A security incident occurred on LuaRocks.org in September 2026, where a remote code execution vulnerability was reported and promptly fixed. An investigation revealed that the vulnerability had been exploited several times between July 9th and August 20th, 2026, allowing an attacker to run code on the server and potentially exposing all data it had access to. As a precaution, the site was moved to a new server, all credentials were revoked and replaced, and although no evidence of package modification was found, the incident highlights a vulnerability in the way LuaRocks.org loads and executes uploaded Lua files, specifically in its failure to reject precompiled bytecode, which can be used to execute malicious code.