pwn.watch: Rust incident updates https://pwn.watch/s/rust Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT [critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380): No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. https://pwn.watch/i/signal-ringrtc-cve-2026-113380 signal-ringrtc-cve-2026-113380:2026-10-22:No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/ Status: live, patched [critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380): SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. https://pwn.watch/i/signal-ringrtc-cve-2026-113380 signal-ringrtc-cve-2026-113380:2026-10-22:SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/ Status: live, patched [critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380): Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins. https://pwn.watch/i/signal-ringrtc-cve-2026-113380 signal-ringrtc-cve-2026-113380:2026-10-21:Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528 Status: live, patched [critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380): CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0. https://pwn.watch/i/signal-ringrtc-cve-2026-113380 signal-ringrtc-cve-2026-113380:2026-10-20:CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0. Tue, 20 Oct 2026 00:00:00 GMT critical Source: https://www.cve.org/CVERecord?id=CVE-2026-113380 Status: live, patched [unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS: FoxIO blog + PoC published; several stacks still unpatched. https://pwn.watch/i/http3-qpack-header-accordions http3-qpack-header-accordions:2026-10-20:FoxIO blog + PoC published; several stacks still unpatched. Tue, 20 Oct 2026 00:00:00 GMT unknown Status: live, partial [critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380): Signal quietly fixes the bug in RingRTC 2.72.0 (commit "Ensure calls terminate completely in corner cases"), about six weeks before disclosure. https://pwn.watch/i/signal-ringrtc-cve-2026-113380 signal-ringrtc-cve-2026-113380:2026-09-04:Signal quietly fixes the bug in RingRTC 2.72.0 (commit "Ensure calls terminate completely in corner cases"), about six weeks before disclosure. Fri, 04 Sep 2026 00:00:00 GMT critical Source: https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3 Status: live, patched [unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3. https://pwn.watch/i/http3-qpack-header-accordions http3-qpack-header-accordions:2025-11 → 2026-07:Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3. Sat, 01 Nov 2025 00:00:00 GMT unknown Status: live, partial