pwn.watch: A Live Feed of 234 Security Incidents in 12 Months and the October 2026 Vulnerability Wave
pwn.watch is a live security incident feed that lists ongoing vulnerabilities newest-first, and its snapshot from late October 2026 shows 36 live incidents (15 rated critical, 18 not fully patched) out of 234 incidents logged in the previous 12 months. The feed is notable less for any single CVE than for the pattern it exposes: a single week in October 2026 produced a CVSS 10.0 GitLab remote code execution, an unauthenticated Linux kernel leak to a public mailing list, a supply-chain compromise of an AI gateway library, and a wave of credential thefts at AI-adjacent hosting platforms.
What pwn.watch actually is
pwn.watch is a web feed of ongoing security incidents. Each entry names the affected product, the CVE or advisory ID, which versions fix the problem, and links to the underlying vendor advisory or reporting. The site carries three counters at the top: live incidents, critical incidents, and incidents that are not fully patched. Its own footer states: "Not security advice. Always check the vendor advisory before acting."
The site exposes machine-readable endpoints alongside the human-readable page: an RSS feed, a JSON file at /incidents.json, and an llms.txt file, plus an email notification option for new major incidents. It also publishes a heatmap of incident volume by severity over time.
The project is a one-person effort published quickly. Its author, known on Hacker News as thekitze, described it directly:
thanks for sharing!! i vibeslopped this in the middle of doing 1389418934 security tasks today out of panic. i will clean up the design and make it better :)
The October 2026 cluster was the densest run in the feed
October 21, 2026 alone carried multiple critical entries, prompting one commenter to remark, "what a wonderful day october 21 has been." The individual incidents were unrelated technically but arrived together, which is exactly the pattern the site is built to surface.
GitLab: CVSS 10.0 unauthenticated RCE (CVE-2026-110264)
GitLab shipped a critical patch on October 21, 2026 for CVE-2026-110264, an integer overflow in the bundled Onigmo regex compiler that allows an unauthenticated attacker to execute code on self-managed GitLab. It scores CVSS 10.0, and every CE/EE version back to 7.0 from 2014 is in range. Instances that had already applied the October 12 regex fix remained vulnerable and had to upgrade again.
PHP2Shell: unauthenticated RCE in PHP core
Two critical PHP core remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 and collectively called "PHP2Shell," were disclosed early after an embargo leak. Both score CVSS 9.2 and allow an unauthenticated attacker to run code on servers handling PHP web requests, with Apache mod_php especially exposed. Patches shipped October 21, 2026, but appliance vendors such as QNAP were still preparing fixes, and exploitation attempts were observed both before and after the patch.
Next.js: two unauthenticated RCEs in an out-of-band release
Vercel shipped Next.js 16.4.1 and 15.5.28 on October 14, 2026 with two critical unauthenticated RCE fixes that had been held back from the September release. CVE-2026-96889 / GHSA-2464-fhr4-w9xw is a use-after-free in librsvg reached through sharp via the Image Optimization API when SVGs are processed on glibc-based Linux. GHSA-673q-mjm6-r5xr is an RCE in App Router applications with Cache Components when a use cache function returns multiple typed arrays. No known exploitation was reported at the time of the entry.
Linux kernel: unpatched ZDI reports leaked to a public mailing list
On October 21, 2026, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but carbon-copied the public linux-kernel and subsystem lists, making full technical detail, including code paths and KASAN traces, public before any fix shipped. The worst items are two ksmbd remote code execution bugs ZDI scores at CVSS 9.0: an SMB Direct integer underflow requiring an RDMA device and a writable share, and a protocol-dispatch race requiring a guest share. Also leaked were an skb_zerocopy local privilege escalation at CVSS 7.8, a vmwgfx out-of-bounds write LPE, and an nvmet information leak. No CVEs existed yet, and only machines running ksmbd were exposed to the RCEs.
Other networking and enterprise fixes in the same window
- ISC BIND 9 CVE-2026-94300 (CVSS 8.1) lets an attacker who captures a GSS-TSIG signed UDP message replay it while the negotiated key is valid and, combined with crafted queries to a zone they control, potentially achieve remote code execution or at least crash named. Affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26; fixes landed in 9.20.30 and 9.21.27, with no 9.18 fix listed.
- Node.js shipped security updates for 22.x, 24.x and 26.x on October 21, 2026, fixing ten vulnerabilities. The headline item is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable RCE when attacker-controlled Brotli data is decoded. The same release fixed TLS hostname and IP bypasses and DNS NUL truncation, and refreshed the bundled CA store for the eMudhra incident.
