// live feed
What's getting pwned right now
Ongoing security incidents, most severe first: CVEs, what's affected, which versions fix it, and the advisories and posts behind each one.
- live
- 13
- critical
- 9
- not fully patched
- 7
- criticallivepartial fixsince Oct 18, 2026
eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
CVE-2026-111943 - criticallivepatchedsince Oct 21, 2026
GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
› GitLab CE/EE (self-managed)
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
CVE-2026-110264 - criticallivepatchedsince Oct 21, 2026
LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
› LiteLLM (PyPI + official Docker/GHCR images)
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
MAL-2026-2144 - criticallivepartial fixsince Oct 17, 2026
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026; exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
CVE-2026-109618CVE-2026-109619 - criticallivepatchedsince Oct 16, 2026
Plex2Shell: chained Plex Media Server RCE exploited for miners
› Plex Media Server
Four Plex Media Server flaws (CVE-2026-96652/96654/96655/96656), together called Plex2Shell, chain to unauthenticated admin-token theft and code execution. Researcher Zach Main published details Oct 16 and a PoC shortly after; exploitation of internet-facing servers (cryptominers + residential proxies) began by Oct 17. Fixed in 1.43.3.10861 (released earlier in August); CISA added the chain to KEV with a federal deadline of Oct 23.
CVE-2026-96652CVE-2026-96654CVE-2026-96655CVE-2026-96656 - criticallivepartial fixsince Aug 29, 2026
BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE)
› BeyondTrust Remote Support (formerly Bomgar)
China-nexus actor ARMORY CASTLE (ex-UNC5221) exploited CVE-2026-102764, a critical unauthenticated file-operations flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. BeyondTrust issued BT26-05-RS; SaaS was auto-patched by Oct 9; CISA added the CVE to KEV on Oct 16. Self-hosted appliances need the patch plus forensics — patching alone does not clear existing footholds (SAWFLY / BARECLAW).
CVE-2026-102764 - criticallivepatchedsince Oct 8, 2026
PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)
› Linux kernel networking (host side of KVM/Firecracker and similar)
Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.
CVE-2026-99999 - criticallivepartial fixsince Oct 7, 2026
tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
› tensorlake (npm)
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
GHSA-8g63-53c9-65j2 - criticallivepatchedsince Sep 30, 2026
FortiMail unauthenticated file-write zero-day CVE-2026-104286
› Fortinet FortiMail
Fortinet FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write via path traversal / null-byte issues in Identity-Based Encryption web flows. CISA confirmed active exploitation and ordered federal mitigation; Fortinet published FG-IR-26-175 with patches and interim mitigations (disable IBE / restrict admin/webmail).
CVE-2026-104286 - highlivepatchedsince Oct 21, 2026
Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069+6 more - highlivepartial fixsince Oct 21, 2026
Railway discloses unauthorized access to customer environment variables
› Railway (hosted platform)
On Oct 21 2026 Railway reported anomalous activity on systems storing customer environment variables. An unauthorized third party may have accessed encrypted env vars and, for some, obtained decrypted contents (API keys, DB/registry credentials). Deployments were paused; Railway recommended that all users rotate secrets while impact scoping continues.
- highlivepartial fixsince Oct 1, 2026
Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
› Ivanti Connect Secure (ICS)
Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.
CVE-2026-104935 - mediumlivepartial fixsince Oct 20, 2026
HTTP/3 QPACK “Header Accordions” memory-amplification DoS
› HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
CVE-2025-64702CVE-2026-12523CVE-2025-13945