Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents

Sep 23, 2026

0 new incidents, 1 with updates.

Updated

  • LivePatched

    Ruby 4.0.9, 3.4.12 and 3.3.13 fix Regexp compiler memory bugs behind GitLab's CVSS 10 RCEs

    Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.

    Ruby (CRuby / Onigmo regex engine)Since Oct 23, 2026

Sponsored

Buy sponsor slot · $149/mo