A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication.

The flaw, tracked as CVE-2026-33032, is caused by nginx-ui leaving the ‘/mcp_message’ endpoint unprotected, allowing remote attackers to invoke privileged MCP actions without credentials.

Because those actions involve writing and reloading nginx configuration files, a single unauthenticated request can modify server behavior and effectively take over the web server.

“[…] any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads – achieving complete nginx service takeover,” reads NIST’s descripion of the flaw in the National Vulnerability Database (NVD).

NGNIX released a fix for the flaw in version 2.3.4 on March 15, a day after researchers at the AI workflow security company Pluto Security AI reported it. However, the vulnerability identifier, along with technical details and a proof-of-concept (PoC) exploit, emerged at the end of the month.

In the CVE Landscape report earlier this week, threat intelligence company Recorded Future notes that CVE-2026-33032 is under active exploitation.

Nginx UI is a web-based management interface for the Nginx web server. The library is very popular, with more than 11,000 stars on GitHub and 430,000 Docker pulls.

Based on Pluto Security’s internet scans using the Shodan engine, there are currently 2,600 publicly exposed instances potentially vulnerable to attacks. Most are in China, the United States, Indonesia, Germany, and Hong Kong.

In a report today, Pluto Security’s Yotam Perkal says that exploitation only requires network access and is achieved by establishing an SSE connection, opening an MCP session, and then using the returned ‘sessionID’ to send requests to the ‘/mcp_message’ endpoint.

From there, attackers can invoke MCP tools without authentication and take the following actions:

• Connect to the target nginx-ui instance
• Send requests without any authentication headers
• Gain access to all 12 MCP tools (7 destructive)
• Read nginx configuration files and exfiltrate them
• Inject a new nginx server block with malicious configuration
• Trigger automatic nginx reload

Pluto Security’s demo shows that an attacker can use the unauthenticated MCP message endpoint to execute privileged nginx management actions, perform config injection, and ultimately take control of the nginx server, all without authentication.

Given the active exploitation status and the availability of public PoCs, system administrators are recommended to apply the available security updates as soon as possible. The latest secure version of nginx-ui is 2.3.6, released last week.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now

The LCD era on Apple’s iPad Air may finally be over next year. According to a new report by the South Korean outlet ET News, Apple is gearing up to give the iPad Air the most-awaited upgrade: an OLED display.

Per the publication, Samsung Display is preparing to manufacture OLED panels for the next-generation iPad Air. Mass production is expected to begin around the end of this year or the beginning of next year (in January 2027). 

Why is this a big deal?

If everything goes well, Apple may release the updated iPad Air in the first half of 2027, likely between March and May. This is a bigger deal than it sounds. The iPad Air is a mid-range tablet that features one of the most capable chipsets in the segment, along with a clean iOS experience.

However, it’s held back by the LCD display, which is limited to 60Hz, while tablets in the market (around the same price) offer OLED displays that support higher refresh rates. The top-tier iPad Pro has also enjoyed an OLED panel for two years. 

Bringing OLED to the Air will deliver richer contrast, deeper blacks, and more accurate colors, effectively closing a significant visual gap between Apple’s mid-range and premium tablet tiers. Once the update lands, Apple’s entire iPad lineup will feature OLED panels, except the baseline iPad. 

What’s the catch, though? 

The OLED panel that’s headed to the 2027 iPad Air could use a single-stack LTPS structure, which is cheaper than the pricier tandem OLED panel found on the iPad Pro. If true, this could result in noticeable compromises. 

For instance, the OLED iPad Air might miss out on ProMotion 120Hz support; the display will most certainly be locked at 60Hz (maintaining the company’s upsell hierarchy). While this won’t be an issue for everyday users, who use the iPad for streaming, browsing, or taking notes, gamers might want to stick with the iPad Pro. 

Anyways, iPad’s OLED jump will still feel transformative, especially for buyers who’ve used the entry-level or the mid-range iPads for years. 

