Luby's Restaurant Corporation
Subway is one of the world's largest quick service restaurant brands, serving freshly made-to-order sandwiches, wraps, salads and bowls to millions of guests, across over 100 countries in more than 37,000 restaurants every day. Subway restaurants are owned and operated by Subway franchisees – a network that includes more than 20,000 dedicated entrepreneurs and small business owners – who are committed to delivering the best guest experience possible in their local communities. Ready to join the Subway team? There are plenty of incredible opportunities to be part of Subway, from our corporate headquarters and worldwide regional offices to our remote development teams. Our thousands of franchised restaurants across the globe offer opportunities for talented, motivated people to join their teams. Browse opportunities at our dual-headquarters offices in Shelton, CT, and Miami, FL, offices as well as regional offices at https://www.subway.com/en-US/Careers. For opportunities at Subway Restaurants around the world, please visit www.mysubwaycareer.com.
Security & Compliance Standards Overview
No incidents recorded for Luby's Restaurant Company in 2026.
No incidents recorded for Subway in 2026.
Luby's Restaurant Company cyber incidents detection timeline including parent company and subsidiaries
Subway cyber incidents detection timeline including parent company and subsidiaries
Last 3 Security & Risk Events by Company
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage. This issue has been patched in version 4.5.90.
