pwn.watch: incident updates

pwn.watch: incident updates https://pwn.watch/ Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 09:55:58 GMT [critical] eMudhra intermediate CA private keys compromised: Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://emudhra.we-have-a-problem.com/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-22:Recorded Future: some public PoCs are unreliable; full extent of successful compromise not yet established. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:Builds restored for Enterprise (by ~06:12 UTC) and Pro (06:29 UTC); Hobby, then Free/Trial to follow. Deploys still queued/slow as of 08:44 UTC. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:Railway publishes per-service remediation guides (AWS, GCP, GitHub, Stripe, OpenAI, Anthropic, Grok, OpenRouter, Postgres/MySQL/Redis/MongoDB credential rotation). Thu, 22 Oct 2026 00:00:00 GMT high Source: https://blog.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: CEO: builds ramping up overnight; full post-mortem promised. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-22:CEO: builds ramping up overnight; full post-mortem promised. Thu, 22 Oct 2026 00:00:00 GMT high Source: https://x.com/JustJake/status/2113126674103722181 Status: live, partial [critical] ConnectWise Cloud Backup shut down after M365 app-identity hijack: Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted. https://pwn.watch/i/connectwise-cloud-backup-m365-hijack connectwise-cloud-backup-m365-hijack:2026-10-21:Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ Status: live, partial [critical] eMudhra intermediate CA private keys compromised: eMudhra published statements; Node.js security release refreshed CA store. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:eMudhra published statements; Node.js security release refreshed CA store. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 Status: live, partial [critical] eMudhra intermediate CA private keys compromised: India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://x.com/ETNOWlive/status/2112914822019137966 Status: live, partial [critical] Fearless Wallet browser extension leaked private keys for ~20 months: Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost. https://pwn.watch/i/fearless-wallet-extension-key-leak fearless-wallet-extension-key-leak:2026-10-21:Polkadot Community Foundation publishes security notice (14:00 UTC); 8 users report 17,286 DOT lost. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058 Status: live, unpatched [critical] GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264): GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched. https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-21:GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] LiteLLM 1.107.0 PyPI/Docker supply-chain compromise: Malicious 1.107.0 wheels appear on PyPI. https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious 1.107.0 wheels appear on PyPI. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] LiteLLM 1.107.0 PyPI/Docker supply-chain compromise: Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC. https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T11:39Z:Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://docs.litellm.ai/blog/security-incident-oct-21-2026 Status: live, patched [critical] LiteLLM 1.107.0 PyPI/Docker supply-chain compromise: PyPI quarantines/pulls the package (~2h window). https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T13:23Z:PyPI quarantines/pulls the package (~2h window). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] LiteLLM 1.107.0 PyPI/Docker supply-chain compromise: Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier. https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T14:20Z:Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] LiteLLM 1.107.0 PyPI/Docker supply-chain compromise: LiteLLM posts containment update; investigation ongoing. https://pwn.watch/i/litellm-1-107-0-pypi-compromise litellm-1-107-0-pypi-compromise:2026-10-21T20:30Z:LiteLLM posts containment update; investigation ongoing. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): Security advisories and patched releases published on nginx.org. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:Security advisories and patched releases published on nginx.org. Wed, 21 Oct 2026 00:00:00 GMT medium Status: closed, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.31.8 mainline released. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:nginx 1.31.8 mainline released. Wed, 21 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Node.js published the Wednesday security releases and advisory. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Node.js published the Wednesday security releases and advisory. