ONS data for England and Wales shows 26% of heterosexual divorces in 2025 followed 20 years or more of marriage

Most couples are aware of the dreaded “seven-year itch”, when the honeymoon period wears off and real life starts to bite.

Now official data has shown that couples in England and Wales are more likely to split after 20 years. According to Office for National Statistics figures, more than a quarter of all divorces between opposite-sex couples happened after 20 years or longer of marriage.

Continue reading...

© Photograph: Rani Nurlaela Desandi/Getty Images

© Photograph: Rani Nurlaela Desandi/Getty Images

© Photograph: Rani Nurlaela Desandi/Getty Images

From ‘has flat buttocks’ to ‘likes brunettes with muscles’, the retailer’s About You pages offer some remarkable insights into customers’ lives and tastes. Naturally, I rushed to check out mine …

There’s been a disturbing development in the surveillance capitalism space for me and other Amazon users: we can now find out exactly what the site thinks about us. The tax-agnostic shopping behemoth launched an “About You” function, which allows shoppers to see what assumptions and beliefs it has gathered from our purchases, in May, but last week things got interesting. Threads user Megan Montgomery found her “About You” page, and discovered Amazon thinks she “has flat buttocks”, prompting other shoppers to post the implacably devastating verdicts they uncovered: “husband has skinny legs”; “likes brunettes with muscles”; “cusses when scared”; “cannot keep real plants alive”; “too short to reach into a 40in-deep box” and “treats cats as biological children”. A TikTok user says hers includes “has a bad father”.

By their fruits shall ye know them, if by “fruits” you mean compression socks, shapewear, cat carriers and self-help guides. Obviously, this is bad, but it’s a well-deserved kind of bad – we’ve sacrificed privacy for convenience and this is the result. It’s also bleakly funny, so just as obviously, I was over there like a ferret up a trouser leg to find out what the stuff Amazon has delivered here over the years has caused it to deduce about my household. The results were disappointing. You don’t need a particularly sophisticated algorithm to deduce “likely lives in York”; “feeds wild birds consistently” (not in summer! I follow RSPB guidance!) and “cycles recreationally” (absolutely not, but I live with a multi-bike-owning MAMNILYBOROD – that’s “middle-aged man not in Lycra yet because of risk of divorce”).

Continue reading...

© Photograph: agrobacter/Getty Images

© Photograph: agrobacter/Getty Images

© Photograph: agrobacter/Getty Images

For a while, those hoping to avoid the difficulty and expense of dealing with Adobe's Creative Suite have been able to use several free and/or open source alternatives that replicate some or all of those capabilities. Now, one developer is using AI-powered reverse engineering to mimic the look, feel, and functionality of Adobe's well-known software with what he hopes will soon be perfect fidelity.

Artcraft got its start last year as a "controllable AI for artists" that allows for precise post-generation editing of AI-crafted images and videos. Over the weekend, though, the brand debuted its pivot to a suite of seven open source apps recreating the user interface and tools found in Adobe's Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign, and Acrobat Pro.

In announcing those new apps on Reddit earlier this week, software developer Brandon Thomas said he used Anthropic's Claude Opus 5.5 to create "clean-room replacements" for Adobe's closed source software in Rust (with WebAssembly versions available for use in a browser). And while commenters on Hacker News and elsewhere have taken pains to point out the new software's many current shortcomings, Thomas makes the grandiose promise that the current "super early alpha" state will soon lead to something just as functional as anything Adobe has ever put out.

