.svg)
Truvo Incident Tracker
Security incident tracker
Every tracker answers the same questions in the same order: what happened, what is confirmed, what is still unknown, what to do in what order, and what each framework and law requires. Facts are dated and sourced, and the change log shows every update.
Talk to a security specialist
Share what you need and a consultant will follow up to book a call.
Tracked incidents and vulnerabilities
Newest first. Status shows whether the situation is still developing.
Brotli decoder flaw (CVE-2026-111497)
A Brotli decoder flaw bundled in Node.js, .NET, Bun, Python, Envoy and PHP for Windows. Fixed versions, a self-check script, and the obligations under SOC 2, ISO 27001, GDPR and HIPAA.
Railway environment variables incident
Railway disclosed unauthorized access to customer environment variables. What to rotate first, what is still unknown, and when it becomes a breach under GDPR, HIPAA and PIPEDA.
PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Two critical PHP runtime flaws allow unauthenticated remote code execution. Fixed versions, how to check, and the obligations under SOC 2, ISO 27001, GDPR and HIPAA.
How the incident tracker works
- Facts come from vendor advisories, regulators and named researchers, each linked with its date. Social media claims are listed only as unverified.
- Unknowns are listed alongside the facts, so a team can plan around what has not been disclosed.
- Actions follow the NIST SP 800-61 incident response phases: detection and analysis, containment, eradication and recovery, and post-incident activity. Vulnerabilities add evidence preservation and remediation first.
- Obligations separate frameworks a company chooses (SOC 2, ISO 27001) from laws that apply once data is in scope (GDPR, HIPAA, PIPEDA, Quebec Law 25), and separate a security incident from a reportable breach.
Dealing with one of these now?
Truvo's incident response team helps scope exposure, review logs and make the incident and breach determination, with the evidence your auditor and customers will ask for.