Every security incident on the internet, collected in the open

Oh Shit.

Someone left their database naked on the internet again. We sniff out every turd before it splashes on you.

Supply-chain poisonings, data leaks, zero-days and cloud misconfigs, graded by stench, each with a clean-up guide. Open data on GitHub, piped to your agents and feed readers through MCP, JSON and RSS.

See who shat today npx @ohshit/mcp

GET /api/v1/incidents.json

Fresh out of the oven

Newest first. Each one tells you what happened, who got splashed, and exactly how to wipe.

L5 · ShitstormOct 21, 2026PHP · RCE · leaked early

PHP2Shell: two critical PHP core RCEs leak a day before the patch, and nearly every PHP back to 5.4 is in the bowl

CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) give remote code execution in PHP itself. A proof-of-concept video leaked the evening before release, so the patch and the exploit arrived together.

Splash zone

PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed: nearly every PHP back to 5.4

How to wipe

Upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Disabling session.upload_progress only blunts one of the two bugs

L4 · Septic Tank BlewOct 21, 2026GitLab · RCE · self-managed

GitLab patches its second CVSS 10.0 regex-compiler RCE in nine days, and this one reaches back to GitLab 7.0

CVE-2026-110264 (CVSS 10.0) is an integer overflow in the Onigmo regex compiler that lets an unauthenticated user run code on self-managed GitLab, from 7.0 onwards. It lands nine days after CVE-2026-97229, a sibling bug that already has a public PoC. Servers patched on Oct 12 are still exposed.

Splash zone

Every self-managed GitLab CE/EE from 7.0 up; GitLab.com and Dedicated are already patched

How to wipe

Upgrade to 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13. There is no workaround

L4 · Septic Tank BlewOct 21, 2026Node.js · TLS · RCE

Node.js October security releases for 22, 24 and 26: ten CVEs, including a Brotli RCE and TLS hostname bypasses

Four HIGH, three MEDIUM and three LOW. An out-of-bounds write in the Brotli decoder, dns.resolve truncating names at a NUL byte, and IP spellings that sneak past certificate hostname checks. The release also rejects the compromised eMudhra keys.

Splash zone

Node.js 22.x, 24.x, 26.x and every end-of-life line

How to wipe

Upgrade to 22.23.4 / 24.22.1 / 26.12.1, rebuild containers, then restart so old TLS sessions drop

L4 · Septic Tank BlewOct 19, 2026cloud database · credentials · extortion

PingCAP confirms TiDB Cloud intrusion: a stolen service account roamed internal systems for a month

From Sep 9 to Oct 7 an intruder used stolen service-account credentials to copy account metadata, billing info, SQL editor text, encrypted API-key values and source code. Extortion group FulcrumSec claims 10.6 TB; PingCAP has not confirmed that.

Splash zone

TiDB Cloud customers' account, billing and SQL-editor data; no evidence customer databases were read

How to wipe

Rotate TiDB Cloud API keys and DB passwords, scrub secrets from SQL editor history, review access logs

L4 · Septic Tank BlewOct 17, 2026PKI · CA · TLS

eMudhra CA intermediate private keys were so weak that every one was a number below 256

Eight intermediate certificates (six TLS, two code signing) under emSign ECC Root CA - G3, cross-signed by Sectigo, had P-384 private keys that were integers below 256. Anyone could recover them instantly and mint certificates for any domain.

Splash zone

Anything trusting emSign ECC Root CA - G3 or the Sectigo cross-signs: browsers, OSes, Go, Python, Node

How to wipe

Update browsers and OSes, certifi 2026.10.19, Go 1.27.3 / 1.26.10, Node 22.23.4+; block the 8 intermediates in custom trust stores

L4 · Septic Tank BlewOct 16, 2026SaaS · OAuth · Microsoft 365

ConnectWise Cloud Backup's app secret got stolen, and attackers walked into Microsoft 365 tenants through the front door

An API secret for ConnectWise's multi-tenant backup app (formerly SkyKick) was stolen. Every Microsoft 365 tenant that had consented to the app was suddenly reachable with the permissions customers had granted it. ConnectWise suspended several cloud services.

Splash zone

Microsoft 365 tenants using ConnectWise Cloud Backup or Cloud Management: 173 confirmed, ~1,000 touched

How to wipe

Remove or re-consent the ConnectWise apps, review Entra sign-ins from 144.172.64.x, check for new Global Admins and app secrets

L4 · Septic Tank BlewOct 13, 2026zero-day · VPN · edge device

Ivanti Connect Secure zero-day chain: unauthenticated root on fully patched VPN boxes, again

Attacker UTA0576 chained an auth bypass, a file write and a privilege escalation to take over VPN appliances running the latest release, then went after AD credentials, LAPS passwords and BitLocker keys. CISA added it to KEV the same day.

