{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:29:01.080Z",
  "tag": {
    "id": "devtools",
    "label": "Dev tools & CI",
    "isStack": true,
    "url": "https://pwn.watch/t/devtools",
    "feed": "https://pwn.watch/t/devtools/feed.xml"
  },
  "counts": {
    "incidents": 24,
    "live": 3,
    "notFullyPatched": 1,
    "patched": 23
  },
  "incidents": [
    {
      "slug": "gitlab-cve-2026-110264-regex-rce",
      "title": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
      "json": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE (self-managed)",
      "tags": [
        "devtools",
        "gitlab",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-110264"
      ],
      "affectedVersions": [
        "All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1"
      ],
      "fixedVersions": [
        "19.5.1",
        "19.4.3",
        "19.3.6",
        "19.2.9",
        "19.1.9",
        "19.0.10",
        "18.11.13"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.",
      "xPost": null
    },
    {
      "slug": "storybook-dev-server-cve-2026-114125",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
      "json": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Storybook (dev server)",
      "tags": [
        "node",
        "npm",
        "devtools",
        "storybook",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-114125"
      ],
      "affectedVersions": [
        "storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19",
        "storybook >= 9.0.0 < 9.1.21",
        "storybook >= 10.0.0 < 10.6.2",
        "storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6",
        "@storybook/addon-vitest and @storybook/addon-mcp (matching ranges)"
      ],
      "fixedVersions": [
        "8.6.19",
        "9.1.21",
        "10.6.2",
        "11.0.0-alpha.6"
      ],
      "startedAt": "2026-10-21",
      "closedAt": "2026-10-22",
      "updatedAt": "2026-10-22T12:43:45.000Z",
      "summary": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.",
      "xPost": null
    },
    {
      "slug": "opencode-mcp-oauth-rce-windows",
      "title": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows",
      "json": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "OpenCode AI coding agent (Anomaly) on Windows and WSL",
      "tags": [
        "ai",
        "devtools",
        "windows",
        "opencode",
        "mcp"
      ],
      "cveIds": [],
      "affectedVersions": [
        "OpenCode 1.0.137 through 1.18.32 on Windows and WSL"
      ],
      "fixedVersions": [
        "OpenCode 1.18.33"
      ],
      "startedAt": "2026-10-19",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when they started the MCP OAuth sign-in. The server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on Sep 28 without a CVE or advisory, so scanners won't flag 1.0.137 through 1.18.32. macOS and Linux are not affected. Pillar Security found it and rates it 9.8; no in-the-wild exploitation reported.",
      "xPost": null
    },
    {
      "slug": "ghostaction-github-workflows-oct-2026",
      "title": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026",
      "json": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "GitHub repositories / GitHub Actions (compromised maintainer accounts)",
      "tags": [
        "github-actions",
        "devtools",
        "github",
        "vscode"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Repos where a compromised account pushed security-audit.yml / github_actions_security.yml (Oct 8-12 2026 wave), and repos with the tasks.json + public/fonts/fa-solid-400.woff2 second stage"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-08",
      "closedAt": null,
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.",
      "xPost": null
    },
    {
      "slug": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "title": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "json": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GitLab Community Edition and Enterprise Edition",
      "tags": [
        "devtools",
        "gitlab",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-85706"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.",
      "xPost": null
    },
    {
      "slug": "jfrog-artifactory-cve-2026-42016",
      "title": "JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "tags": [
        "devtools",
        "jfrog",
        "artifactory",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-42016",
        "CVE-2026-42018"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. CISA added CVE-2026-42016, CVE-2026-42018 to the Known Exploited Vulnerabilities catalog on 2026-09-11 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "jfrog-artifactory-cve-2026-82329",
      "title": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "tags": [
        "devtools",
        "jfrog",
        "artifactory",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-82329"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-02",
      "closedAt": "2026-09-02",
      "updatedAt": "2026-09-02",
      "summary": "JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02.",
      "xPost": null
    },
    {
      "slug": "jfrog-artifactory-cve-2026-66384",
      "title": "JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384",
      "json": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JFrog Artifactory",
      "tags": [
        "devtools",
        "jfrog",
        "artifactory",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-66384"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-27",
      "closedAt": "2026-08-27",
      "updatedAt": "2026-08-27",
      "summary": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27.",
      "xPost": null
    },
    {
      "slug": "gitea-gitea-cve-2026-60004",
      "title": "Gitea Gitea: Gitea Code Injection Vulnerability",
      "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004",
      "json": "https://pwn.watch/i/gitea-gitea-cve-2026-60004.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Gitea Gitea",
      "tags": [
        "devtools",
        "gitea",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-60004"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-25",
      "closedAt": "2026-08-25",
      "updatedAt": "2026-08-25",
      "summary": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-cve-2026-63077",
      "title": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077",
      "json": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ransomware",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-63077"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-05",
      "closedAt": "2026-08-05",
      "updatedAt": "2026-08-05",
