LuaRocks.org suffered a remote code execution vulnerability exploited multiple times between July and August 2026, with the fix deployed on September 26th coordinated through CISA. All credentials and API keys were exposed, 2FA secrets compromised, and the site moved to a new server. Users are advised to create new API keys, change passwords, re-enable 2FA, and upgrade to LuaRocks 3.12+.
Background
LuaRocks is the package manager for the Lua programming language, widely used in game development and embedded systems. CISA coordination indicates the severity and federal-level response to this incident.
- Source
- Lobsters
- Published
- Sep 27, 2026 at 09:58 PM
- Score
- 9.0 / 10