Splash zone

Internet-facing Ivanti Connect Secure 22.8R2.4, 25.1.1.1, 25.1.2.2 and earlier

How to wipe

Patch to 22.8R2.5 / 25.1.1.2 / 25.1.3.x, run Ivanti's external Integrity Checker, rotate every credential that touched the box

L4 · Septic Tank BlewOct 9, 2026supply chain · GitHub Actions · secrets

GhostAction is back: hijacked maintainer accounts plant “security-audit.yml” workflows that ship your CI secrets out

Compromised GitHub accounts pushed workflows dressed up as security jobs that exfiltrate Actions secrets. A new variant scans full git history, so the key you deleted three years ago still counts. GitHub started blocking the workflow on Oct 9.

Splash zone

~1,900 accounts and 30,000+ repos targeted (GitGuardian); 3,174 secrets attempted

How to wipe

Search .github/workflows for security-audit.yml and friends, rotate every CI secret and any key ever committed, revoke old PATs

L4 · Septic Tank BlewOct 5, 2026healthcare · data leak

The Oracle Health breach tally quietly climbs to nearly 20 million patients

Stolen logins on two legacy Cerner servers in early 2025. The true size only surfaced through a Texas attorney-general filing: 19.9 million people, with SSNs, diagnoses, medications and medical images. Oracle still hasn't published a total.

Splash zone

~19.9M patients of legacy Cerner clients in the US, at least 29 hospitals and health systems

How to wipe

Freeze your credit, watch for fake “Oracle Health” notices; providers: enforce MFA and retire legacy servers

9 incidents on file since Oct 5, 2026. Browse the raw data on GitHub →

The OhShit Scale™

Graded by nose, not by CVSS

We weigh blast radius, exploit difficulty, in-the-wild activity, and the odds your boss calls you at 3 a.m.

Silent FartSmells, but clears fast. A theoretical bug with no exploitation in the wild.Just be aware

Bit of a LeakNarrow impact or hard-to-meet conditions.Fix it next sprint

ShartedA mainstream component is hit, or a proof-of-concept is public.Handle it this week

Septic Tank BlewMass data leak or active exploitation in the wild.Check and patch today

ShitstormInternet-scale. A worm is spreading, a core runtime or trust anchor is broken.Drop everything now

For developers & agents

Let the smell
come to you

Stop finding out you got hit by doomscrolling. Three ways to plug in — pick your plunger. All of it is open source.

claude_desktop_config.json

{
  "mcpServers": {
    "ohshit": {
      "command": "npx",
      "args": ["-y", "@ohshit/mcp"]
    }
  }
}

# Then just ask your agent:
> Any L4+ incidents in the last 7 days?
> Is Node 22.20.0 hit by anything on OhShit?

list_incidents

Filter by minimum level, ecosystem, tag and age

get_incident

Full write-up, fixed versions and the wipe checklist

smell_index

The current Shit Index and days since the last turd

terminal

$ curl -s https://ohshit.app/api/v1/incidents.json \
    | jq '.data[] | select(.level >= 4) | {id, level, title}'

{
  "id": "php2shell",
  "level": 5,
  "title": "PHP2Shell: …"
}

$ curl -s https://ohshit.app/api/v1/smell-index.json
{ "level": 5, "level_name": "shitstorm", "days_since_last": 0 }

GET /api/v1/incidents.json

Every incident, newest first

GET /api/v1/incidents/{id}.json

One incident with checklist and sources

GET /api/v1/smell-index.json

Today’s global Shit Index, for your wallboard

Slack

# Slack: pipe the feed into #security
/feed subscribe https://ohshit.app/rss.xml

# Discord, Teams, email: any RSS bot or
# Zapier / IFTTT "new RSS item" trigger works.

# Or just add it to your reader:
https://ohshit.app/rss.xml

/rss.xml

Every incident, newest first, with level in the title

No signup

No account, no key, no email list

Works anywhere

Feedly, Slack, Discord bots, a Raspberry Pi in the toilet

One fresh turd,
straight to your reader

Subscribe to the RSS feed, or watch the GitHub repo for new incident pull requests. No diarrhea, no filler, no tracking.

Make me smell it (RSS)Watch on GitHub

Smell something new?

Every incident is one Markdown file. Open an issue with an advisory link, or send a pull request with the file. Once it is merged it hits the feed, the API, the RSS feed and the MCP server.

Report a turd →How to contribute

Oh Shit.

Fresh out of the oven

Graded by nose, not by CVSS

Let the smellcome to you

One fresh turd,straight to your reader

Smell something new?

Let the smell
come to you

One fresh turd,
straight to your reader