      "summary": "JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05.",
      "xPost": null
    },
    {
      "slug": "nx-nx-console-cve-2026-48027",
      "title": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027",
      "json": "https://pwn.watch/i/nx-nx-console-cve-2026-48027.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Nx Nx Console",
      "tags": [
        "node",
        "devtools",
        "nx",
        "supply-chain",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-48027"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-27",
      "closedAt": "2026-05-27",
      "updatedAt": "2026-05-27",
      "summary": "Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.",
      "xPost": null
    },
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "tags": [
        "github-actions",
        "docker",
        "devtools",
        "github",
        "trivy",
        "checkmarx",
        "vscode",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.",
      "xPost": null
    },
    {
      "slug": "glassworm-vscode-openvsx-worm-october-2025",
      "title": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025",
      "json": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "VS Code extensions on OpenVSX and the VS Code Marketplace",
      "tags": [
        "devtools",
        "glassworm",
        "vscode",
        "openvsx",
        "supply-chain",
        "worm",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. CodeJoy 1.8.3/1.8.4, cline-ai-agent 3.1.3 (Microsoft marketplace) and several OpenVSX extensions (see Koi list)"
      ],
      "fixedVersions": [
        "Malicious releases removed from the marketplaces"
      ],
      "startedAt": "2025-10-17",
      "closedAt": "2025-10-31",
      "updatedAt": "2025-10-31",
      "summary": "Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.",
      "xPost": null
    },
    {
      "slug": "jenkins-cve-2017-1000353",
      "title": "Jenkins: Remote Code Execution Vulnerability",
      "url": "https://pwn.watch/i/jenkins-cve-2017-1000353",
      "json": "https://pwn.watch/i/jenkins-cve-2017-1000353.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Jenkins",
      "tags": [
        "java",
        "devtools",
        "jenkins",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2017-1000353"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-02",
      "closedAt": "2025-10-02",
      "updatedAt": "2025-10-02",
      "summary": "Jenkins contains a remote code execution vulnerability. This vulnerability that could allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blocklist-based protection mechanism. Added to CISA KEV on 2025-10-02.",
      "xPost": null
    },
    {
      "slug": "red-hat-consulting-gitlab-breach-october-2025",
      "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025",
      "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Red Hat Consulting self-managed GitLab",
      "tags": [
        "devtools",
        "red-hat",
        "gitlab",
        "crimson-collective",
        "shinyhunters",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-10-01",
      "closedAt": "2025-10-10",
      "updatedAt": "2025-10-10",
      "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.",
      "xPost": null
    },
    {
      "slug": "git-cve-2025-48384",
      "title": "Git: Link Following Vulnerability",
      "url": "https://pwn.watch/i/git-cve-2025-48384",
      "json": "https://pwn.watch/i/git-cve-2025-48384.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Git",
      "tags": [
        "devtools",
        "git",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-48384"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-08-25",
      "closedAt": "2025-08-25",
      "updatedAt": "2025-08-25",
      "summary": "Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files. Added to CISA KEV on 2025-08-25.",
      "xPost": null
    },
    {
      "slug": "reviewdog-action-setup-github-action-cve-2025-30154",
      "title": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154",
      "json": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "reviewdog action-setup GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "reviewdog",
        "github",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30154"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-24",
      "closedAt": "2025-03-24",
      "updatedAt": "2025-03-24",
      "summary": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.",
      "xPost": null
    },
    {
      "slug": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "title": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066",
      "json": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "tj-actions/changed-files GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "tj-actions",
        "reviewdog",
        "github",
        "coinbase",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30066"
      ],
      "affectedVersions": [
        "tj-actions/changed-files through 45.0.7 (tags repointed March 14-15, 2025)"
      ],
      "fixedVersions": [
        "46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)"
      ],
      "startedAt": "2025-03-14",
      "closedAt": "2025-03-20",
      "updatedAt": "2025-03-20",
      "summary": "Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "tags": [
        "devtools",
        "java",
        "jetbrains",
        "teamcity",
        "auth-bypass",
        "ci-cd",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-27198",
        "CVE-2024-27199"
      ],
      "affectedVersions": [
        "TeamCity On-Premises before 2023.11.4 (JetBrains)"
      ],
      "fixedVersions": [
        "2023.11.4 (JetBrains)"
      ],
      "startedAt": "2024-03-04",
      "closedAt": "2024-03-07",
      "updatedAt": "2024-03-07",
      "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "title": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "json": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Jenkins Command Line Interface (CLI)",
      "tags": [
        "devtools",
        "java",
        "jenkins",
        "ci-cd",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-23897"
      ],
      "affectedVersions": [
        "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)"
      ],
      "fixedVersions": [
        "Jenkins 2.442",
        "LTS 2.426.3",
        "LTS 2.440.1"
      ],
      "startedAt": "2024-01-24",
      "closedAt": "2024-08-19",
      "updatedAt": "2024-08-19",
      "summary": "Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "gitlab-ce-ee-cve-2023-7028",
      "title": "GitLab Community and Enterprise Editions Improper Access Control",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028",
