Top stories

pwn.watch is a live security-incident tracker listing 236 incidents from the previous 12 months, including 37 current incidents, 16 rated critical and 18 not fully patched. Its tracker showed no incident-free days as of Oct. 22, 2026; its longest quiet period was 11 days, from Jan. 2 through Jan. 12. The latest entries include patches for an actively exploited CVSS 9.9 SQL-injection flaw in on-premises Arista VeloCloud Orchestrator and a CVSS 10.0 unauthenticated remote-code-execution flaw affecting self-managed GitLab CE/EE versions since 7.0. Linux kernel vulnerability reports containing technical reproduction details were inadvertently sent to public mailing lists before fixes were available, including two ksmbd remote-code-execution bugs rated CVSS 9.0 by Trend Micro’s Zero Day Initiative. LiteLLM’s release pipeline was compromised on Oct. 21, briefly publishing a malicious PyPI package and compromised container tags designed to steal credentials and install a remote-code loader. The tracker also reports alleged third-party AI agents operating in U.S. bank customer accounts, a Railway incident that may have exposed customer environment variables, and a Zeabur breach exposing about 3.22 million environment-variable records. Other listed incidents include actively exploited PHP, Plex, Ivanti, FortiMail and BeyondTrust vulnerabilities, plus a Capcom ID breach affecting 11.77 million email-address records.