TLDR Tech / InfoSec
Claude + Humans vs nginx: CVE-2026-27654
CVE-2026-27654 is a heap buffer overflow in nginx's WebDAV module that is triggered when the Destination header is shorter than the location prefix, causing an unsigned underflow. It requires a non-default config with ngx_http_dav_module, alias, and dav_methods COPY or MOVE. Claude found the bug and wrote the initial crash PoC. Three researchers then built two more variants: one achieving arbitrary file write, another reading /etc/passwd with a single COPY request. When the nginx fix went public on March 24, an AI commit-watcher produced a crashing PoC the same day.
Read the full story