Having demonstrated that it has the operational capability to transport humans safely to the moon and back, the United States is moving on to its next major aim: It wants nuclear reactors in orbit and on the lunar surface by 2030. For such a feat, the National Aeronautics and Space Administration will have to work in conjunction with the Department of Defense and the Department of Energy.

In a post on X, the White House Office of Science and Technology Policy (OSTP) unveiled a document with new guidelines for federal agencies to establish the space nuclear technology road map for the coming years. This, they say, will ensure “US space superiority.”

At present, space instruments use solar power to operate. However, this is considered impractical for more complex purposes. Although technically there is always sunlight, the power is intermittent and almost always requires bulky batteries to store it.

Reactors produce fairly continuous energy for years through nuclear fission. They can also be used for so-called nuclear electric propulsion. Continuous output makes them the most viable option for lunar base subsistence, but they can also allow spacecraft to undertake long or complex missions without worrying about depleting a limited supply of chemical fuel.

Nuclear technology, in short, makes it possible to go farther, with more payload, for longer, and with fewer constraints.

According to the memorandum, the US goal is to put a medium-power reactor in orbit by 2028, with a variant designed for nuclear electric propulsion, and a first functional large reactor on the surface of the moon by 2030. To achieve this, both NASA and the Pentagon will develop energy technologies in parallel, using the current strategy of competition among contractors.

The reactors will have to be modular and scalable, and will have to include applications for both future life on the moon and space propulsion. For its part, the DOE will have to ensure that these projects have the fuel, infrastructure, and safety features necessary to achieve their objectives. In addition, the agency will evaluate whether the industry has the capacity to produce up to four reactors in five years.

The plan contemplates technologies that produce at least 20 kilowatts of electricity (kWe) for three years in orbit and at least five years on the lunar surface. In the meantime, they should have a design capable of raising power to 100 kWe. The first designs should arrive within a year.

Finally, the order tasks the OSTP with creating a road map for the initiative, noting obstacles and recommendations for addressing them.

“Nuclear power in space will give us the sustained electricity, heating, and propulsion essential to a permanent presence on the moon, Mars, and beyond,” OSTP posted. For his part, NASA administrator Jared Isaacman posted, “The time has come for America to get underway on nuclear power in space.” The message was followed by an emoji of a US flag.

The plan provides a common framework for each agency to work within. In the background, the race for space infrastructure is evidence of technological competition with China, which is also seeking advanced energy capabilities for the moon.

This story originally appeared in WIRED en Español and has been translated from Spanish.

Apple’s MacBook Neo is a $600 (or $500 for students) shot across the bow at affordable Windows laptops, and it seems like Microsoft has ready its first response. The newly announced “Microsoft College Offer” is a bundle of Microsoft 365 Premium, Xbox Game Pass Ultimate, custom Xbox controller and discounted laptop that the company thinks could woo students away from Apple’s new deal.

With the purchase of a discounted machine directly from Microsoft, retailers like Amazon and Best Buy or PC makers like HP, ASUS and Acer, you can get what the company says is an extra $500 of value from its bundle. The laptop deals include a Lenovo IdeaPad Slim 3x with a Snapdragon X chip, 16GB of RAM and 256GB of storage for $500 from Best Buy, around $250 off the laptop’s usual $750 price. Or if you wanted something even cheaper, Walmart is selling an HP Omnibook 3 for $429, a discount of $270 off its usual $699 price. Microsoft is less generous with the deals on its own laptops and tablets, but you can even get a discount on a Surface Laptop as part of the offer.

A discounted laptop is great, but where the value of the Microsoft College Offer gets harder to define is with the services the company is packing in. Getting what would normally be a $200 year-long subscription to Microsoft 365 Premium for free is a meaningful deal, but many colleges give their students access to Microsoft’s apps (and other software) with the cost of their tuition. A year of Xbox Game Pass Ultimate, which costs $30 per month as of October 2025, sounds like significant savings, but the offer is only valid for new subscribers. That leaves the free custom Xbox controller as the simplest bonus of the bunch, a value of around $76.

