A claimed nginx chain turns the same rewrite-engine state mismatch into both an $args heap leak and a constrained heap overwrite, then avoids the ugly full-pointer problem with a two byte partial write. I would click for the operational details more than the headline, because the useful parts are the Debian-specific leak pivot, the limit_conn cleanup pointer target, and the crash notes that show where the exploit almost fell apart.