// archive
Past incidents
Closed incidents, most recently closed first.
## 16 incidents in the last year
through Oct 22, 2026- highclosedpatchedclosed Oct 21, 2026
nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)
› nginx
nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.
CVE-2026-15176CVE-2026-93479CVE-2026-95101CVE-2026-97629+1 more - highclosedpatchedclosed Oct 13, 2026
Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)
› Microsoft Windows Shell (and related Oct Patch Tuesday components)
Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.
CVE-2026-96951CVE-2026-108398CVE-2026-92707 - highclosedpatchedclosed Sep 16, 2026
Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)
› Telegram Desktop
CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.
CVE-2026-107181