Windows PC makers are expected to make more serious attempts to compete with the Neo over the next year. For now, though, the Microsoft College Offer isn’t exactly a bad deal, but it’s certainly not as straightforwardly appealing as an Apple-quality laptop for $500 with a college discount.

The Microsoft College Offer is available to students starting April 15 and runs through June 30, 2026. Microsoft says redemption of the full bundle of services and accessories it’s offering needs to happen by July 31, 2026.

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Nothing launched a genuinely useful app called Warp earlier today, with a simple idea: allowing Android users to share files, links, and copied texts directly to their Mac, Windows, or Linux machines without including any cables or convoluted workarounds. 

Nothing announced the app for Chrome and Edge (Chromium-based web browsers) and Android smartphones, floating it on both the Chrome Web Store and the Google Play Store (via 9To5Google). However, a few hours later, the app is nowhere to be found, with the official listings returning errors. 

So, how did Warp actually work?

Nothing’s Warp app used Google Drive as a data transfer bridge, keeping files within users’ accounts rather than routing them via Nothing’s servers. From their phones, users picked any file or link (via the Android share sheet) and sent it through Warp.

On the receiving end, a desktop, the browser extension added a right-click “Send with Nothing Warp” option, along with an upload button. Once a file was received, users still had to manually download it. 

In other words, Nothing’s Warp wasn’t using peer-to-peer transfer (like Quick Share or AirDrop), but a cloud relay with some branding on top. 

Did the Nothing Warp app disappear already?

That’s the part nobody has explained (yet). Within hours of launch, the official community post announcing the app returned a “This page doesn’t exist” error. The app isn’t listed on the Play Store or the Chrome Web Store anymore.

One Reddit user claims that the app bears a striking resemblance to an open-source tool, which could be one of the reasons for the potential takedown. However, this remains unconfirmed speculation at the moment, as the company hasn’t issued an official statement about the removal. 

Another user downloaded the app’s setup, but couldn’t run it due to a Play Store warning, which is usually issued for safety purposes. Even so, the app is reportedly working fine for users who installed it earlier today on their smartphones and laptops. 

Warp’s rapid rise and fall remind me of how the Nothing Chat app, an iMessage-bridging solution, was pulled days after launch due to security concerns. If the removal was precautionary, Nothing might go ahead with a refined version of the app. 

from the with-friends-like-this… dept

Back in January of last year, the Wall Street Journal published a story about a leather-bound birthday book that Ghislaine Maxwell had assembled for Jeffrey Epstein’s 50th birthday in 2003. The book included letters from various associates, and one of them bore Donald Trump’s name. According to the article, it featured a hand-drawn outline of a naked woman with typewritten text inside. The page was signed with a recognizable squiggly “Donald” signature positioned to mimic pubic hair and closed with the ridiculously creepy line: “Happy Birthday—and may every day be another wonderful secret.”

Trump denied writing the letter and called it “a fake thing” before suing the Journal, Rupert Murdoch, News Corp, and the two reporters for a mere $10 billion. Each count asked for at least $10 billion, because apparently that’s the going rate for Donald Trump’s hurt feelings these days.

On Monday, federal judge Darrin Gayles dismissed the lawsuit, finding that Trump hadn’t come anywhere close to adequately alleging “actual malice,” the standard required for a public figure to win a defamation claim. For those who follow this stuff, that’s about as unsurprising as it gets.

The actual malice standard, established in New York Times v. Sullivan decision, requires a public figure to show that the defendant either knew the story was false or published it with reckless disregard for the truth (which courts have interpreted to require that the publisher actually harbored serious doubts about whether the statement was true). It does not mean, as many people assume, the colloquial meaning of “malice”: that they just don’t like the person. Trump’s complaint was heavy on boilerplate language about malice and light on, well, anything resembling actual facts supporting it. Judge Gayles was blunt about the gap:

The Complaint comes nowhere close to this standard. Quite the opposite.