      "json": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE",
      "tags": [
        "devtools",
        "ruby",
        "gitlab",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-7028"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-12",
      "closedAt": "2024-05-01",
      "updatedAt": "2024-05-01",
      "summary": "GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity On-Premises",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ci-cd",
        "auth-bypass",
        "rce",
        "north-korea",
        "apt29",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-42793"
      ],
      "affectedVersions": [
        "Before 2023.05.4 (NVD)"
      ],
      "fixedVersions": [
        "2023.05.4"
      ],
      "startedAt": "2023-09-18",
      "closedAt": "2023-12-13",
      "updatedAt": "2023-12-13",
      "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.",
      "xPost": null
    },
    {
      "slug": "github-rsa-ssh-host-key-exposed-2023",
      "title": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023",
      "json": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "GitHub (github.com SSH)",
      "tags": [
        "devtools",
        "github",
        "ssh",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-03-24",
      "closedAt": "2023-03-24",
      "updatedAt": "2023-03-24",
      "summary": "GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.",
      "xPost": null
    },
    {
      "slug": "circleci-security-incident-rotate-all-secrets-2023",
      "title": "CircleCI breach: rotate every secret",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023",
      "json": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "CircleCI",
      "tags": [
        "devtools",
        "circleci",
        "ci-cd",
        "secrets",
        "infostealer",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-01-04",
      "closedAt": "2023-01-13",
      "updatedAt": "2023-01-13",
      "summary": "Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "YorkDev",
      "handle": "YoDevp",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2108041001340112897/pVqNB6Ej_bigger.jpg",
      "text": "🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125.\n\nAfecta a Storybook 8, 9, 10 y 11 alpha.\nCorregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6.\n\nQué puede hacer un atacante 👇 https://t.co/fPN9ReSVRH",
      "date": "2026-10-22T12:43:45.000Z",
      "url": "https://x.com/YoDevp/status/2113249953879593338",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.\n\nFixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.\n\nWhat developers need to know: https://t.co/l6N4LCjhWt",
      "date": "2026-10-22T10:44:40.000Z",
      "url": "https://x.com/TheHackersNews/status/2113219984365359340",
      "media": [],
      "incident": "opencode-mcp-oauth-rce-windows"
    },
    {
      "authorName": "Tim Notes",
      "handle": "timwork_notes",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2107197400041340928/TMXhl773_bigger.jpg",
      "text": "localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run",
      "date": "2026-10-22T09:30:20.000Z",
      "url": "https://x.com/timwork_notes/status/2113201277933109352",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    },
    {
      "authorName": "Kenji",
      "handle": "inagakikenji",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1055736419061100545/e1Tz89g__bigger.jpg",
      "text": "米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… https://t.co/9RBiQlMg8N",
      "date": "2026-10-22T03:44:09.000Z",
      "url": "https://x.com/inagakikenji/status/2113114155519758377",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    },
    {
      "authorName": "flowers.engg",
      "handle": "flowersengg",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067629049481195520/xxkejAlq_bigger.jpg",
      "text": "patched self-managed GitLab on 12 Oct? patch again.\n\nthat release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range.\n\nfixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13",
      "date": "2026-10-21T23:57:03.000Z",
      "url": "https://x.com/flowersengg/status/2113057007309885672",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    },
    {
      "authorName": "Iván Pérez",
      "handle": "IvanPerezF_",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2100615087392215040/4ad0g2S8_bigger.jpg",
      "text": "Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto.\n\nGitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión.\n\nAfecta a todas las versiones",
      "date": "2026-10-21T20:26:51.000Z",
      "url": "https://x.com/IvanPerezF_/status/2113004107149512943",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    },
    {
      "authorName": "Threat Intelligence",
      "handle": "threatintel",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1696530233028161536/U_hdVndn_bigger.jpg",
      "text": "#ThreatProtection GhostAction now phishes open-source maintainers with fake GitHub sign-in alerts to steal credentials, 2FA codes and OAuth tokens. Read more about Symantec’s protection: https://t.co/GN7LOBQNZj",
      "date": "2026-10-14T07:22:43.000Z",
      "url": "https://x.com/threatintel/status/2110270059365191876",
      "media": [],
      "incident": "ghostaction-github-workflows-oct-2026"
    }
  ],
  "changes": [
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "The Hacker News reports the flaw; upgrade to 1.18.33, run `opencode mcp list`, and remove unvetted remote MCP servers.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "Pillar Security discloses the flaw publicly. Anomaly declined to request a CVE, saying user-configured MCP servers are outside its trust boundary.",
      "body": null,
      "sourceUrl": "https://x.com/Pillar_sec/status/2112166888985722937",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-16",
      "title": "OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron.",
      "body": null,
      "sourceUrl": "https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-13",
      "title": "GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Prior critical regex patch released (separate CVE); some operators stopped there.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-11",
      "title": "Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-09",
      "title": "Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered.",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ghostaction-cloud-credentials",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/ghostaction-returns",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-30",
      "title": "Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-28",
      "title": "OpenCode 1.18.33 ships the fix as a routine browser-launch refactor; release notes don't mention security.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "incidentTitle": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-42016",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-42016, CVE-2026-42018 to the KEV catalog (due 2026-09-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-42016"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-82329",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-02",
      "title": "CISA added CVE-2026-82329 to the KEV catalog (due 2026-09-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-82329"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-08-31",
      "title": "2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "opencode-mcp-oauth-rce-windows",
      "incidentTitle": "OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-29",
      "title": "Pillar Security privately reports the flaw to Anomaly.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html",
      "url": "https://pwn.watch/i/opencode-mcp-oauth-rce-windows"
    },
    {
      "incident": "jfrog-artifactory-cve-2026-66384",
      "incidentTitle": "JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-27",
      "title": "CISA added CVE-2026-66384 to the KEV catalog (due 2026-09-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jfrog-artifactory-cve-2026-66384"
    },
    {
      "incident": "gitea-gitea-cve-2026-60004",
      "incidentTitle": "Gitea Gitea: Gitea Code Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-25",
      "title": "CISA added CVE-2026-60004 to the KEV catalog (due 2026-08-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitea-gitea-cve-2026-60004"
    },
    {
      "incident": "jetbrains-teamcity-cve-2026-63077",
      "incidentTitle": "JetBrains TeamCity: JetBrains TeamCity Deserialization of Untrusted Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-05",
      "title": "CISA added CVE-2026-63077 to the KEV catalog (due 2026-08-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-cve-2026-63077"
    },
    {
      "incident": "nx-nx-console-cve-2026-48027",
      "incidentTitle": "Nx Nx Console: Nx Console Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-27",
      "title": "CISA added CVE-2026-48027 to the KEV catalog (due 2026-06-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nx-nx-console-cve-2026-48027"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "Wider coverage; Microsoft marketplace extension also affected",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    },
    {
      "incident": "glassworm-vscode-openvsx-worm-october-2025",
      "incidentTitle": "GlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible Unicode",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-17",
      "title": "Koi Security discloses GlassWorm on OpenVSX",
      "body": null,
      "sourceUrl": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace",
      "url": "https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-10",
      "title": "FINRA alert to member firms",
      "body": null,
      "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "jenkins-cve-2017-1000353",
      "incidentTitle": "Jenkins: Remote Code Execution Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-02",
      "title": "CISA added CVE-2017-1000353 to the KEV catalog (due 2025-10-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jenkins-cve-2017-1000353"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-02",
      "title": "Red Hat confirms the incident",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-01",
      "title": "Crimson Collective claims the Red Hat GitLab theft",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-09",
      "title": "GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.)",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "git-cve-2025-48384",
      "incidentTitle": "Git: Link Following Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-25",
      "title": "CISA added CVE-2025-48384 to the KEV catalog (due 2025-09-15).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/git-cve-2025-48384"
    },
    {
      "incident": "reviewdog-action-setup-github-action-cve-2025-30154",
      "incidentTitle": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-24",
      "title": "CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-20",
      "title": "tj-actions and reviewdog maintainers finish remediation",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-18",
      "title": "CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-15",
      "title": "GitHub removes the action, then restores a cleaned repository",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC)",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-11",
      "title": "Malicious commit pushed to reviewdog/action-setup v1 tag",
      "body": "Reverted about two hours later.",
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-19",
      "title": "CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-01",
      "title": "CISA added CVE-2023-7028 to the KEV catalog (federal deadline 2024-05-22)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-07",
      "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27198 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27199 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "CVE-2024-23897 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "Jenkins security advisory and fixed releases",
      "body": null,
      "sourceUrl": "https://www.jenkins.io/security/advisory/2024-01-24/",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-12",
      "title": "CVE-2023-7028 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-7028",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-13",
      "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "CISA adds CVE-2023-42793 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "github-rsa-ssh-host-key-exposed-2023",
      "incidentTitle": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-24",
      "title": "GitHub replaces its RSA SSH host key; users must update known_hosts",
      "body": null,
      "sourceUrl": "https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-13",
      "title": "Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/jan-4-2023-incident-report/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-04",
      "title": "CircleCI tells all customers to rotate every secret stored in CircleCI",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/january-4-2023-security-alert/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    }
  ]
}