On June 18, F5 released emergency fixes for two critical vulnerabilities in NGINX Open Source — the web server software that quietly powers a huge share of small-business websites, customer portals, and cloud apps. A remote attacker who can reach the server over the network can run their own code on it, with no password and no user interaction. If you don't know whether NGINX is running anywhere in your stack, that's exactly the problem your managed-IT provider should be solving right now.
What F5 actually disclosed
F5 has released security updates to address two critical security flaws in NGINX Open Source that could be exploited to achieve code execution on affected systems. The headline bug is CVE-2026-42530, a CVSS v4 score of 9.2 use-after-free vulnerability in the ngx_http_v3_module that could be triggered by a remote unauthenticated attacker — in plain English, anyone on the internet can reach a vulnerable server and potentially take it over, without logging in.
NGINX Open Source is the free version of the NGINX web server. It runs in front of websites, e-commerce stores, customer portals, internal dashboards, VPN landing pages, and a long list of cloud-hosted small-business apps. If a vendor built you a web app in the last decade, there's a real chance NGINX is sitting somewhere in the delivery path.
Why this matters for a small business
Unauthenticated remote code execution on a public-facing web server is the worst kind of bug. It's the entry point that ransomware crews and data-theft groups look for first, because once they're on the web server they can pivot into databases, customer records, payment data, and the rest of your network.
The complication for small businesses is that you usually don't run NGINX directly — your web developer, hosting provider, SaaS vendor, or marketing agency does. That means the patch isn't sitting on your office computers. It's sitting on someone else's server, and someone has to make sure it actually gets applied. That coordination is exactly the kind of work that belongs to York Computer's managed IT services — tracking which of your vendors run vulnerable software and pushing them to fix it on a clock, not on their own schedule.
What your MSP should be doing this week
A competent managed-IT provider should already be doing four things in response to this advisory:
1. Inventorying every web server, reverse proxy, and load balancer you own or pay a vendor to run, and flagging anything that uses NGINX Open Source.
2. Confirming the installed version and pushing the F5 patch on anything you control directly. The fix is available now.
3. Contacting your web host, web developer, and any SaaS vendor that exposes a custom domain on your behalf, and asking — in writing — whether they've patched.
4. Reviewing web server access logs for unusual HTTP/3 traffic or unexplained outbound connections from the server, since the bug is in the HTTP/3 module.
If your IT support can't answer question #1 by Monday, that's the real story. You shouldn't be discovering your attack surface in the middle of an incident.
The bigger pattern
This is the third widely-deployed open-source or edge component with a critical, unauthenticated RCE bug in the last several weeks, alongside Palo Alto GlobalProtect and the Joomla JCE editor. The pattern is consistent: attackers are aggressively hunting the software that sits between the public internet and your internal network, because one bug on one box gets them everything. Patching cadence — not antivirus, not employee training — is what separates businesses that get breached from businesses that don't.
What York Businesses Should Do
If your York County business runs a public website, customer portal, or online booking system, ask whoever built it whether they use NGINX and when they applied the June 18 F5 patch. Get the answer in email so you have a paper trail if something goes wrong later.