Read full article

Comments

© Artcraft

- In 2022 Altair Engineering open sourced "OpenRadioss", an industry-leading finite element solver under the GNU AGPL License, reports Phoronix. - Siemens acquired Altair Engineering last year - Siemens closes access to OpenRadioss. "Siemens didn't just end the project but they shutdown the GitHub repository that hosted the open-source code and removed other resources that had built around it," writes Phoronix, before announcing a new open-source community fork: Radioss has been an industry-leading solver for analyzing crashes, blasts, and other purposes. Altair creating OpenRadioss was a huge milestone for the technical computing industry. It also had other effects like for myself in finally being able to benchmark with this (Open)Radioss code for CPU performance testing compared to the expensive licensing on Radioss itself... Siemens argues the OpenRadioss closure is for consolidating efforts: "After four years of successful community-driven research, Siemens is entering a new chapter for the Radioss solver. To accelerate innovation and provide the robust support our global users require for production-grade simulation, we are consolidating our efforts." It was Brian Clemens. founder/VP Rocky Linux and the Rocky Enterprise Software Foundation who launched the community fork of OpenRadioss — to be called OpenCourant. Its web site announces they'll be "carrying forward the OpenRadioss code base under the GNU AGPL, in the open, where it belongs." Phoronix writes in a follow-up: OpenCourant is based on the last publicly known open-source OpenRadioss snapshot before Siemens shut it down and removed access to the Git repository... OpenCourant continues with the OpenRadioss GNI AGPLv3 licensing and will be run as part of the Rocky Enterprise Software Foundation. They have run into a small issue though with part of OpenRadioss consisting of binary dependencies and not having the very latest versions prior to Siemens' removal of the repository. Details on that via this discussion thread for anyone that happens to have recent OpenRadioss binaries. In other open source news, Kagi is ending their development work on the Orion Browser for Linux and Windows, reports the site Linuxiac — but Kagi "plans to open-source both versions so other developers or organizations can keep them going."

Read more of this story at Slashdot.

Long-time Slashdot reader Andreas(R) announces Northstar, a "minimalist" web browser written entirely from scratch in C — now available in version 1.0.11: One window, one page, one process — about 160,000 lines of original C, small enough for one person to read and audit end-to-end. It carries no upstream browser engine: no Gecko, no WebKit, no Blink. It is free software under the GNU General Public License, version 3 or later, and it runs on Linux, macOS and Windows... Compliance is not inherited from an upstream engine; it is measured, section by section, against the specification text... Private by construction. No telemetry, no update pings, and no AI assistant or AI-style web APIs. Safe browsing checks a top-level navigation's host against a local SHA-256 blocklist before it is fetched — the check never leaves your machine. Cookies, storage and the cache are partitioned by origin. It's logo reminds me of the old Netscape logo. (And I love the "Best viewed in..." GIF at the upper-right of its web site.)

Read more of this story at Slashdot.

In late 1970, a Titan IIIC rocket launched from Space Launch Complex 40 at what was then called Cape Canaveral Air Force Station. It carried a top-secret payload for the US military.

Much has changed in spaceflight since then. The Titan IIIC would bow out in 1982 after dozens of launches. Various Titans continued launching from Space Launch Complex 40 until 2005, at which point the US Air Force—in a competitive process hotly opposed by United Launch Alliance—turned the pad over to a small, largely unknown startup called SpaceX. And Cape Canaveral is now a "Space Force" station.

But those unspecified payloads? Until last month, some of them were still flying operationally.

Read full article

Comments

© ULA/Carleton Bailie

The tech giant will refund $7.25 million in Prime membership fees to affected customers and pay an additional $1 million to settle the suit brought by the District of Columbia.

© Lucia Vazquez for The New York Times

For a long time, PC gamers could access many PlayStation 5 games only if the publisher invested in a bespoke port (something Sony has recently said it will be scaling back). Now, though, rapid advancements in PS5 emulators and other tools are making recent PlayStation titles increasingly playable on generic PCs.

SharpEmu was the first of these emulators, advancing from a "very early alpha stage" in May to a current state that can "load the eboot.bin of real games, execute native CPU instructions, and partially handle GPU-related functionality." The most recent release boasts 10 tested games that reach a "playable" state, including six that developer CursedIfElse says are "fully playable at 60 fps." That includes simple 2D games like Tetris Forever but also 3D titles like Astro Bot and the PS5 Demon's Souls remaster running at playable frame rates.

"SharpEmu has prioritized hardware accuracy from the very beginning, and we’re finally starting to see that investment pay off," CursedIfElse wrote on social media this week. "It was built completely from scratch, and this is how far we’ve come."

