad Air. Mass production is expected to begin around the end of this year or the beginning of next year (in January 2027). 

Why is this a big deal?

If everything goes well, Apple may release the updated iPad Air in the first half of 2027, likely between March and May. This is a bigger deal than it sounds. The iPad Air is a mid-range tablet that features one of the most capable chipsets in the segment, along with a clean iOS experience.

However, it’s held back by the LCD display, which is limited to 60Hz, while tablets in the market (around the same price) offer OLED displays that support higher refresh rates. The top-tier iPad Pro has also enjoyed an OLED panel for two years. 

Bringing OLED to the Air will deliver richer contrast, deeper blacks, and more accurate colors, effectively closing a significant visual gap between Apple’s mid-range and premium tablet tiers. Once the update lands, Apple’s entire iPad lineup will feature OLED panels, except the baseline iPad. 

What’s the catch, though? 

The OLED panel that’s headed to the 2027 iPad Air could use a single-stack LTPS structure, which is cheaper than the pricier tandem OLED panel found on the iPad Pro. If true, this could result in noticeable compromises. 

For instance, the OLED iPad Air might miss out on ProMotion 120Hz support; the display will most certainly be locked at 60Hz (maintaining the company’s upsell hierarchy). While this won’t be an issue for everyday users, who use the iPad for streaming, browsing, or taking notes, gamers might want to stick with the iPad Pro. 

Anyways, iPad’s OLED jump will still feel transformative, especially for buyers who’ve used the entry-level or the mid-range iPads for years. 

Having demonstrated that it has the operational capability to transport humans safely to the moon and back, the United States is moving on to its next major aim: It wants nuclear reactors in orbit and on the lunar surface by 2030. For such a feat, the National Aeronautics and Space Administration will have to work in conjunction with the Department of Defense and the Department of Energy.

In a post on X, the White House Office of Science and Technology Policy (OSTP) unveiled a document with new guidelines for federal agencies to establish the space nuclear technology road map for the coming years. This, they say, will ensure “US space superiority.”

At present, space instruments use solar power to operate. However, this is considered impractical for more complex purposes. Although technically there is always sunlight, the power is intermittent and almost always requires bulky batteries to store it.

Reactors produce fairly continuous energy for years through nuclear fission. They can also be used for so-called nuclear electric propulsion. Continuous output makes them the most viable option for lunar base subsistence, but they can also allow spacecraft to undertake long or complex missions without worrying about depleting a limited supply of chemical fuel.

Nuclear technology, in short, makes it possible to go farther, with more payload, for longer, and with fewer constraints.

According to the memorandum, the US goal is to put a medium-power reactor in orbit by 2028, with a variant designed for nuclear electric propulsion, and a first functional large reactor on the surface of the moon by 2030. To achieve this, both NASA and the Pentagon will develop energy technologies in parallel, using the current strategy of competition among contractors.

The reactors will have to be modular and scalable, and will have to include applications for both future life on the moon and space propulsion. For its part, the DOE will have to ensure that these projects have the fuel, infrastructure, and safety features necessary to achieve their objectives. In addition, the agency will evaluate whether the industry has the capacity to produce up to four reactors in five years.

The plan contemplates technologies that produce at least 20 kilowatts of electricity (kWe) for three years in orbit and at least five years on the lunar surface. In the meantime, they should have a design capable of raising power to 100 kWe. The first designs should arrive within a year.

Finally, the order tasks the OSTP with creating a road map for the initiative, noting obstacles and recommendations for addressing them.

“Nuclear power in space will give us the sustained electricity, heating, and propulsion essential to a permanent presence on the moon, Mars, and beyond,” OSTP posted. For his part, NASA administrator Jared Isaacman posted, “The time has come for America to get underway on nuclear power in space.” The message was followed by an emoji of a US flag.

The plan provides a common framework for each agency to work within. In the background, the race for space infrastructure is evidence of technological competition with China, which is also seeking advanced energy capabilities for the moon.

This story originally appeared in WIRED en Español and has been translated from Spanish.

Apple’s MacBook Neo is a $600 (or $500 for students) shot across the bow at affordable Windows laptops, and it seems like Microsoft has ready its first response. The newly announced “Microsoft College Offer” is a bundle of Microsoft 365 Premium, Xbox Game Pass Ultimate, custom Xbox controller and discounted laptop that the company thinks could woo students away from Apple’s new deal.

With the purchase of a discounted machine directly from Microsoft, retailers like Amazon and Best Buy or PC makers like HP, ASUS and Acer, you can get what the company says is an extra $500 of value from its bundle. The laptop deals include a Lenovo IdeaPad Slim 3x with a Snapdragon X chip, 16GB of RAM and 256GB of storage for $500 from Best Buy, around $250 off the laptop’s usual $750 price. Or if you wanted something even cheaper, Walmart is selling an HP Omnibook 3 for $429, a discount of $270 off its usual $699 price. Microsoft is less generous with the deals on its own laptops and tablets, but you can even get a discount on a Surface Laptop as part of the offer.

A discounted laptop is great, but where the value of the Microsoft College Offer gets harder to define is with the services the company is packing in. Getting what would normally be a $200 year-long subscription to Microsoft 365 Premium for free is a meaningful deal, but many colleges give their students access to Microsoft’s apps (and other software) with the cost of their tuition. A year of Xbox Game Pass Ultimate, which costs $30 per month as of October 2025, sounds like significant savings, but the offer is only valid for new subscribers. That leaves the free custom Xbox controller as the simplest bonus of the bunch, a value of around $76.

