A critical nginx vulnerability, 9.2 on CVSS, sat in the code for eighteen years. It was found not by a human but by an AI agent, and six hours were enough. The news comes with a number attached: 5.7 million servers on the internet.
Then two independent researchers run scanners over real nginx configurations from GitHub. The first looks at 1465 configs from 528 popular repositories and finds not a single vulnerable one in production. The second looks at 35633 configs and finds one, in an abandoned project from 2011.
Between "5.7 million" and "one out of thirty five thousand" the gap is tens of thousands of times. I built a test stand to work out which of them is right, and to check whether my own server is lying there open.
Short answer: both are right, because they count different things. Long answer below, with commands, logs, and a script that checks your config in a second.
What happened
