A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication.

The flaw, tracked as CVE-2026-33032, is caused by nginx-ui leaving the ‘/mcp_message’ endpoint unprotected, allowing remote attackers to invoke privileged MCP actions without credentials.

Because those actions involve writing and reloading nginx configuration files, a single unauthenticated request can modify server behavior and effectively take over the web server.

“[…] any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads – achieving complete nginx service takeover,” reads NIST’s descripion of the flaw in the National Vulnerability Database (NVD).

NGNIX released a fix for the flaw in version 2.3.4 on March 15, a day after researchers at the AI workflow security company Pluto Security AI reported it. However, the vulnerability identifier, along with technical details and a proof-of-concept (PoC) exploit, emerged at the end of the month.

In the CVE Landscape report earlier this week, threat intelligence company Recorded Future notes that CVE-2026-33032 is under active exploitation.

Nginx UI is a web-based management interface for the Nginx web server. The library is very popular, with more than 11,000 stars on GitHub and 430,000 Docker pulls.

Based on Pluto Security’s internet scans using the Shodan engine, there are currently 2,600 publicly exposed instances potentially vulnerable to attacks. Most are in China, the United States, Indonesia, Germany, and Hong Kong.

In a report today, Pluto Security’s Yotam Perkal says that exploitation only requires network access and is achieved by establishing an SSE connection, opening an MCP session, and then using the returned ‘sessionID’ to send requests to the ‘/mcp_message’ endpoint.

From there, attackers can invoke MCP tools without authentication and take the following actions:

• Connect to the target nginx-ui instance
• Send requests without any authentication headers
• Gain access to all 12 MCP tools (7 destructive)
• Read nginx configuration files and exfiltrate them
• Inject a new nginx server block with malicious configuration
• Trigger automatic nginx reload

Pluto Security’s demo shows that an attacker can use the unauthenticated MCP message endpoint to execute privileged nginx management actions, perform config injection, and ultimately take control of the nginx server, all without authentication.

Given the active exploitation status and the availability of public PoCs, system administrators are recommended to apply the available security updates as soon as possible. The latest secure version of nginx-ui is 2.3.6, released last week.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now

The LCD era on Apple’s iPad Air may finally be over next year. According to a new report by the South Korean outlet ET News, Apple is gearing up to give the iPad Air the most-awaited upgrade: an OLED display.

Per the publication, Samsung Display is preparing to manufacture OLED panels for the next-generation iPad Air. Mass production is expected to begin around the end of this year or the beginning of next year (in January 2027). 

Why is this a big deal?

If everything goes well, Apple may release the updated iPad Air in the first half of 2027, likely between March and May. This is a bigger deal than it sounds. The iPad Air is a mid-range tablet that features one of the most capable chipsets in the segment, along with a clean iOS experience.

However, it’s held back by the LCD display, which is limited to 60Hz, while tablets in the market (around the same price) offer OLED displays that support higher refresh rates. The top-tier iPad Pro has also enjoyed an OLED panel for two years. 

Bringing OLED to the Air will deliver richer contrast, deeper blacks, and more accurate colors, effectively closing a significant visual gap between Apple’s mid-range and premium tablet tiers. Once the update lands, Apple’s entire iPad lineup will feature OLED panels, except the baseline iPad. 

What’s the catch, though? 

The OLED panel that’s headed to the 2027 iPad Air could use a single-stack LTPS structure, which is cheaper than the pricier tandem OLED panel found on the iPad Pro. If true, this could result in noticeable compromises. 

For instance, the OLED iPad Air might miss out on ProMotion 120Hz support; the display will most certainly be locked at 60Hz (maintaining the company’s upsell hierarchy). While this won’t be an issue for everyday users, who use the iPad for streaming, browsing, or taking notes, gamers might want to stick with the iPad Pro. 

Anyways, iPad’s OLED jump will still feel transformative, especially for buyers who’ve used the entry-level or the mid-range iPads for years. 

Having demonstrated that it has the operational capability to transport humans safely to the moon and back, the United States is moving on to its next major aim: It wants nuclear reactors in orbit and on the lunar surface by 2030. For such a feat, the National Aeronautics and Space Administration will have to work in conjunction with the Department of Defense and the Department of Energy.

In a post on X, the White House Office of Science and Technology Policy (OSTP) unveiled a document with new guidelines for federal agencies to establish the space nuclear technology road map for the coming years. This, they say, will ensure “US space superiority.”

At present, space instruments use solar power to operate. However, this is considered impractical for more complex purposes. Although technically there is always sunlight, the power is intermittent and almost always requires bulky batteries to store it.

Reactors produce fairly continuous energy for years through nuclear fission. They can also be used for so-called nuclear electric propulsion. Continuous output makes them the most viable option for lunar base subsistence, but they can also allow spacecraft to undertake long or complex missions without worrying about depleting a limited supply of chemical fuel.

Nuclear technology, in short, makes it possible to go farther, with more payload, for longer, and with fewer constraints.

According to the memorandum, the US goal is to put a medium-power reactor in orbit by 2028, with a variant designed for nuclear electric propulsion, and a first functional large reactor on the surface of the moon by 2030. To achieve this, both NASA and the Pentagon will develop energy technologies in parallel, using the current strategy of competition among contractors.

