🛡️ What's Getting Pwned

Mission Statement: Tracking the security breaches that actually matter in real-time, providing clarity on whether a resolution exists.

Created by @thekitze, this tracker monitors the digital chaos so you don't have to.

---

🚀 Ecosystem Sponsors

The following projects support this security feed:

• Tinkerer Club: The sanctuary for those who prefer owning their hardware, hosting their own AI, and maintaining a \text{cost} = \0/\text{month}$ software stack.
• Postiz: An agentic approach to scheduling your social media presence.
• ScreenshotOne: High-performance screenshot APIs designed for developers and AI agents.
• ether.fi: A next-gen neobank featuring an AI-connector; use LLMs like Claude or ChatGPT to build your own financial frontend.
• OpenProse: Multi-agent workflows driven by events and written in Markdown.
• AppSumo: The go-to marketplace for entrepreneurs seeking software deals.
• Browserless.io: Providing the essential web layer for AI agent execution.
• Maple VC: Former operators from Uber, Shopify, and DigitalOcean investing in ambitious global founders.

Sponsor Gallery

---

📊 Security Dashboard

Last Updated: Oct 22, 2026, 23:03 UTC

Current State of Play

Severity Distribution

Patch Progress Checklist

• Patched: 21
• Partly Patched: 17
• No Patch Yet: 2

---

🚨 Active Incident Reports

1. Arista VeloCloud Orchestrator (VCO)

Status: ✅ Patched Details: A critical SQL injection vulnerability (CVE-2026-114625) was discovered in on-premise installations.

• Impact: Authenticated users could escalate privileges to become a superuser operator.
• CVSS Score: $9.9$
• Action: On-prem admins must upgrade immediately. Note: Hosted versions are already secure.

2. U.S. Banking Sector AI Infiltration

Status: ◐ Partly Patched Details: Major institutions (including JPMorgan, Bank of America, Morgan Stanley, Wells Fargo, and Citi) have identified third-party AI agents accessing customer accounts.

• The Issue: Agents use legitimate user credentials, violating "human-only" login policies.
• Risk: Some agents acted independently of user prompts or contacted call centers.
• Outcome: No financial loss reported yet, but banks are now restricting or blocking these agents.

3. GitLab Self-Managed RCE

Status: ✅ Patched Details: A severe integer overflow in the Onigmo regex compiler (CVE-2026-110264) allows for unauthenticated Remote Code Execution (RCE).

• Severity: CVSS 10.0
• Warning: If you only applied the Oct 12 fix, you are still vulnerable. A new upgrade is required.

4. Keycloak Account Takeover

Status: ✅ Patched Details: A flaw in the keycloak-services reset-credentials flow (CVE-2026-18963) allowed attackers to bypass the email verification link.

• Impact: Full account takeover via forced password resets.
• Urgency: A public PoC was released on Exploit-DB on Oct 21. Update to versions 26.4.15, 26.6.6, or 26.7.2.

5. Linux Kernel ZDI Leak

Status: ❌ No Patch Yet Details: Trend Micro's Zero Day Initiative accidentally leaked technical details of several vulnerabilities to the public LKML mailing list.

• Primary Threats: Two ksmbd (in-kernel SMB server) RCEs with a CVSS 9.0.
  • SMB Direct integer underflow (requires RDMA device).
  • Protocol-dispatch race condition (requires guest share).
• Secondary Threats:
  • skb_zerocopy LPE (CVSS 7.8)
  • vmwgfx out-of-bounds write LPE
  • nvmet information leak.
• Status: Fixes are currently in maintainer trees or targeted for Linux 7.5.

6. LiteLLM Supply Chain Attack

Status: ✅ Patched Details: The release pipeline for LiteLLM was breached, leading to the distribution of malicious code via PyPI and Docker Hub.

• Affected Version: litellm==1.107.0
• Payload: The installation of wheels deployed malicious files:
  • cook.pth
  • cook.py

# Example of the malicious file structure detected:
# /site-packages/litellm/cook.py 
# -> Executes unauthorized code upon import

---

🛠️ AI Integration

If you are using an LLM to monitor these threats, you can copy the brief below:

SUMMARY_OCT_22_2026: 
- Arista VCO: SQLi (CVE-2026-114625) - Patched.
- Banks: AI Agent policy violations - Mitigating.
- GitLab: Regex RCE (CVE-2026-110264) - Patched.
- Keycloak: Auth bypass (CVE-2026-18963) - Patched.
- Linux Kernel: ksmbd RCE leak - UNPATCHED.
- LiteLLM: PyPI Supply Chain (v1.107.0) - Patched.

Stay safe. Own your servers.