CVE-2019-6706 Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.

⚡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More

Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions

CVE-2026-35093 Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

USN-8169-1: Redis, Lua vulnerabilities

New ‘LucidRook’ malware used in targeted attacks on NGOs, universities

ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT RAT

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites