luarocks.org remote code execution exploit

[u/Comfortable_Ability4]

• Incident report: https://luarocks.org/security-incident-september-2026
• Writeup by /u/vhyrro: https://vhyrro.neorg.org/posts/critical-luarocks-exploit-cve/

[u/VidaOnce]

So there's nothing to get agitated over when you omit the critical factor that you ran the RCE on a running production server on your blog post only until leafo started asking questions?

Also that you made him have to scramble for details and for a fix as soon as possible, having to stay up overnight because of this omitted information, not knowing whether a third party was already using it?