Read full article

Comments

© Youtube / PSXTech

Meta’s C.E.O. talks for the first time about his style evolution.

© Victor Llorente for The New York Times

A SharePoint Server vulnerability tracked as CVE-2026-65660 turned out to be far more serious than Microsoft first indicated. The company originally described it as a spoofing issue with a CVSS score of 6.5. In reality, it is an authenticated RCE flaw rated 8.8. That gap matters, because security teams that trusted the first label may have pushed the patch further down their to-do lists. 

What the CVE-2026-65660 RCE Flaw Does?

Dinh Ho Anh Khoa, a researcher at Viettel Cyber Security, discovered the bug. Microsoft credits him as "khoadha." The flaw affects SharePoint Server 2016, 2019, and Subscription Edition, and it stems from improper validation of the SafeControls list.  An attacker can use unescaped quotes to slip malicious Register directives past that validation. They can then run arbitrary .NET classes through deserialization in XamlServices.Parse(), which opens the door to deploying an in-memory webshell.  Microsoft's executive summary states that "improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network." The weakness is categorized as CWE-94. According to the company's FAQ, an authenticated attacker with low-level access could send a specially crafted request to run code on the server, with no user interaction required. 

Inside Microsoft's Revised SharePoint Advisory 

Microsoft published the advisory on August 11, 2026. It issued version 1.1 on August 27, updating the impact field in the Security Updates table, the CVE title, and the FAQs, and it called the revision "an informational change only."  The advisory now lists the impact as Remote Code Execution, with a maximum severity of Important. The vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, which gives a base score of 8.8 and a temporal score of 7.7. That means the attack comes over the network with low complexity, requires low privileges and no user interaction, leaves scope unchanged, and has high impact on confidentiality, integrity, and availability. Exploit code maturity is rated Unproven, the remediation level is Official Fix, and report confidence is Confirmed.  At original publication, the flaw had not been publicly disclosed or exploited. Microsoft assessed it as "Exploitation Less Likely." 

Patching SharePoint Against the RCE Flaw 

The fixes released on August 11 are listed below by edition: 

• Subscription Edition: KB 5002893, build 16.0.19725.20522 
• SharePoint Server 2019: KBs 5002894 and 5002896, build 16.0.10417.20198 
• SharePoint Enterprise Server 2016: KBs 5002905 and 5002906, build 16.0.5565.1001 

Microsoft advises customers to install every update offered for their software, in any order. It also confirms that the same KB number covers both SharePoint Server 2016 and SharePoint Enterprise Server 2016. 

How a CVE-2026-65660 Attack Could Unfold 

Threat analysts mapped the vulnerability onto a cloud kill chain. They rated initial compromise with high confidence. The remaining stages are rated medium confidence and inferred: 

• Privilege escalation through the SharePoint service context 
• Lateral movement across the farm and connected systems 
• Command and control via the webshell 
• Data exfiltration 
• Operational disruption 

A successful attack could expose sensitive organizational data, confidential documents, and user information. It could also disrupt SharePoint collaboration services. The overall confidence for this assessment is medium. 

Troy E. Meink’s comments were the first public acknowledgment of American weapons in orbit. The Pentagon has been preparing for potential conflict in space with Russia or China.

© Pool photo by Matt Rourke

The online retailer said it would “pause” its relationship with 21 Air, the cargo airline operating a Boeing 767 that overshot a runway in Miami.

© Joe Raedle/Getty Images

On the Windows side of the age verification question, Microsoft is obviously following trends among lawmakers the world over.

To address this, Windows is introducing a new platform capability: the Windows Age API. 

This API brings age awareness beyond the operating system by making it available across the entire Windows ecosystem so that apps and services can deliver age-appropriate experiences using the same trusted foundation. By making age awareness available as a platform capability, Windows helps developers build safeguards into experiences from the start rather than placing the burden on children and families to manage protections app by app. 

↫ Rob Mauceri at the Windows Blogs

Meanwhile, on the Linux side of things, there’s been some cheering as at least California passed amendments to its age verification law to exempt open source operating systems.

