What's Getting Pwned

Ongoing security incidents, newest first: CVEs, what's affected, which versions fix it, and the advisories and posts behind each one.

17 incidents still unpatched · longest quiet streak: 11 days (Jan 2–Jan 12)

copy instructions for agent

brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

get notified

criticallive✓patchedsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTC

GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)

› GitLab CE/EE (self-managed)

GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.

Dev tools & CI

GitLab

RCE

criticallive✕unpatchedsince Oct 21, 2026updated Oct 22, 2026, 16:32 UTC

Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)

› Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet

On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.

Linux

ksmbd

ZDI

RCE

criticallive✓patchedsince Oct 21, 2026updated Oct 22, 2026, 16:00 UTC

LiteLLM 1.107.0 PyPI/Docker supply-chain compromise

› LiteLLM (PyPI + official Docker/GHCR images)

On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.

Python

PyPI

Docker

AI / LLM tooling

LiteLLM

Supply chain

highlive◐partial fixsince Oct 21, 2026updated Oct 22, 2026, 15:59 UTC

ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)

› ISC BIND 9 (named) DNS server

ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.

Linux

BIND

DNS

RCE

highlive✓patchedsince Oct 21, 2026updated Oct 22, 2026, 11:18 UTC

Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)

› Node.js

On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.

Node.js

#eMudhra

TLS

RCE

highlive◐partial fixsince Oct 21, 2026updated Oct 22, 2026, 16:32 UTC

Railway discloses unauthorized access to customer environment variables

› Railway (hosted platform)

On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Railway says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and asked upstream providers to revoke keys. Builds were paused platform-wide for ~a day; on Oct 22 they were restored for Enterprise and Pro, with Hobby/Free/Trial still pending. All users are told to rotate secrets while scoping continues.

Cloud & hosting

Railway

criticallive✓patchedsince Oct 20, 2026updated Oct 22, 2026, 15:19 UTC

Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)

› Signal (RingRTC calling library, @signalapp/ringrtc)

A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.

Rust

npm

iOS

Android

Signal

▶Oct 20highEG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability✓patched› EG Secure Solutions SiteGuard Server Edition ✓patched

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. Added to CISA KEV on 2026-10-20.

› Onamae Desktop Cloud (GMO Internet) ◐partial fix

GMO Internet’s Japanese VPS service Onamae Desktop Cloud said an attacker installed malicious programs in customer environments, forcing shutdown of as many as ~26,739 servers with no immediate restart date (mid-October 2026 reporting).

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. Added to CISA KEV on 2026-10-20.

› HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

Go

Rust

Python

Cloudflare

HTTP/3

criticallive✓patchedsince Oct 19, 2026updated Oct 22, 2026, 16:00 UTC

OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)

› OpenCode AI coding agent (Anomaly) on Windows and WSL

A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.

AI / LLM tooling

Dev tools & CI

Windows

OpenCode

MCP

criticallive◐partial fixsince Oct 18, 2026updated Oct 22, 2026, 16:32 UTC

eMudhra intermediate CA private keys compromised

› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores

Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.

TLS

criticallive◐partial fixsince Oct 17, 2026updated Oct 22, 2026, 16:32 UTC

ConnectWise Cloud Backup shut down after M365 app-identity hijack

› ConnectWise Cloud Backup / Microsoft 365 app identity

ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.

Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.

PHP

Apache

CISA KEV

RCE

highlive◐partial fixsince Oct 17, 2026updated Oct 22, 2026, 16:32 UTC

OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys

› OpenCode Console (hosted service by Anomaly)

On the night of Oct 16 2026 an intruder reached a legacy OpenCode Console system that was being decommissioned and may have exposed third-party AI provider keys saved in Console workspaces. OpenCode says 1.4% of Console users (those with external providers linked) were affected and tied it to a large-scale distillation attack. Users reported unauthorized charges up to ~$1,700 and some Google Cloud project suspensions. Anthropic and Google revoked/blocked exposed keys; OpenAI refunded drawn credits. The OpenCode app itself (local keys) was not affected.

AI / LLM tooling

OpenCode

Data breach

criticallive✓patchedsince Oct 16, 2026updated Oct 22, 2026, 11:20 UTC

Plex2Shell: chained Plex Media Server RCE exploited for miners

› Plex Media Server

Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.

Plex

CISA KEV

RCE

▶Oct 16highFortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability✓patched› Fortinet Multiple Products ✓patched

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. Added to CISA KEV on 2026-10-16.

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated