Live security incidents, brewed hourly

Everything is fine. I checked twice.Decaf. Everything is fine. Really.Quiet morning. Suspiciously quiet.

Brewed for everyone. Tell us your usual

Today's specials13

Critical10

Not fully patched4

Days since the last spill1Record calm: 8 days

297 spills in 12 months

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Today's specials

1 of 13 specials. Clear

highno fix yetexploited 6 h ago Plex Media Server External Control of File Name or Path Vulnerability Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Can be chained with CVE-2026-96655, CVE-2026-96654, CVE-2026-96652. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23). CVE-2026-96652CVE-2026-96654+26 sources

Don't get pwned

1
Tell us your usualPick what you run. The specials, the fire and the delivery shrink to just your stack.
Get the fires deliveredOne email when something big catches fire in your usual. No newsletter.Email delivery isn't switched on yet. Take the RSS feed instead.
Ask your agent to check your codeAny agent that speaks MCP (Cursor, Codex, Claude Code, Gemini CLI, Windsurf, Zed) can check your whole repo against today's specials in one call and get the exact fix commands. Setup and prompts. https://pwned.coffee/mcp Want a full audit? Run Cloudflare's open-source security-audit skill: npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit

Or paste this into your agent

Every live high and critical special, with a request to report whether you're affected. Works in any coding agent.

Check this project and its deployment for exposure to the live security incidents below (from pwned.coffee).

For each one: search lockfiles, manifests, Dockerfiles, CI workflows and infra config for the affected product or package. If it's present, report the version in use, whether it's in the affected range, and the exact upgrade or mitigation. If an incident involves leaked secrets at a provider we use, list which of our secrets live there so they can be rotated. Don't change anything yet; report first.

- **Pillow: Argument Injection in Ghostscript call, potentially leading into RCE** (critical). Pillow (pip); CVE-2026-112900; fixed in Pillow 13.0.0. https://pwned.coffee/i/pillow-argument-injection-in-ghostscript-call-potentiall-cve-2026-112900
- **Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays** (critical). next (npm); fixed in next 16.4.1. https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-use-cache-functions-ret
- **Pillow multi-frame loaders can reuse stale native image storage after mode transitions** (critical). Pillow (pip); CVE-2026-96639; fixed in Pillow 13.0.0. https://pwned.coffee/i/pillow-multi-frame-loaders-can-reuse-stale-native-image-cve-2026-96639
- **Sentry-Javascript: Middleware Bypass when using Tunnel route** (critical). @sentry/nextjs (npm); CVE-2026-114139; fixed in @sentry/nextjs 9.47.2, @sentry/nextjs 10.75.2, @sentry/nextjs 11.0.0-rc.1. https://pwned.coffee/i/sentry-javascript-middleware-bypass-when-using-tunnel-ro-cve-2026-114139
- **Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used** (critical). next (npm); fixed in next 15.5.28, next 16.4.1. https://pwned.coffee/i/next-js-unauthenticated-remote-code-execution-in-image-optimization-api
- **Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO** (critical). Pillow (pip); CVE-2026-112393; fixed in Pillow 13.0.0. https://pwned.coffee/i/pillow-heap-buffer-overflow-in-tiffwriteproc-when-saving-cve-2026-112393
- **Pillow: Heap buffer overflow in ImagingJpegDecode** (critical). Pillow (pip); CVE-2026-112403; fixed in Pillow 13.0.0. https://pwned.coffee/i/pillow-heap-buffer-overflow-in-imagingjpegdecode-cve-2026-112403
- **Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks** (critical). github.com/argoproj/argo-cd/v2 (go), github.com/argoproj/argo-cd/v3 (go); CVE-2026-77459; fixed in github.com/argoproj/argo-cd/v3 3.3.15, github.com/argoproj/argo-cd/v3 3.4.10, github.com/argoproj/argo-cd/v3 3.5.4, github.com/argoproj/argo-cd/v3 3.6.0-rc2; patch: partial fix. https://pwned.coffee/i/argo-cd-appproject-destination-namespace-and-resource-re-cve-2026-77459
- **Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path** (critical). @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven); CVE-2026-103922; fixed in @capacitor/android 6.2.2, @capacitor/android 7.6.9, @capacitor/ios 6.2.2, @capacitor/ios 7.6.9, github.com/ionic-team/capacitor-swift-pm 6.2.2, github.com/ionic-team/capacitor-swift-pm 7.6.9, com.capacitorjs:core 6.2.2, com.capacitorjs:core 7.6.9, @capacitor/android 8.5.1, @capacitor/ios 8.5.1, github.com/ionic-team/capacitor-swift-pm 8.5.1, com.capacitorjs:core 8.5.1, com.capacitorjs:core 8.4.3, @capacitor/android 8.4.3, @capacitor/ios 8.4.3, github.com/ionic-team/capacitor-swift-pm 8.4.3; patch: partial fix. https://pwned.coffee/i/capacitor-android-and-ios-remote-content-can-be-loaded-a-cve-2026-103922
- **ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass** (critical). github.com/ixofoundation/ixo-blockchain/v8 (go), github.com/ixofoundation/ixo-blockchain/v7 (go), github.com/ixofoundation/ixo-blockchain/v6 (go), github.com/ixofoundation/ixo-blockchain/v5 (go) +3 more; CVE-2026-61604; fixed in github.com/ixofoundation/ixo-blockchain/v8 8.0.0; patch: partial fix. https://pwned.coffee/i/ixo-blockchain-x-bonds-did-resolved-payer-drain-x-entity-cve-2026-61604
- **Plex Media Server External Control of File Name or Path Vulnerability** (high, exploited). Plex Media Server; CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656; patch: no fix yet. https://pwned.coffee/i/plex-media-server-external-control-of-file-name-or-path-vulnerability
- **EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability** (high, exploited). EG Secure Solutions SiteGuard Server Edition; CVE-2026-106931. https://pwned.coffee/i/eg-secure-solutions-siteguard-server-edition-os-command-cve-2026-106931
- **Siemens Software Center Uncontrolled Search Path Element Vulnerability** (high, exploited). Siemens Software Center; CVE-2026-110936. https://pwned.coffee/i/siemens-software-center-uncontrolled-search-path-element-cve-2026-110936

Full machine-readable list: https://pwned.coffee/incidents.json. MCP server: https://pwned.coffee/mcp (check_repo does all of this in one call).

Today's specials: 13 live security incidents, brew temperature 319°C

297 spills in 12 months

Today's specials