The “quite the opposite” is the fun part. Trump’s own complaint described the reporters reaching out to him, as well as the FBI and the Justice Department, before publication. Trump gave them a denial, which they printed; the DOJ didn’t respond and the FBI declined to comment. Trump’s argument was essentially that since he told the Journal the letter was fake before publication, running the story anyway proved they had serious doubts about its truth and therefore acted with actual malice.

You hear this a lot from SLAPP defamation filers, pretending that a mere denial by them means that anyone printing what they’re accused of is actual malice. But that’s not how any of this works. Just because you deny something, doesn’t automatically mean the journalists have to believe it’s false. Their evidence can (and often does) reveal that the subjects of their reporting are lying in their denials. A denial is not proof of falsity. It’s just proof that you’re denying something. The court wasn’t buying any of it:

To establish actual malice, “a plaintiff must show the defendant deliberately avoided investigating the veracity of the statement in order to evade learning the truth.”…

As the judge noted, printing Trump’s denial alongside their own journalistic findings demonstrated responsible reporting — the opposite of actual malice, which would require evidence that the reporters had serious doubts about the letter’s authenticity and deliberately avoided investigating further. Then printing the denial alongside the evidence, again, was the opposite of actual malice:

The Article also informed readers that President Trump decried the Letter as a fake and denied writing it. By “allowing readers to decide for themselves what to conclude from the [Article], any allegation of actual malice [is] less plausible.” Turner, 879 F.3d at 1274. See also Michel, 816 F.3d at 703 (holding that “reporting perspectives contrary to the publisher’s own should be interpreted as helping to rebut, not establish, the presence of actual malice.”)

The judge also, somewhat gently, reminded Trump’s lawyers that actual malice is an actual legal standard, not just ‘they don’t like me.’

President Trump’s allegation that Defendants acted with ill-will is insufficient to plead actual malice. Aside from being conclusory and without factual support, “ill-will, improper motive or personal animosity plays no role in determining whether a defendant acted with actual malice.”

Meanwhile, as this lawsuit wound through the courts, the very letter Trump claimed didn’t exist surfaced publicly. The House Oversight Committee subpoenaed the Epstein estate and obtained the birthday book. They released it publicly, and wouldn’t you know it, there’s a page that matches the Journal’s description of the letter exactly:

The judge couldn’t consider the produced letter at this stage of the litigation because Trump disputes its authenticity, which is his right procedurally. And the judge has to treat the claims in the complaint as true. But the rest of us sure can look at it. And judge for ourselves.

The court gave Trump until April 27 to file an amended complaint, and a spokesman for his legal team promised he would “refile this powerhouse lawsuit.” I suppose if you squint hard enough at a complaint a federal judge said “comes nowhere close” to meeting basic legal standards, “powerhouse” is one word you could use for it — just probably not in the way they mean.

The Journal’s defense team also sought attorneys’ fees under Florida’s anti-SLAPP statute. The judge denied the fee request for now, since Trump gets a chance to amend. But that request can be renewed, which means if the amended complaint fares no better, Trump could end up paying for the privilege of having sued the Journal over a story that appears to be true.

This is also a reminder of why we need stronger anti-SLAPP laws in every state, as well as a federal anti-SLAPP law.

This case isn’t over yet, but the judge clearly sees it as just as weak as we said it was when it was filed last year. As always, Trump files these vexatious lawsuits knowing none of them have a real shot — the goal is to burn time and money for media organizations, and scare some of them into softening their coverage or thinking twice before calling out his behavior.

The guy who presents himself as a champion of free speech remains the most anti-free speech president we’ve had in any of our lifetimes, consistently abusing the judicial system as a way to punish those who make him look bad.

Filed Under: actual malice, darrin gayles, defamation, donald trump, jeffrey epstein, rupert murdoch, slapp

Companies: news corp., wsj