{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed · updates",
  "home_page_url": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026",
  "feed_url": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026/feed.json",
  "description": "Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more.",
  "language": "en",
  "_pwn": {
    "slug": "luanti-contentdb-breach-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-27-cf5ef947",
      "url": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-27-cf5ef947",
      "title": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: Luanti discloses the incident and tells users to change reused passwords, watch for phishing posing as Luanti, and recheck anything downloaded from ContentDB between Oct 22 and Oct 26 against upstream sources or the unofficial mirror. ContentDB stays offline for a week or more.",
      "content_text": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: Luanti discloses the incident and tells users to change reused passwords, watch for phishing posing as Luanti, and recheck anything downloaded from ContentDB between Oct 22 and Oct 26 against upstream sources or the unofficial mirror. ContentDB stays offline for a week or more.\n\nSource: https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-26-aa6a1d98",
      "url": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-26-aa6a1d98",
      "title": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: The attacker gains command execution inside the ContentDB server container (from 00:15 UTC), with full access to the database, redis, secrets and uploads. Luanti discovers the break-in at 09:00 UTC, takes ContentDB offline and revokes all secrets, sessions, API tokens and GitHub OAuth tokens.",
      "content_text": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: The attacker gains command execution inside the ContentDB server container (from 00:15 UTC), with full access to the database, redis, secrets and uploads. Luanti discovers the break-in at 09:00 UTC, takes ContentDB offline and revokes all secrets, sessions, API tokens and GitHub OAuth tokens.\n\nSource: https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-22-9a775b1e",
      "url": "https://pwn.watch/i/luanti-contentdb-breach-oct-2026#2026-10-22-9a775b1e",
      "title": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: From 13:00 UTC the attacker has access to ContentDB internal configuration and signs into a staff account. At 17:35 UTC Luanti coincidentally patches one of the two exploited vulnerabilities, not yet knowing it was exploited.",
      "content_text": "Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed: From 13:00 UTC the attacker has access to ContentDB internal configuration and signs into a staff account. At 17:35 UTC Luanti coincidentally patches one of the two exploited vulnerabilities, not yet knowing it was exploited.\n\nSource: https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://blog.luanti.org/2026/10/27/contentdb-security-incident/",
      "tags": [
        "medium"
      ]
    }
  ]
}