These amendments redefine the term “operating system provider” to exclude any person or entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” Any software distributed under the GPL, MIT, BSD, and Apache licenses satisfies that test, which removes the likes of Debian, Fedora, Ubuntu, Arch, and the BSD family from AB 1856’s scope.

↫ Luke James at Tom’s Hardware

I think this is not at all the good news that many make it out to be. Exempting Linux, BSD, and other open source operating systems from age verification obligations may seem like a good thing at first glance, but in reality, I think services and applications will simply choose to not work at all on platforms that do not implement age verification. The fear of legal ramifications, especially when it involves children, will be enough for existing and future popular services and applications to exclusively work on platforms that implement age verification – whether those fears are founded or not.

In fact, I’m fairly sure a company like Microsoft, which has actually been feeling the squeeze from the Linux side recently – even if it is modestly so – is quite happy to see open source operating systems excluded from these obligations. Google, too, is probably none too unhappy to see any possible open source mobile operating system competitors not implement age verification. The fear of missing out is real, and most people are not as invested in fighting big tech and government surveillance as the average OSNews reader is going to be. If using Linux means not being able to play the latest hit games or use that new successful service, people will choose to stick with Windows or macOS.

Let me be very clear that I do not support these age verification laws in any way, shape, or form, and I definitely do not want the open source world to embrace age verification. What I’m worried about is that the open source world will cheer on these exceptions and consider the battle won, when in reality, they feel more like Pyrrhic victories. Age verification laws must be fought and destroyed at ballot boxes the world over, because otherwise I fear they will become just another tool in big tech’s toolbox, exemptions or not.

Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it.

What’s worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we’re going to need to change the way we deal with security responses in open source.

Simon Willison comments:

Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe.

Attackers are exploiting an unpatched remote code execution flaw in Adobe Commerce and Magento Open Source to install persistent backdoors on e-commerce sites, Dutch security firm Sansec reported, with the first intrusions observed Sept. 4 and no vendor fix available as of Sept. 6.

Sansec's forensics team, in an advisory, named the flaw StyleSmuggler. No CVE identifier has been assigned. As of Sept. 7, Adobe's Magento security bulletin index listed no September advisory, and the flaw does not appear in CISA's Known Exploited Vulnerabilities catalog, leaving an unknown number of merchants exposed during a window in which working exploit traffic is already circulating.

Magento underpins a large share of mid-market online retail, and Adobe has sold it as Adobe Commerce since acquiring the platform in 2018. The codebase has been a durable target for payment-skimming crews: Sansec has tracked Magecart-style card theft against Magento storefronts for close to a decade, and the platform's checkout position makes any unauthenticated code execution flaw unusually valuable.

According to Sansec's analysis, StyleSmuggler is a two-stage chain that abuses the platform's GraphQL interface. Attackers first inject PHP code into files Magento writes on its own, such as failure reports, then trigger execution through the platform's "Payment Transaction Failed Reminder" email routine. Because the trigger fires when the reminder is generated, no recipient has to open the message for the payload to run.

The vulnerability was confirmed on Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The detail likely to unsettle merchants most is the first known victim: a store running 2.4.6-p15 with all available patches applied. Being current on Adobe's release cycle did not prevent compromise.

The implant Sansec documented is built to survive routine inspection. It runs under a process name mimicking a Linux kernel thread, [kworker/u:8:0], with the binary written to ~/.local/share/.gvfsd/gvfsd-user and a cron entry relaunching it every five minutes. Sansec also listed the domain 247.cdnflare.xyz among its indicators of compromise.

Sansec advised merchants to disable GraphQL where the storefront can tolerate it, disable the PHP proc_open function, and mount /tmp, /var/tmp and /dev/shm with the noexec option. Unofficial community patches have been published by Disrex Group, ProxiBlue and Graycore. Disrex said it independently identified two compromised stores and a third that was attacked without being breached.

Adobe's most recent scheduled Commerce bulletin, APSB26-92, was published Aug. 11 and addressed critical and important flaws across the 2.4.4 through 2.4.9 branches. The company's next scheduled security release is Sept. 8. Adobe did not appear to have commented publicly on StyleSmuggler.

