Nginx

Vincent Bernat has published a technical guide explaining how to self-host HTTP tunnels using SSH and Nginx, offering an alternative to commercial tunnelling services like ngrok. The article walks through reverse tunneling, proxy configuration, and the practical trade-offs involved. Developers on Hacker News are engaging with the piece, debating whether rolling your own setup beats managed services.

A security flaw tracked as CVE-2026-107806 has been disclosed in Nginx UI, the web interface for Nginx by developer 0xJacky. A logged-in user can abuse the backup restore endpoint to overwrite configuration and execute commands on the server. Versions 2.3.8 through before 2.5.0 are affected, and the issue is fixed in version 2.5.0. Administrators running the panel are being urged to upgrade promptly.

Caddy, the open-source web server written in Go, is trending among developers. The project bills itself as a fast, extensible HTTP/1, HTTP/2 and HTTP/3 server with automatic HTTPS, meaning it provisions and renews TLS certificates by default. It runs across platforms and is widely used as a reverse proxy and lightweight alternative to Nginx. Developers are discussing it for its simplicity and secure-by-default configuration.

A high-severity flaw, CVE-2026-107809 rated 8.8, has been disclosed in Nginx UI, the web interface for the Nginx server. Versions 2.0.0 through before 2.5.0 accept a browser-managed token cookie as an API credential after the front end stores the JWT there, leaving management endpoints exposed. Security communities are sharing the advisory and urging users to update to 2.5.0 or later.

A new high-severity vulnerability, CVE-2026-107808 with a CVSS score of 8.1, has been disclosed in Nginx UI, the web management interface for the Nginx web server. Versions 2.0.0 through 2.5.0 fail to properly enforce passkey authentication: the login endpoint checks whether OTP is enabled but does not require a WebAuthn assertion when passkeys are enabled and no TOTP secret is configured, potentially allowing passkey-only accounts to bypass authentication. Security teams are urged to update to version 2.5.0 or later.

A new vulnerability, CVE-2026-107807, has been assigned a high severity score of 8.8. It affects Nginx UI, a web interface for managing the Nginx web server, in versions 2.0.0 through 2.5.0. The flaw involves the software accepting the Node.Secret master credential via the node_secret query parameter in HTTP and WebSocket authentication paths, rather than requiring it through a more secure channel, exposing credentials to interception. Administrators running affected versions are urged to review the advisory and update promptly.