About & methodology

What Has Been Pwned Today is a small, independent list of recent security incidents: data breaches, ransomware attacks, disruptive cyber incidents, actively exploited vulnerabilities and critical vulnerabilities.

How entries are found

  1. Surfaced from X. We search public posts on X for terms like CVE identifiers, CVSS scores, "actively exploited", "data breach", "ransomware attack" and "security incident". The posts that led us to each entry are listed under surfaced by. Being listed is not an endorsement of the post or its author.
  2. Corroborated with official sources. An entry is published only after we find at least one official source, such as the vendor's security advisory, the NVD record, the CISA Known Exploited Vulnerabilities catalog or another government CERT, the affected organisation's own statement, or a regulatory or stock-exchange filing. Items backed only by rumor are left out.
  3. Summarised in our own words. Summaries are short and factual. CVE IDs and CVSS scores are copied from the official records, and we note which scoring version and source each score comes from.
  4. Explained in plain English. Every entry starts with a short In plain English summary and a What this means list for non-technical readers: what happened, who is affected, whether it is confirmed, and what affected people or organisations should do. These notes are based only on the official sources and well-established facts, without speculation. Where the impact is not known, we say so.

What "confirmed" means

An entry is marked confirmed only when an official source confirms that the incident happened or that the vulnerability is being exploited in the wild (for example, a KEV listing or a company disclosure). A critical CVE with a vendor fix but no official confirmation of exploitation is marked not confirmed exploited.

Dates

All times are UTC. First seen is when the item first appeared in our X search, not necessarily when the incident happened or was disclosed. The official sources have the authoritative dates.

Data & feed

The whole dataset is available as JSON data (incidents.json) and as an RSS feed with the latest 100 items.

Disclaimer

This site is not affiliated with X, CISA, NIST, or any vendor or organisation mentioned here. It is provided as-is, for information only, and may contain errors or be out of date. It is not security, legal or investment advice. Always check the linked official advisory before you act. If you spot a mistake, please let us know through the site's Neocities profile and we will fix it.