https://pwn.watch/s/devtools Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-22:Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Status: live, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-22:The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-21:GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-10-19:Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary. Mon, 19 Oct 2026 00:00:00 GMT critical Source: https://x.com/Pillar_sec/status/2112166888985722937 Status: live, patched https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-16:OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron. Fri, 16 Oct 2026 00:00:00 GMT high Source: https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file Status: live, partial https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-13:GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted. Tue, 13 Oct 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce gitlab-cve-2026-110264-regex-rce:2026-10-12:Prior critical regex patch released (separate CVE); some operators stopped there. Mon, 12 Oct 2026 00:00:00 GMT critical Status: live, patched https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-11:Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes. Sun, 11 Oct 2026 00:00:00 GMT high Source: https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html Status: live, partial https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-09:Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered. Fri, 09 Oct 2026 00:00:00 GMT high Source: https://socket.dev/blog/ghostaction-cloud-credentials Status: live, partial https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-10-08:Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration. Thu, 08 Oct 2026 00:00:00 GMT high Source: https://www.stepsecurity.io/blog/ghostaction-returns Status: live, partial https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-09-28:OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security. Mon, 28 Sep 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706 gitlab-community-edition-and-enterprise-edition-cve-2026-85706:2026-09-11:CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14). Fri, 11 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/jfrog-artifactory-cve-2026-42016 jfrog-artifactory-cve-2026-42016:2026-09-11:CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25). Fri, 11 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/jfrog-artifactory-cve-2026-82329 jfrog-artifactory-cve-2026-82329:2026-09-02:CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05). Wed, 02 Sep 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2026-08-31:2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4. Mon, 31 Aug 2026 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial https://pwn.watch/i/opencode-mcp-oauth-rce-windows opencode-mcp-oauth-rce-windows:2026-08-29:Pillar Security privately reports the flaw to Anomaly. Sat, 29 Aug 2026 00:00:00 GMT critical Source: https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Status: live, patched https://pwn.watch/i/jfrog-artifactory-cve-2026-66384 jfrog-artifactory-cve-2026-66384:2026-08-27:CISA added CVE-2026-66384 to the KEV catalog (due 2026-09-10). Thu, 27 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/gitea-gitea-cve-2026-60004 gitea-gitea-cve-2026-60004:2026-08-25:CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28). Tue, 25 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077 jetbrains-teamcity-cve-2026-63077:2026-08-05:CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08). Wed, 05 Aug 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/nx-nx-console-cve-2026-48027 nx-nx-console-cve-2026-48027:2026-05-27:CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10). Wed, 27 May 2026 00:00:00 GMT high Status: closed, patched https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Trivy compromise disclosed; Microsoft guidance published. Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain teampcp-trivy-checkmarx-supply-chain:2026-03:Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates). Sun, 01 Mar 2026 00:00:00 GMT critical Status: closed, patched https://pwn.watch/i/ghostaction-github-workflows-oct-2026 ghostaction-github-workflows-oct-2026:2025-09:GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.) Mon, 01 Sep 2025 00:00:00 GMT high Source: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/ Status: live, partial