Windows PC makers are expected to make more serious attempts to compete with the Neo over the next year. For now, though, the Microsoft College Offer isn’t exactly a bad deal, but it’s certainly not as straightforwardly appealing as an Apple-quality laptop for $500 with a college discount.

The Microsoft College Offer is available to students starting April 15 and runs through June 30, 2026. Microsoft says redemption of the full bundle of services and accessories it’s offering needs to happen by July 31, 2026.

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Nothing launched a genuinely useful app called Warp earlier today, with a simple idea: allowing Android users to share files, links, and copied texts directly to their Mac, Windows, or Linux machines without including any cables or convoluted workarounds. 

Nothing announced the app for Chrome and Edge (Chromium-based web browsers) and Android smartphones, floating it on both the Chrome Web Store and the Google Play Store (via 9To5Google). However, a few hours later, the app is nowhere to be found, with the official listings returning errors. 

So, how did Warp actually work?

Nothing’s Warp app used Google Drive as a data transfer bridge, keeping files within users’ accounts rather than routing them via Nothing’s servers. From their phones, users picked any file or link (via the Android share sheet) and sent it through Warp.

On the receiving end, a desktop, the browser extension added a right-click “Send with Nothing Warp” option, along with an upload button. Once a file was received, users still had to manually download it. 

In other words, Nothing’s Warp wasn’t using peer-to-peer transfer (like Quick Share or AirDrop), but a cloud relay with some branding on top. 

Did the Nothing Warp app disappear already?

That’s the part nobody has explained (yet). Within hours of launch, the official community post announcing the app returned a “This page doesn’t exist” error. The app isn’t listed on the Play Store or the Chrome Web Store anymore.

One Reddit user claims that the app bears a striking resemblance to an open-source tool, which could be one of the reasons for the potential takedown. However, this remains unconfirmed speculation at the moment, as the company hasn’t issued an official statement about the removal. 

Another user downloaded the app’s setup, but couldn’t run it due to a Play Store warning, which is usually issued for safety purposes. Even so, the app is reportedly working fine for users who installed it earlier today on their smartphones and laptops. 

Warp’s rapid rise and fall remind me of how the Nothing Chat app, an iMessage-bridging solution, was pulled days after launch due to security concerns. If the removal was precautionary, Nothing might go ahead with a refined version of the app. 

The online leak of a full version of Avatar: Aang, The Last Airbender—a highly anticipated animated film in a multimedia fantasy franchise—has divided passionate fans while upsetting those who spent years working on the film.

The leaks began on X late on Saturday night, about six months before Aang was scheduled to premiere on Paramount+. User @ImStillDissin posted two short clips from the film. “Nickelodeon accidentally emailed me the entire Avatar aang movie,” he claimed. He also threatened to stream the entire movie if Paramount didn’t release an official trailer, and he posted a still from the movie’s end credits, revealing previously undisclosed voice-over cast and roles. The media from @ImStillDissin’s posts were later hit with copyright strikes and removed.

But within 48 hours, links to download the full movie appeared on 4chan and X, where some users also directly streamed the film. Across the web, fans said they had successfully pirated and watched what appeared to be a nearly finished and “beautiful” animated film.

While some argued that Paramount deserved to be punished because of certain creative and marketing decisions around the movie, others noted what a blow the leak was to the animators and production crew. A number of those team members took to social media to convey their sadness and frustration.

“We worked on the aang movie for years with the expectation that’d [sic] we’d get to celebrate all of our hard work in theaters. Just to see people unceremoniously leak the film and pass our shots around on twitter like candy,” animator Julia Schoel wrote Tuesday on X.

The user behind @ImStillDissin, who would not reveal his real name due to fear of legal repercussions, tells WIRED that he obtained the movie almost by chance and did not expect his posts to set off such a crisis in the entertainment world. “When I posted those clips I was purely trolling,” he says. “I was expecting a day of clout farming at best, not for the whole thing to blow up like this.”

(While WIRED has done its due diligence in verifying that the person speaking to us was behind the @ImStillDissin X account, we acknowledge that the hacking community is known to troll.)

According to @ImStillDissin, a screen-grabbed version of Avatar: Aang, The Last Airbender was circulating among people he knew from his days in the hacking community, one of whom shared it with him. “Broadly speaking, the supply chain for movies and TV is rife with insecure companies and vendors and lax checks,” he claims. He notes that two different SpongeBob SquarePants movies leaked months before their release dates in 2024. “Someone on 4chan who wasn’t happy at me drip-feeding stuff posted a copy of a draft script [of the new Avatar film] from like two years back,” says @ImStillDissin.

Neither Nickelodeon nor its parent company Paramount have confirmed a hack had taken place, nor have they issued a statement on the matter. They also did not respond to requests for comment.

Originally announced in 2021, Avatar: Aang, The Last Airbender marked the first production for Avatar Studios, a division of Nickelodeon’s animation department.

Some people felt justified in pirating and sharing the movie due to the recasting of voice actors. Last year, during a Reddit AMA, casting director Jenny Jue wrote that the voice cast from the Avatar TV show that aired on Nickelodeon in the 2000s was not returning due to efforts to “match actors’ ethnic/racial background to the characters they’re portraying.”