What's Getting Pwned

What is happening

The page lists ongoing security problems, newest first. Each one says what is hit, whether a fix exists, and where to read more. The top items are a bank story about AI agents, a critical GitLab flaw that has been patched, a set of unpatched Linux kernel bugs, and a LiteLLM software attack.

Key numbers and facts

• The page counts 191 incidents in the last year, up to Oct 22, 2026.
• GitLab bug CVE-2026-110264 has a severity score of 10 out of 10 (CVSS 10.0).
• Two Linux kernel bugs in the ksmbd file-sharing server are scored 9.0 out of 10.
• The LiteLLM bad package was live on PyPI for about 2 hours.
• No account takeovers, fraud losses, or exploitation have been reported for the bank story or the Linux bugs.

Key terms

A CVE is a public ID for one security flaw. CVSS is a 0 to 10 score for how bad a flaw is. A patch is a fix that developers release. An unpatched bug has no fix yet. Remote code execution (RCE) means an attacker can run their own code on a machine they do not control.

Why it matters

These stories show risks from many sides. AI agents that log in to bank accounts can break bank rules. A flaw in software like GitLab can let outsiders take over a server with no password. A leak of unpatched Linux bugs means attackers may study them before fixes arrive. Software supply-chain attacks, like the LiteLLM case, can steal passwords and keys from developers as soon as their code runs.

What to watch

• Whether GitLab users upgrade to a fixed version, since some who applied an earlier fix are still at risk.
• When Linux kernel fixes for the ksmbd and other leaked bugs are released and get CVE numbers.
• Whether banks block or allow third-party AI agents in customer accounts.
• Whether LiteLLM users find and remove the bad versions and rotate their passwords and keys.