Also read: Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento

In a long-awaited decision, a federal judge said Google must change its ad tech business to address antitrust issues, but did not disclose the measures.

© Lucia Vazquez for The New York Times

Regulators say the e-commerce giant forced more than a million advertisers to pay more than they should have. The company denies the claims.

© Vincent Alban/The New York Times

As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question than "should we adopt it" — it's "who's accountable when it goes wrong." To unpack this, The Cyber Express sat down with Harsha Reddy, Head of Information Security at Veterinary Emergency Group (VEG).

With nearly two decades in security leadership — including senior roles at Lixil and American Standard before joining VEG — Harsha brings a practitioner's view of where AI is genuinely changing the CISO's job, and where it's mostly just hype and shadow adoption.

Watch the Full Interview:

Harsha Reddy Explains Why AI Will Replace Tasks, Not Defenders

Harsha pushes back on the narrative that AI will hollow out security teams, pointing to Gartner research showing that while most fields are projected to lose jobs to AI, cybersecurity is expected to gain them. In his view, the technology is mainly absorbing the "toil" — log review, alert triage, evidence gathering — that keeps analysts from actually defending.

Also listen to S1 Episode: Awareness and Education at Young Age is the Answer to Cybersecurity Skill Gap

“It's the analyst who refuses to use AI that will get replaced by an analyst who uses it,” he says.

On adoption, Reddy points to a 2024 Microsoft-LinkedIn survey in which most executives called AI critical to their business, yet a majority had no formal plan and most had employees already bringing in their own tools. That gap, he argues, is why so many organizations are now dealing with AI-related data leaks. "Many organizations started onboarding AI like software when they should be onboarding it like staff." His fix isn't more restrictions — blocking AI just pushes it into the shadows — but guardrails, an internal AI enablement committee, and measuring actual business value instead of token consumption.

The conversation also digs into deepfake-driven fraud, why training employees to spot deepfakes is “a losing bet” at machine speed, and how he decides when to greenlight a new AI tool versus telling a business unit “not yet.”

The conversation closes with our newly introduced rapid-fire round "Express Shots" — Claude vs. ChatGPT, passkeys vs. passwords, and Reddy's prediction for the biggest cybersecurity threat of 2030.

💾

This is good:

Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography.

Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

WordPress has released security updates to address the wp2shell vulnerability, a critical flaw that allowed attackers to achieve remote code execution (RCE) on vulnerable sites using a single anonymous web request.   Unlike many previous attacks, this issue did not require plugins, authentication, or third-party code, making affected core installations particularly vulnerable. Security patches were released in WordPress 6.9.5 and 7.0.2. 

wp2shell Vulnerability Exposed Core WordPress Sites 

Tracked as CVE-2026-63030, the wp2shell vulnerability is described in the official WordPress release notes as a "REST API batch-route confusion and SQL injection" issue that can result in remote code execution. The flaw originates from the REST API batch endpoint located at /wp-json/batch/v1, or its legacy query-string alias ?rest_route=/batch/v1, allowing exploitation through a single anonymous web request.  The vulnerability was discovered by Adam Kues of Assetnote, an attack surface management division of Searchlight Cyber, through the WordPress HackerOne programme.   To provide defenders time to update their systems, Searchlight Cyber intentionally withheld technical exploitation details, stating, "Given the egregious nature of the flaw and to ensure defenders have adequate time, we are refraining from disclosing technical specifics at this juncture." 

Second SQL Injection Flaw Patched 

The same security release also fixed CVE-2026-60137, another critical SQL injection vulnerability. WordPress credited researchers TF1T, dtro, and haongo for reporting the issue. Unlike the wp2shell vulnerability, this flaw predates the latest release and was backported to WordPress 6.8.6. The wp2shell vulnerability only affects versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.  Severity ratings differ across security advisories. While WordPress classifies CVE-2026-63030 as "high severity," the corresponding GitHub Security Advisory (GHSA-ff9f-jf42-662q) labels it as Critical with a CVSS score of 7.5. Regardless of classification, both vulnerabilities require immediate patching because the wp2shell vulnerability can be exploited without authentication. 