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Multiple PoCs seen from ~02:00 UTC; after the 14:00 UTC release AWS reports broad in-the-wild exploitation. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP project ships minimal source backports for 7.4 / 8.0 / 8.1 alongside the 8.2-8.5 releases. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.php.net/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Cloudflare deploys free default WAF rules (request + response signals) for all customers. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:Cloudflare deploys free default WAF rules (request + response signals) for all customers. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21/22:PoCs and broad exploitation attempts reported; some researchers claim additional post-patch paths remain on 8.5.12 (treat as uncertain). Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-21:PHP Foundation released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; CISA, CERT-EU, NSA/FBI-style guidance urged immediate patching or taking sites offline. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP Japan adds support-ticket information to the list of exposed data. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-21:PingCAP Japan adds support-ticket information to the list of exposed data. Wed, 21 Oct 2026 00:00:00 GMT high Source: https://pingcap.co.jp/trust-hub/security/security-update-october-2026/ Status: live, partial [critical] Plex2Shell: chained Plex Media Server RCE exploited for miners: CISA KEV warning; patch-by Oct 23 for federal agencies. https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-21:CISA KEV warning; patch-by Oct 23 for federal agencies. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched [high] Railway discloses unauthorized access to customer environment variables: Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Public security disclosure; deployments paused; users told to rotate all env vars and registry credentials. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Status page: investigating issues; builds paused (07:24 UTC), then dashboard/API/CLI unavailable (11:33 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:OAuth sessions invalidated as part of mitigation; users signed out (20:30 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://status.railway.com/ Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC). https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21:Railway posts 'urgent notice' on X; CEO says servers were compromised and urges key rotation (21:51-22:04 UTC). Wed, 21 Oct 2026 00:00:00 GMT high Source: https://x.com/Railway/status/2113025284148715845 Status: live, partial [high] Railway discloses unauthorized access to customer environment variables: Railway detects anomalous activity; investigates. https://pwn.watch/i/railway-env-var-security-disclosure railway-env-var-security-disclosure:2026-10-21 morning:Railway detects anomalous activity; investigates. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, partial [high] EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability: CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23). https://pwn.watch/i/eg-secure-solutions-siteguard-server-edition-cve-2026-106931 eg-secure-solutions-siteguard-server-edition-cve-2026-106931:2026-10-20:CISA added CVE-2026-106931 to the KEV catalog (due 2026-10-23). Tue, 20 Oct 2026 00:00:00 GMT high Status: live, patched [critical] eMudhra intermediate CA private keys compromised: Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-20:Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial [unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS: FoxIO blog + PoC published; several stacks still unpatched. https://pwn.watch/i/http3-qpack-header-accordions http3-qpack-header-accordions:2026-10-20:FoxIO blog + PoC published; several stacks still unpatched. Tue, 20 Oct 2026 00:00:00 GMT unknown Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-20:Embargo leaked; watchTowr confirmed the two CVEs publicly; PHP pre-announced an emergency release for Oct 21 14:00 UTC. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-20:FulcrumSec goes public with claims (10.6 TB, 180k orgs, 115k API keys) and a ~200 GB sample; Bitget says it held only public trade logs there. Tue, 20 Oct 2026 00:00:00 GMT high Source: https://cryptobriefing.com/bitget-no-user-data-tidb-cloud-breach/ Status: live, partial [critical] Plex2Shell: chained Plex Media Server RCE exploited for miners: CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-20:CISA adds CVE-2026-96652, -96654, -96655, -96656 to KEV (federal due dates Oct 23 for -96654/-96656, Nov 3 for -96652/-96655). Tue, 20 Oct 2026 00:00:00 GMT critical Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Status: live, patched [high] Siemens Software Center: Siemens Software Center Uncontrolled Search Path Element Vulnerability: CISA added CVE-2026-110936 to the KEV catalog (due 2026-11-03). https://pwn.watch/i/siemens-software-center-cve-2026-110936 siemens-software-center-cve-2026-110936:2026-10-20:CISA added CVE-2026-110936 to the KEV catalog (due 2026-11-03). Tue, 20 Oct 2026 00:00:00 GMT high Status: live, patched [critical] eMudhra intermediate CA private keys compromised: eMudhra revoked the eight intermediates; browsers continued emergency distrust. