A Busy Week for Software Patches
Three separate security problems surfaced this week, each affecting software used by millions of people and businesses. One involves the web server software that powers a huge share of the internet. Another affects a popular file compression tool. The third is a business software platform that is already under attack right now. None of these tools are obscure. Chances are good that something you use every day depends on at least one of them, even if you have never heard their names before.
The Nginx Web Server Flaw
Nginx is server software that sits behind a massive portion of websites you visit, quietly handling traffic between your browser and the sites you use. A newly discovered flaw, tracked as CVE-2026-42533, lets an attacker send a specially crafted web request that overwhelms the server's memory handling and crashes the process responsible for serving pages. In the worst case, researchers say the same flaw could potentially be used to run malicious code on the server, not just crash it.
The good news is that this attack has to be carried out by someone targeting the server directly, not something that reaches you through your browser. The people who need to act are website operators and hosting companies, not everyday internet users. Nginx released fixed versions on July 15, covering both its stable and mainline release branches, along with the commercial NGINX Plus product. If you run a website or manage servers, this is worth checking immediately, since an unpatched server sitting online is an easy target once details of a flaw like this become public.
A Booby-Trapped Archive File in 7-Zip
The second issue hits closer to home for regular computer users. 7-Zip is one of the most widely used free tools for opening compressed files, including the increasingly common XZ archive format. Researchers found that a corrupted or maliciously altered XZ file can trigger a memory error in 7-Zip during extraction, and that error can be exploited to run code on your computer.
In plain terms, this means opening the wrong compressed file, even one that looks harmless, could let an attacker plant malware on your machine without any other warning signs. This is the same basic trick attackers have used for years with rigged Word documents and PDFs, just applied to a file format many people trust without a second thought. A fixed version, 7-Zip 26.02, was released back on June 25, and full technical details about the flaw were published on July 15. If you have not updated 7-Zip recently, any protection from that fix simply is not on your machine yet.
ServiceNow Attacks Already Underway
The most urgent item on this list is a flaw in ServiceNow's AI Platform, tracked as CVE-2026-6875. Unlike the other two issues, this one is not just theoretical. Security researchers monitoring attacker activity say hackers have already started exploiting this vulnerability in real attacks. ServiceNow is widely used by large organizations to manage internal operations like IT support, HR requests, and customer service workflows, often storing sensitive company and customer data in the process.
A code execution flaw in a platform like this can give attackers a foothold inside a company's internal systems, potentially exposing employee records, customer data, or internal communications. Because active exploitation has already been observed, organizations using ServiceNow should treat this as a same-day priority rather than something to schedule for next week's maintenance window.
What You Should Do
Most of this falls on IT teams and website operators rather than individual users, but there are still steps worth taking.
- If you manage a website or server running nginx, upgrade to version 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 as soon as possible.
- If you use 7-Zip, update to version 26.02 or later right away, and avoid opening XZ archive files from sources you do not fully trust in the meantime.
- If your workplace uses ServiceNow, alert your IT or security team immediately if you have not already heard about this, since attackers are actively exploiting it.
- For everyone else, this is a good reminder to keep automatic updates turned on for the everyday software you rely on, since flaws like these are usually fixed quietly long before most people notice the news about them.
