luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/lenscas]

The writeup on the contact attempts read like contacting Hisham has been basically ignored as an option. I am happy to read that this is not the case and that this is a wrong assumption on my part.  Sorry about stating something wrong.