pwned.coffeeUpdated 30 min ago

Today's specials: 82 live security incidents, brew temperature 666°C

Head on fireIced. Chilling.

ProFTPD is being exploited and nobody's sure about a fix. Lovely.Decaf. Everything is fine. Really.

The baristaRead the ticket

Spills, last 30 daysOn the board now: 34 exploited, 10 no fix, 39 critical

Exploited now
34
No fix yet
10
Critical
39
Days since a spill
0 record 8

Decaf: just the things that can hurt you. Breaches, news and anything below high are off the menu.

9 of 82 specials. Clear

On holdStatus unknown9

Nobody has said yet. Read the advisory.

  1. ProFTPD Improper Access Control 🔥 On the fly · exploitedOld bug, newly exploited (KEV 2026-10-08)KEV overdue 13d
    Do now Restrict access to the ProFTPD SITE CPFR and SITE CPTO commands and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    KEV ✓ Record ✓ Vendor –
  2. Fortinet FortiMail Path Traversal 🔥 On the fly · exploitedKEV overdue 20d
    Do now Restrict access to FortiMail HTTP and HTTPS interfaces and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    KEV ✓ Record ✓ Vendor –
  3. BeyondTrust Remote Support Authentication Bypass by Spoofing 🔥 On the fly · exploitedKEV overdue 5d
    Do now Restrict network access to BeyondTrust Remote Support and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    KEV ✓ Record ✓ Vendor –
  1. YOOtheme Pro for Joomla Remote code execution
    Do now Restrict public access to YOOtheme Pro's image transformation handler until a vendor fix is released. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    KEV – Record ✓ Vendor –
  3. openapi-typescript-codegen Code injection
    Do now Only generate code from trusted OpenAPI documents and upgrade past 0.31.0 when a fix is available. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    KEV – Record ✓ Vendor –
  1. GPAC /MP4Box Heap Use-After-Free
    Do now Restrict use of GPAC/MP4Box on untrusted files and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    Re-scored 24 Oct high → unknown KEV – Record – Vendor –
  2. LiteLLM Supply Chain Attack
    Do now Check whether LiteLLM was installed and rotate any credentials it could access. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    Re-scored 24 Oct critical → unknown KEV – Record – Vendor –
  3. VMware Tools Hackers Hid Vasilek Backdoor in VMware Tools
    Do now Check VMware Tools installations for the Vasilek backdoor and investigate any hits. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
    Re-scored 24 Oct high → unknown KEV – Record – Vendor –

359 spills in 12 months

Worst days: 23 Oct 2026 (33 new), 22 Oct 2026 (19 new), 24 Oct 2026 (5 new), 20 Apr 2026 (7 new), 21 Oct 2026 (9 new)

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.