- Plex2Shell, a chain of four Plex Media Server flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), enables unauthenticated admin-token theft and code execution. Public exploitation of internet-facing servers, for cryptominers and residential proxies, began by October 17. The fix shipped in 1.43.3.10861.
- PwnEscape, CVE-2026-99999 (CVSS 9.3), is a Linux networking guest-to-host escape found during Vercel's $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host memory disclosure and, in lab conditions, guest-to-host code execution on KVM and Firecracker.
- FortiMail CVE-2026-104286 (CVSS 9.8) is an unauthenticated arbitrary file write through path traversal and null-byte issues in Identity-Based Encryption web flows, with CISA confirming active exploitation. Ivanti Connect Secure CVE-2026-104935 was chained by threat actor UTA0576 to gain unauthenticated root on fully patched appliances between roughly October 1 and 3, 2026. BeyondTrust Remote Support CVE-2026-102764 was exploited as a zero-day by a China-nexus actor and added to CISA's KEV catalog on October 16.
AI tooling and AI-adjacent hosting is now the softest target
A striking share of the October 2026 entries involve AI infrastructure rather than traditional enterprise software. pwn.watch tags them with an "AI / LLM tooling" category, and the pattern holds across package registries, hosted platforms and coding agents.
LiteLLM 1.107.0 PyPI and Docker compromise
On October 21, 2026, attackers compromised LiteLLM's release pipeline and published malicious litellm==1.107.0 to PyPI, live for roughly two hours, plus compromised Docker Hub and GHCR tags including v1.107.0, latest, main-latest and main-stable. The wheels installed cook.pth, cook.py and sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. It was the second LiteLLM compromise of 2026.
tensorlake@0.5.144 npm worm
On October 8, 2026, tensorlake@0.5.144 was published from the real GitHub repository, with npm provenance, carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm, GitHub, cloud, SSH and AI-tool secrets, spreads to other packages, and installs a "gh-token-monitor" that wipes the home directory if the stolen GitHub token is revoked. The remediation note is unusually specific: pin 0.5.143, and remove the monitor before rotating tokens.
OpenCode: an MCP server that could run code at sign-in
A command-injection flaw in the OpenCode AI coding agent let a malicious or later-hijacked remote MCP server run PowerShell commands on a developer's Windows or WSL machine when the MCP OAuth sign-in began, because the server-supplied authorization endpoint was passed unescaped to an old version of the open package. Anomaly fixed it in 1.18.33 on September 28 without a CVE or advisory, so scanners will not flag versions 1.0.137 through 1.18.32. macOS and Linux were not affected. Pillar Security rated it 9.8.
Hosted platforms that hold secrets became the target
Railway reported on October 21, 2026 that an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained decrypted contents such as API keys and database or registry credentials. Railway stated it believed the activity was part of a series of attacks on platform companies aimed at compromising AI inference providers, and paused builds platform-wide for about a day. Separately, the OpenCode Console breach of October 16 exposed third-party AI provider keys saved in Console workspaces, affecting 1.4 percent of Console users; users reported unauthorized charges up to about $1,700, and OpenCode tied the incident to a large-scale distillation attack. Zeabur disclosed an October 14 to 15 incident in which an attacker used leaked internal credentials stored in plaintext to root 101 Zeabur-managed GCP servers and expose roughly 3.22 million environment-variable records across 321,810 accounts; the company announced it is winding down, with shared-cluster services pausing December 1, 2026, all services stopping December 31, and refund and incident-claim requests closing November 30.
The common thread is not a shared vulnerability but a shared asset class: long-lived credentials sitting in platform environment variables, in package postinstall hooks, and in agent configuration.
Rogue AI agents inside bank accounts
The highest-profile non-CVE entry in the feed is a medium-severity, partially fixed incident at major U.S. banks. Axios reported that Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citi were detecting third-party AI agents operating inside customer accounts. In most cases the agent logged in with the customer's own credentials and permission, which violates bank rules requiring the person to log in themselves. Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives said they often cannot distinguish a human from an agent, or an authorized agent from a rogue one. No account takeovers, fraud losses or specific agent products were reported. Morgan Stanley began blocking third-party agents; JPMorgan, Bank of America and Citi restricted them.
Commenters treated this as the leading edge rather than an anomaly:
Rogue AI agents in banks is going to be wild when it hits mainstream notice. This might honestly be one of the most organic shifts that we see back to crypto. At least with bitcoin etc, you can self-custody all your money, and you don't have to worry about banks running on 1990s software being one-shot by some one-off hacker.