Immediate Updates Recommended 

Powering around 40% of websites, WordPress responded by enabling forced automatic updates for affected versions, including WordPress 7.1 beta2, to secure pre-release installations. As of 17 July, there were no confirmed reports of active exploitation. However, security researchers warned that because WordPress is open source and patch-related code changes became publicly available immediately, proof-of-concept exploits could emerge within hours.  Administrators should verify that every internet-facing WordPress installation has successfully received the update, as some hosting environments disable automatic updates or lock websites to specific versions. Site owners can also check exposure using the public tool available at wp2shell.com. If immediate patching is not possible, temporarily blocking both REST API batch endpoints at the Web Application Firewall (WAF) level can reduce risk, although this should not replace installing the official update.  Security teams managing multiple WordPress websites should also monitor for spikes in anonymous web request traffic targeting batch endpoints, as the wp2shell vulnerability demonstrates how overlooked core features can introduce severe security risks. 

A newly disclosed security flaw, CVE-2026-42533, has revealed a critical Pre-Auth nginx vulnerability that could allow attackers to achieve reliable RCE (remote code execution) without authentication. The issue affects nginx versions 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline), while patched releases include 1.30.4 and 1.31.3. Affected NGINX Plus versions include R33-R36 (fixed in R36 P7) and 37.0.0.1-37.0.2.1 (fixed in 37.0.3.1).  According to the disclosure, the vulnerability stems from a missing save-and-restore mechanism for PCRE capture state within nginx's two-pass script evaluation engine. The flaw enables attackers to trigger a heap buffer overflow with attacker-controlled content and length, while also exposing heap pointers through an information leak that can defeat Address Space Layout Randomization (ASLR). Chaining both primitives enables reliable Pre-Auth nginx RCE. 

CVE-2026-42533 Impacts Multiple Configurations 

The advisory warns that deployments using map directives with regex patterns alongside regex capture sources, including location, server_name, rewrite, or if blocks, may be vulnerable. The issue depends on evaluation order, where regex capture references, such as $1 or named groups, are processed before a regex map variable.  Affected directives include proxy_set_header, proxy_method, proxy_pass, fastcgi_param, uwsgi_param, scgi_param, grpc_set_header, return, add_header, rewrite, set, root, alias, and access_log, among others. Both HTTP and stream modules are affected, and the vulnerable capture and map variables do not need to exist within the same directive. 

Technical Root Cause

The researcher explained that nginx evaluates expressions in two stages: a length calculation (LEN) pass followed by a value (VALUE) pass. During execution, regex map evaluation overwrites shared capture data stored in the request object. As a result, the LEN pass and VALUE pass can calculate different capture sizes, causing either a heap overflow or an information leak depending on the relative capture lengths.  The disclosure states that attackers can control both the overflow size and leaked data using ordinary HTTP requests, including request URIs, headers, and bodies. No credentials, client certificates, or unusual configuration beyond the vulnerable pattern are required.  Testing reportedly achieved 10 out of 10 successful exploitations on Ubuntu 24.04 using glibc 2.39 with ASLR enabled.

Mitigation and Disclosure

The researcher said recent fixes for CVE-2026-42945, CVE-2026-9256, CVE-2026-42055, and CVE-2026-48142 do not address CVE-2026-42533. Administrators are advised to upgrade immediately to nginx 1.30.4, 1.31.3, or the corresponding patched NGINX Plus releases.  Until systems are updated, defenders should audit configurations that combine regex captures with regex map variables in the same evaluation path. The researcher also released a static configuration scanner that identifies vulnerable configurations without exploiting them.  The initial report was submitted to F5 SIRT on May 17, 2026, with follow-up analyses covering additional variants, including cross-directive triggering and named capture clobbering. While a proof-of-concept exploit exists, the researcher said it will be withheld until users have sufficient time to apply patches, citing concerns over rapid exploitation following previous nginx vulnerability disclosures.