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-19:eMudhra revoked the eight intermediates; browsers continued emergency distrust. Mon, 19 Oct 2026 00:00:00 GMT critical Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-19:PingCAP publishes incident report; Japan notice cites up to ~50,000 personal records. Mon, 19 Oct 2026 00:00:00 GMT high Source: https://pingcap.co.jp/trust-hub/security/security-update-october-2026/ Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-18:Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla. Sun, 18 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:Amazon MadPot honeypot records a PHP2Shell exploit attempt from anonymized infrastructure, four days before disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Source: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ Status: live, partial [critical] PHP2Shell: critical unauthenticated RCE in PHP core: AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. https://pwn.watch/i/php2shell-cve-2026-109618-109619 php2shell-cve-2026-109618-109619:2026-10-17:AWS MadPot saw PHP2Shell exploitation attempts four days before public disclosure. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] Plex2Shell: chained Plex Media Server RCE exploited for miners: Honeypot exploitation (XMRig + proxy) observed. https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-17:Honeypot exploitation (XMRig + proxy) observed. Sat, 17 Oct 2026 00:00:00 GMT critical Status: live, patched [high] Fortinet Multiple Products: Fortinet Multiple Products Path Traversal Vulnerability: CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19). https://pwn.watch/i/fortinet-multiple-products-cve-2025-61624 fortinet-multiple-products-cve-2025-61624:2026-10-16:CISA added CVE-2025-61624 to the KEV catalog (due 2026-10-19). Fri, 16 Oct 2026 00:00:00 GMT high Status: live, patched [critical] Plex2Shell: chained Plex Media Server RCE exploited for miners: Public write-up. https://pwn.watch/i/plex2shell-cve-2026-96652 plex2shell-cve-2026-96652:2026-10-16:Public write-up. Fri, 16 Oct 2026 00:00:00 GMT critical Status: live, patched [high] Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability: CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18). https://pwn.watch/i/atlassian-multiple-products-cve-2026-21589 atlassian-multiple-products-cve-2026-21589:2026-10-15:CISA added CVE-2026-21589 to the KEV catalog (due 2026-10-18). Thu, 15 Oct 2026 00:00:00 GMT high Status: live, patched [critical] BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE): Public disclosure / Mandiant blog; CISA KEV Oct 16. https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764 beyondtrust-remote-support-cve-2026-102764:2026-10-15/16:Public disclosure / Mandiant blog; CISA KEV Oct 16. Thu, 15 Oct 2026 00:00:00 GMT critical Status: live, partial [high] Ahsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability: CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17). https://pwn.watch/i/ahsay-ahsaycbs-cve-2026-105134 ahsay-ahsaycbs-cve-2026-105134:2026-10-14:CISA added CVE-2026-105134, CVE-2026-105133 to the KEV catalog (due 2026-10-17). Wed, 14 Oct 2026 00:00:00 GMT high Status: live, patched [high] Cisco Secure Email Gateway: Cisco Secure Email Gateway Relative Path Traversal Vulnerability: CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17). https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76519 cisco-secure-email-gateway-cve-2026-76519:2026-10-14:CISA added CVE-2026-76519 to the KEV catalog (due 2026-10-17). Wed, 14 Oct 2026 00:00:00 GMT high Status: live, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-14:nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. Wed, 14 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched [high] Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability: CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17). https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0322 palo-alto-networks-pan-os-cve-2026-0322:2026-10-14:CISA added CVE-2026-0322 to the KEV catalog (due 2026-10-17). Wed, 14 Oct 2026 00:00:00 GMT high Status: live, patched [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-14:All identified compromised credentials invalidated and access paths blocked; four vulnerabilities found by IR firm fixed. Wed, 14 Oct 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [critical] PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Mainline