The reactors will have to be modular and scalable, and will have to include applications for both future life on the moon and space propulsion. For its part, the DOE will have to ensure that these projects have the fuel, infrastructure, and safety features necessary to achieve their objectives. In addition, the agency will evaluate whether the industry has the capacity to produce up to four reactors in five years.

The plan contemplates technologies that produce at least 20 kilowatts of electricity (kWe) for three years in orbit and at least five years on the lunar surface. In the meantime, they should have a design capable of raising power to 100 kWe. The first designs should arrive within a year.

Finally, the order tasks the OSTP with creating a road map for the initiative, noting obstacles and recommendations for addressing them.

“Nuclear power in space will give us the sustained electricity, heating, and propulsion essential to a permanent presence on the moon, Mars, and beyond,” OSTP posted. For his part, NASA administrator Jared Isaacman posted, “The time has come for America to get underway on nuclear power in space.” The message was followed by an emoji of a US flag.

The plan provides a common framework for each agency to work within. In the background, the race for space infrastructure is evidence of technological competition with China, which is also seeking advanced energy capabilities for the moon.

This story originally appeared in WIRED en Español and has been translated from Spanish.

Apple’s MacBook Neo is a $600 (or $500 for students) shot across the bow at affordable Windows laptops, and it seems like Microsoft has ready its first response. The newly announced “Microsoft College Offer” is a bundle of Microsoft 365 Premium, Xbox Game Pass Ultimate, custom Xbox controller and discounted laptop that the company thinks could woo students away from Apple’s new deal.

With the purchase of a discounted machine directly from Microsoft, retailers like Amazon and Best Buy or PC makers like HP, ASUS and Acer, you can get what the company says is an extra $500 of value from its bundle. The laptop deals include a Lenovo IdeaPad Slim 3x with a Snapdragon X chip, 16GB of RAM and 256GB of storage for $500 from Best Buy, around $250 off the laptop’s usual $750 price. Or if you wanted something even cheaper, Walmart is selling an HP Omnibook 3 for $429, a discount of $270 off its usual $699 price. Microsoft is less generous with the deals on its own laptops and tablets, but you can even get a discount on a Surface Laptop as part of the offer.

A discounted laptop is great, but where the value of the Microsoft College Offer gets harder to define is with the services the company is packing in. Getting what would normally be a $200 year-long subscription to Microsoft 365 Premium for free is a meaningful deal, but many colleges give their students access to Microsoft’s apps (and other software) with the cost of their tuition. A year of Xbox Game Pass Ultimate, which costs $30 per month as of October 2025, sounds like significant savings, but the offer is only valid for new subscribers. That leaves the free custom Xbox controller as the simplest bonus of the bunch, a value of around $76.

Windows PC makers are expected to make more serious attempts to compete with the Neo over the next year. For now, though, the Microsoft College Offer isn’t exactly a bad deal, but it’s certainly not as straightforwardly appealing as an Apple-quality laptop for $500 with a college discount.

The Microsoft College Offer is available to students starting April 15 and runs through June 30, 2026. Microsoft says redemption of the full bundle of services and accessories it’s offering needs to happen by July 31, 2026.

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Nothing launched a genuinely useful app called Warp earlier today, with a simple idea: allowing Android users to share files, links, and copied texts directly to their Mac, Windows, or Linux machines without including any cables or convoluted workarounds. 

Nothing announced the app for Chrome and Edge (Chromium-based web browsers) and Android smartphones, floating it on both the Chrome Web Store and the Google Play Store (via 9To5Google). However, a few hours later, the app is nowhere to be found, with the official listings returning errors. 

So, how did Warp actually work?

Nothing’s Warp app used Google Drive as a data transfer bridge, keeping files within users’ accounts rather than routing them via Nothing’s servers. From their phones, users picked any file or link (via the Android share sheet) and sent it through Warp.

On the receiving end, a desktop, the browser extension added a right-click “Send with Nothing Warp” option, along with an upload button. Once a file was received, users still had to manually download it. 

In other words, Nothing’s Warp wasn’t using peer-to-peer transfer (like Quick Share or AirDrop), but a cloud relay with some branding on top. 

Did the Nothing Warp app disappear already?

That’s the part nobody has explained (yet). Within hours of launch, the official community post announcing the app returned a “This page doesn’t exist” error. The app isn’t listed on the Play Store or the Chrome Web Store anymore.

One Reddit user claims that the app bears a striking resemblance to an open-source tool, which could be one of the reasons for the potential takedown. However, this remains unconfirmed speculation at the moment, as the company hasn’t issued an official statement about the removal. 

Another user downloaded the app’s setup, but couldn’t run it due to a Play Store warning, which is usually issued for safety purposes. Even so, the app is reportedly working fine for users who installed it earlier today on their smartphones and laptops. 

Warp’s rapid rise and fall remind me of how the Nothing Chat app, an iMessage-bridging solution, was pulled days after launch due to security concerns. If the removal was precautionary, Nothing might go ahead with a refined version of the app.