anotha’ one… this time brotli
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Vranac Srdjan retweeted
🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.
CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.
What you need to know ↓ thehackernews.com/2026/10/cr…
Vranac Srdjan retweeted
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Vranac Srdjan retweeted
Quest Diagnostics has been hacked. Patient data was exposed. They serve roughly half of U.S. hospitals and physicians. Investigation ongoing.
Vranac Srdjan retweeted
Umm...this slightly got away from me. mostlylucid.net/blog/show-me…
About 7,500 words! I really wanted to explain how recommendation systems work and intersect with embeddings and more MLish concepts - including streaming compression, emergent patterns etc...
Ah well...40 minute read it is!
Part 2 is a crazy idea for a generalizable recommendation system you can use anywhere.
in the words of DJ Khaled "ANOTHA ONE!"
is it time to turn the internet off yet
kb.isc.org/docs/cve-2026-943…
oh my, this looks very interesting, and it might get me to finaly do orbin time
Vranac Srdjan retweeted
‼️ A critical Signal bug could keep your microphone, and possibly your camera, live after you hang up.
The other caller can flood the call's event queue so your hang-up is never processed.
Dubed CVE-2026-113380 it scored 9.3 and got fixed in September.
Vranac Srdjan retweeted
OH DEAR GOD NOT NOW
Readers added context they thought people might want to know
The screenshot of a The Hacker News post about a critical AutoMapper CVE-2026-REFLECT (CVSS 10.0) appears fabricated. No such article or CVE exists.
A real unrelated AutoMapper DoS flaw (CVE-2026-32933, CVSS 7.5) was disclosed in March 2026.
github.com/advisories/GHS…
thehackernews.com
here we go again…
shut... the ... front... door...
was JAVA feeling lonely and wanted to get into the party?????
Oracle Security Alert Advisory - CVE-2026-91403 CVS 9.1
oracle.com/security-alerts/a…
@uwu_underground
Vranac Srdjan retweeted
Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine.
• Best-in-class fast local coding
• Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark
• Built from scratch in under 4 months
Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.
Vranac Srdjan retweeted
Good news everyone!
The absolute legends @ the Sury php mirror have backported the patch all the way back to 5.6
Vranac Srdjan retweeted
Cloudflare:
On va utiliser des lampes à lave pour générer des nombres aléatoires.
Random boîte indienne:
4
I mean, this is one way to force an upgrade... might not be pleasent, but is sure as hell is effective
Vranac Srdjan retweeted
‼️ If you run a branch older than 8.2 — 8.1, 7.x, or 5.x — PHP will not fix it.
😬 There is no patch coming for you from PHP.
Your only options are to upgrade to a supported branch, take the system off the internet, or get a backported fix from your Linux distribution or host, if they offer one.
🚨 PHP2Shell: the one-line “fix” everyone shared overnight — session.upload_progress.enabled=0 — isn’t enough on its own, the firm that suggested it now says.
A PHP core developer put it bluntly: “the only mitigation is patching / upgrading PHP.”
No patch until 14:00 UTC today.
Here’s what actually cuts your risk before then → thehackernews.com/2026/10/ph…
and here is yet another reason for CF to sit in front of your web
‼️BREAKING: Cloudflare says it is already seeing early attacks on the two leaked PHP flaws, hours before the patch.
Its CTO Dane Knecht says WAF rules for the known exploit vectors are live for all customers, including free plans, but calls them "a STOPGAP only".
Websites are going dark while they wait. NotuBiz, used by 100+ Dutch local governments, pulled council information sites offline, including those of Den Bosch, Breda and Eindhoven.
explain xkcd and the Star Citizen Wiki are down too.
PHP ships the fix at 14:00 UTC today.
