LuaRocks.org Security Incident, September 2026
Summary
LuaRocks.org disclosed a remote code execution vulnerability that was exploited earlier in 2026 and fixed by Sept 26. The incident exposed credentials, API keys, and 2FA secrets; the site was rebuilt and credentials rotated. The post includes recommended actions for maintainers and users, including revoking keys, rotating passwords, and auditing packages.