merge / public write-ups. https://pwn.watch/i/pwnescape-cve-2026-99999 pwnescape-cve-2026-99999:2026-10-14/15:Mainline merge / public write-ups. Wed, 14 Oct 2026 00:00:00 GMT critical Status: live, patched [high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root: Ivanti discloses and patches CVE-2026-104935; Volexity publishes. https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-13:Ivanti discloses and patches CVE-2026-104935; Volexity publishes. Tue, 13 Oct 2026 00:00:00 GMT high Status: live, partial [high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root: CISA KEV listing; federal patching deadline reported as Oct 16. https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-13/16:CISA KEV listing; federal patching deadline reported as Oct 16. Tue, 13 Oct 2026 00:00:00 GMT high Status: live, partial [high] Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951): Microsoft ships patches; CISA KEV lists CVE-2026-96951. https://pwn.watch/i/windows-shell-cve-2026-96951-motw windows-shell-cve-2026-96951-motw:2026-10-13:Microsoft ships patches; CISA KEV lists CVE-2026-96951. Tue, 13 Oct 2026 00:00:00 GMT high Status: closed, patched [critical] GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264): Prior critical regex patch released (separate CVE); some operators stopped there. https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-12:Prior critical regex patch released (separate CVE); some operators stopped there. Mon, 12 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] Fearless Wallet browser extension leaked private keys for ~20 months: Last known period the exfiltration code was active (it could be re-enabled). https://pwn.watch/i/fearless-wallet-extension-key-leak fearless-wallet-extension-key-leak:2026-10-10:Last known period the exfiltration code was active (it could be re-enabled). Sat, 10 Oct 2026 00:00:00 GMT critical Source: https://forum.polkadot.network/t/security-notice-fearless-wallet-browser-extension-leaked-private-keys/19058 Status: live, unpatched [critical] BeyondTrust Remote Support zero-day CVE-2026-102764 (ARMORY CASTLE): BeyondTrust patches; SaaS auto-fixed. https://pwn.watch/i/beyondtrust-remote-support-cve-2026-102764 beyondtrust-remote-support-cve-2026-102764:2026-10-08/09:BeyondTrust patches; SaaS auto-fixed. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [high] Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181): Public write-ups and X discussion peak. https://pwn.watch/i/telegram-desktop-cve-2026-107181 telegram-desktop-cve-2026-107181:2026-10-08/10:Public write-ups and X discussion peak. Thu, 08 Oct 2026 00:00:00 GMT high Status: closed, patched [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: 0.5.144 published via the project’s release workflow. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08:0.5.144 published via the project’s release workflow. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08+:StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: PingCAP detects the intrusion and starts disabling credentials. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-10-07:PingCAP detects the intrusion and starts disabling credentials. Wed, 07 Oct 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [critical] PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Upstream IPv4 checksum guard accepted into net.git. https://pwn.watch/i/pwnescape-cve-2026-99999 pwnescape-cve-2026-99999:2026-10-07/08:Upstream IPv4 checksum guard accepted into net.git. Wed, 07 Oct 2026 00:00:00 GMT critical Status: live, patched [critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token: Malicious commits land on tensorlakeai/tensorlake main. https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-07:Malicious commits land on tensorlakeai/tensorlake main. Wed, 07 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286: Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA. https://pwn.watch/i/fortimail-cve-2026-104286 fortimail-cve-2026-104286:2026-10-05:Fortinet remediates FortiMail Cloud by updating all instances to 7.6.7 / 8.0.2 GA. Mon, 05 Oct 2026 00:00:00 GMT critical Source: https://www.fortiguard.com/psirt/FG-IR-26-175 Status: live, patched [high] Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability: CISA added CVE-2026-88779 to the KEV catalog (due 2026-10-07). https://pwn.watch/i/citrix-netscaler-cve-2026-88779 citrix-netscaler-cve-2026-88779:2026-10-04:CISA added CVE-2026-88779 to the KEV catalog (due 2026-10-07). Sun, 04 Oct 2026 00:00:00 GMT high Status: live, patched [high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root: Volexity sees UTA0576 chaining for unauth root. https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-03:Volexity sees UTA0576 chaining for unauth root. Sat, 03 Oct 2026 00:00:00 GMT high Status: live, partial [high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root: Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root. https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-03:Volexity: UTA0576 chains the auth bypass + RCE (CVE-2026-104935) with a still-unpatched privilege escalation for root. Sat, 03 Oct 2026 00:00:00 GMT high Source: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ Status: live, partial [high] Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability: CISA added CVE-2026-102490, CVE-2026-102489 to the KEV catalog (due 2026-10-05). https://pwn.watch/i/zammad-gmbh-zammad-cve-2026-102490 zammad-gmbh-zammad-cve-2026-102490:2026-10-02:CISA added CVE-2026-102490, CVE-2026-102489 to the KEV catalog (due 2026-10-05). Fri, 02 Oct 2026 00:00:00 GMT high Status: live, patched [high] Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root: Defused reports first signs of exploitation. https://pwn.watch/i/ivanti-connect-secure-cve-2026-104935 ivanti-connect-secure-cve-2026-104935:2026-10-01:Defused reports first signs of exploitation. Thu, 01 Oct 2026 00:00:00 GMT high Status: live, partial [critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286: Fortinet PSIRT FG-IR-26-175 patches and mitigations. https://pwn.watch/i/fortimail-cve-2026-104286 fortimail-cve-2026-104286:2026-10:Fortinet PSIRT FG-IR-26-175 patches and mitigations. Thu, 01 Oct 2026 00:00:00 GMT critical Status: live, patched [high] Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability: CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03). https://pwn.watch/i/cisco-catalyst-sd-wan-manager-cve-2026-76504 cisco-catalyst-sd-wan-manager-cve-2026-76504:2026-09-30:CISA added CVE-2026-76504 to the KEV catalog (due 2026-10-03). Wed, 30 Sep 2026 00:00:00 GMT high Status: closed, patched [critical] FortiMail unauthenticated file-write zero-day CVE-2026-104286: Active exploitation and CISA alerts begin circulating. https://pwn.watch/i/fortimail-cve-2026-104286 fortimail-cve-2026-104286:~2026-09-30/10-01:Active exploitation and CISA alerts begin circulating. Wed, 30 Sep 2026 00:00:00 GMT critical Status: live, patched [high] Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability: CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28). https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660 microsoft-sharepoint-cve-2026-65660:2026-09-25:CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched [high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). https://pwn.watch/i/wordpress-core-cve-2026-87902 wordpress-core-cve-2026-87902:2026-09-25:CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability : CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362 adobe-commerce-and-magento-cve-2026-71362:2026-09-24:CISA added CVE-2026-71362 to the KEV catalog (due 2026-09-27). Thu, 24 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Linux Kernel: Linux Kernel Race Condition Vulnerability: CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21). https://pwn.watch/i/linux-kernel-cve-2025-39964 linux-kernel-cve-2025-39964:2026-09-18:CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21). Fri, 18 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Cisco Identity Services Engine: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability: CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19). https://pwn.watch/i/cisco-identity-services-engine-cve-2026-76460 cisco-identity-services-engine-cve-2026-76460:2026-09-16:CISA added CVE-2026-76460 to the KEV catalog (due 2026-09-19). Wed, 16 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Google Pixel: Google Pixel Improper Authorization Vulnerability: CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19). https://pwn.watch/i/google-pixel-cve-2026-58704 google-pixel-cve-2026-58704:2026-09-16:CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19). Wed, 16 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181): Telegram Desktop 7.2.9 ships the fix. https://pwn.watch/i/telegram-desktop-cve-2026-107181 telegram-desktop-cve-2026-107181:2026-09-16:Telegram Desktop 7.2.9 ships the fix. Wed, 16 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability: CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17). https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461 cisco-secure-email-gateway-cve-2026-76461:2026-09-14:CISA added CVE-2026-76461 to the KEV catalog (due 2026-09-17). Mon, 14 Sep 2026 00:00:00 GMT high Status: closed, patched [high] ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability: CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14). https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869 connectwise-screenconnect-cve-2026-84869:2026-09-11:CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14). Fri, 11 Sep 2026 00:00:00 GMT high Status: closed, patched [high] GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability: CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14). https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706 gitlab-community-edition-and-enterprise-edition-cve-2026-85706:2026-09-11:CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14). Fri, 11 Sep 2026 00:00:00 GMT high Status: closed, patched [high] JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability: CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25). https://pwn.watch/i/jfrog-artifactory-cve-2026-42016 jfrog-artifactory-cve-2026-42016:2026-09-11:CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25). Fri, 11 Sep 2026 00:00:00 GMT high Status: closed, patched [high] MikroTik RouterOS: MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability: CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the KEV catalog (due 2026-09-13). https://pwn.watch/i/mikrotik-routeros-cve-2026-86060 mikrotik-routeros-cve-2026-86060:2026-09-10:CISA added CVE-2026-86060, CVE-2026-67277, CVE-2026-67279 to the KEV catalog (due 2026-09-13). Thu, 10 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using: CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12). https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew:2026-09-09:CISA added CVE-2026-20079 to the KEV catalog (due 2026-09-12). Wed, 09 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability: CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12). https://pwn.watch/i/citrix-netscaler-cve-2026-19490 citrix-netscaler-cve-2026-19490:2026-09-09:CISA added CVE-2026-19490 to the KEV catalog (due 2026-09-12). Wed, 09 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Fortinet Multiple Products: Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability: CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12). https://pwn.watch/i/fortinet-multiple-products-cve-2025-25249 fortinet-multiple-products-cve-2025-25249:2026-09-09:CISA added CVE-2025-25249 to the KEV catalog (due 2026-09-12). Wed, 09 Sep 2026 00:00:00 GMT high Status: closed, patched [high] PingCAP / TiDB Cloud breach: stolen service-account credentials, data and source code taken: Unauthorized access with stolen service-account credentials begins. https://pwn.watch/i/pingcap-tidb-cloud-breach pingcap-tidb-cloud-breach:2026-09-09:Unauthorized access with stolen service-account credentials begins. Wed, 09 Sep 2026 00:00:00 GMT high Source: https://www.pingcap.com/trust-hub/security/security-update-october-2026/ Status: live, partial [high] Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability: CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650 adobe-commerce-and-magento-cve-2026-75650:2026-09-08:CISA added CVE-2026-75650 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Microsoft Windows: Microsoft Windows Link Following Vulnerability: CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22). https://pwn.watch/i/microsoft-windows-cve-2026-81963 microsoft-windows-cve-2026-81963:2026-09-08:CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] N-able N-central: N-able N-central Static Code Injection Vulnerability: CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11). https://pwn.watch/i/n-able-n-central-cve-2026-86218 n-able-n-central-cve-2026-86218:2026-09-08:CISA added CVE-2026-86218 to the KEV catalog (due 2026-09-11). Tue, 08 Sep 2026 00:00:00 GMT high Status: closed, patched [high] BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability: CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16). https://pwn.watch/i/berriai-litellm-cve-2026-59822 berriai-litellm-cve-2026-59822:2026-09-02:CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched [high] JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability: CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05). https://pwn.watch/i/jfrog-artifactory-cve-2026-82329 jfrog-artifactory-cve-2026-82329:2026-09-02:CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability: CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05). https://pwn.watch/i/kestra-kestra-oss-cve-2026-49869 kestra-kestra-oss-cve-2026-49869:2026-09-02:CISA added CVE-2026-49869 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched [high] Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability: CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05). https://pwn.watch/i/sangoma-switchvox-cve-2026-9586 sangoma-switchvox-cve-2026-9586:2026-09-02:CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched [high] SonicWall SMA1000 Appliances: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability: CISA added CVE-2026-83548, CVE-2026-83549 to the KEV catalog (due 2026-09-05). https://pwn.watch/i/sonicwall-sma1000-appliances-cve-2026-83548 sonicwall-sma1000-appliances-cve-2026-83548:2026-09-02:CISA added CVE-2026-83548, CVE-2026-83549 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched