Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

Plausible

Security incidents tagged Plausible. Newest first.

1 Plausible incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
1
Days without an incident
1
Longest quiet run: 1 day (Oct 25–Oct 25)
All tags →
  • Patched

    Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts

    From Oct 24 2026 a Brazilian Magecart group appended a card skimmer to the Plausible analytics tracker hosted on Convertr's own server. Convertr runs the online stores and checkout for dozens of Brazilian fashion brands, and every checkout.convertr page loaded that file, so card numbers, expiry dates, CVVs, cardholder names and CPF numbers were sent to the attacker. Sansec suspects the entry point was CVE-2026-8467 in Convertr's never-updated Plausible Community Edition 3.0 (unconfirmed). Convertr removed the skimmer and upgraded Plausible on Oct 27.

    Convertr e-commerce checkout (self-hosted Plausible CE tracker)Since Oct 24, 2026

Posts 1

Sponsored

Buy sponsor slot · $149/mo