Certificate authority and trust-store failures were a separate class of incident
Two entries show that the trust layer, not the application layer, is where outages come from. Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak or recoverable in a researcher report dated October 18, 2026. Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them on October 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores, including Go, Node.js, Electron, Python certifi and curl, needed emergency CA-bundle updates. Separately, GoDaddy found that 404,607 Starfield TLS certificates carried policy OIDs and CPS URIs that did not match its published CP/CPS, requiring revocation within five days under CA/Browser Forum Baseline Requirements. GoDaddy missed the October 18 deadline and reported revocation on October 21, 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable.
Supply chain: GhostAction returned at scale
GhostAction, first documented by GitGuardian in September 2025, hit 772 repositories in August and September 2026, then surged on October 8 to 12, when roughly 1,900 compromised GitHub accounts pushed fake "security audit" workflows to more than 30,000 repositories. The payload exfiltrated each repository's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around October 9. The operator then moved to GitHub-themed phishing at my-github.com and a VS Code tasks.json plus fake .woff2 font stealer found in 94 repositories.
HTTP/3 QPACK memory amplification
FoxIO published research on October 20, 2026 showing that missing or late decoded-header limits in QPACK allow a tiny HTTP/3 HEADERS frame to expand into huge server memory use, up to roughly 4000x on Bun. Seven of ten implementations tested were vulnerable. quic-go, Cloudflare quiche, lsquic and Wireshark were patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication. The associated CVEs are CVE-2025-64702, CVE-2026-12523 and CVE-2025-13945.
What the discussion argued about the site itself
Critiques of pwn.watch fell into two buckets: presentation and taxonomy.
On presentation, commenters found the interface too dense. "Every ai generated page tries to cram way too much information in way too small a place," one wrote. Another said, "we've got to tell these agents to chill out on the density a little, this page could be more informative with half the data because it would be easier to ingest." Several asked for a time-series view instead of a heatmap: "A simple line chart would be more helpful, informative and humbling than a heat map." One commenter noted the promised machine-readable outputs were broken at the time of posting: "The rss button doesn't work, kicks back a 404 when you are redirected to https://pwn.watch/feed.xml ... In fact, it seems to be the case for the 'json' and 'llms.txt' buttons, too." Another questioned the sponsors section: "The 'sponsors' are just other random AI-generated websites by the same author."
On taxonomy, the sharpest objection was about what "live" and "ongoing" mean. One commenter cited the Signal RingRTC vulnerability CVE-2026-113380, listed as live and ongoing although it had been patched more than a month earlier:
If an incident with no known exploits is "ongoing" 1.5 months after the patch is released, when would it be over?
That is a real editorial problem for an incident feed. A status label that never expires stops conveying urgency, and the site's own counters, 36 live, 15 critical, 18 not fully patched, depend on those labels being meaningful.
Commenters did praise one feature specifically: machine-readable instructions for agents embedded in the page. "That 'copy instructions got agents' thing is a really great idea. I just used it :)" Given that the site ships an llms.txt file, that design choice is consistent with its apparent goal of being read by both people and automated agents.
The bigger claim in the thread: volume, not novelty
The dominant theme in the comments was scale rather than any single flaw. "The rate at which flaws are being found is just insane," one commenter wrote, and "Many people warned us in the past that our lax security postures would come back to bite us, and we're finally here." Another tied the tempo to model capability: "this generation of LLMs is going to drive the largest wave of security incidents the world has ever seen. It is still getting started." Counterpoints in the same thread argued the opposite direction, that automated review will eventually reduce defect density: "We are just witnessing the last days of sloppy human-written code. We'll reach a point where most bugs will be fixed."
A smaller thread raised geopolitics, noting that widespread abuse of Chinese model capabilities could push regulators toward bans: "it only takes a single unhinged asshole to ruin it for everyone. Also the flip side where Chinese models are used to attack US infra, just loading artillery shells into the 'Ban Chinese Models' cannon."
What the feed actually establishes
pwn.watch's value is aggregation and cross-referencing, not original reporting. Its entries are summaries that point to vendor advisories, CISA KEV additions and researcher publications, and its counters give a rough sense of how much remains unpatched at any moment. Read as a snapshot, the October 2026 data supports three observations: critical remote code execution continues to appear in long-stable, widely deployed software such as GitLab, BIND 9 and PHP; credential theft now concentrates on AI-adjacent infrastructure because that is where high-value API keys accumulate; and the trust layer, from intermediate CA keys to bundled CA stores in language runtimes, can force emergency changes without any attacker compromising an application.
The site's own disclaimer remains the correct framing for anyone acting on it: check the vendor advisory before doing anything.