Security incident register — every incident, its status, and links to the full post-incident
review. Incidents are filed at infrastructure/security/incidents/<incident-name> as required by
Standard 6: Responding to Incidents. Newest first.
| Incident | Date | Status | Report |
|---|---|---|---|
| Hosting provider complaint — spurious SSH activity reported against the primary VPS | Aug 2026 | Answered — see the provider report below | Complaint |
| Forgejo compromise — hosting provider report (cause, measures, verification) | 2026-08-20 | Closed — resolution verified | Provider Report |
| Forgejo compromise — root cause found & remediated (git-apply path-traversal RCE, patched) | 2026-08-14 | Remediated | Root Cause & Remediation |
| Kinsing-family crypto-miner in the Forgejo container | 2026-08-11 | Contained — entry vector closed by the 2026-08-14 remediation | Kinsing Miner |
| test-client login landed on the VeriPath staff dashboard | 2026-08-01 | Resolved — same day | Report |
| test-client tenant outage — 500 / VPN tunnel unhealthy (post-reboot DB name) | 2026-08-01 | Resolved — same day | Report |
| Wiki.js database loss with Keycloak, nginx and Docker service impact | 14 May 2026 | Resolved — 25 May 2026 | Incident Report • Findings & Recommendations |
The 2026-08-11 and 2026-08-14 entries are one incident chain: the first contained the miner but
left the entry vector open, the second identified and patched it. Read them together.
| Status | Meaning |
|---|---|
| Open | Incident is ongoing, investigation or remediation in progress |
| Investigating | Root cause analysis underway |
| Contained | Immediate threat stopped; root cause and remediation still outstanding |
| Remediated | Root cause fixed and the fix verified |
| Resolved | Corrective actions completed and verified |