LuaRocks Server Breached, Credentials Exposed

LuaRocks.org fixed a remote code execution flaw on September 26, 2026, after a CISA-coordinated report. Attackers exploited it between July 9 and August 20, exposing usernames, email addresses, bcrypt password hashes, 2FA secrets and GitHub tokens. All API keys, sessions and credentials were revoked; the site moved to a new server. Users must reset passwords, 2FA and API keys, and upgrade to LuaRocks 3.12 or newer.