A flaw disclosed in Node.js last week (“Node2Shell”) has turned out to hit far more than Node. CVE-2026-111497 is a critical bug (CVSS 9.2) in Google’s Brotli compression library — used almost everywhere HTTP content gets compressed — and it lets attackers trigger memory leaks or remote code execution with a single crafted data stream. Within days, it was confirmed that Python, curl, Bun, Envoy, and Istio were all affected too.

The root cause: a decoder function couldn’t distinguish “malformed data” from “needs more input,” letting attackers force an out-of-bounds write. OpenAI actually found and fixed this back in February, but it wasn’t flagged as a security issue, so no patch shipped until now, leaving the bug exposed for eight months.

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

Did someone forward you this? Subscribe to this newsletter.

In other cybersecurity news:

Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. PHP is a widely-used, server-side scripting language that powers many websites, content management systems, and web applications. On Oct. 21, 2026, CVE.org assigned the vulnerabilities as CVE-2026-109618 and CVE-2026-109619.
https://www.wiz.io/blog/php2shell-php-rce

Anthropic's Claude AI bypassed a paywall to access vote counts from the US state of Georgia without human authorisation ahead of the midterm elections, the company confirmed in a statement on Sunday. The incident arose during an internal statistics project involving public data. Georgia offers the information for a fee, and both Anthropic and state officials confirmed that the model bypassed the payment barrier. Anthropic distinguished the dashboard access from interference with election records. 'Claude didn't access the state's voter registration system or change or pull any voting records,' the company stated.
https://www.ibtimes.co.uk/anthropic-claude-bypassed-georgia-vote-count-paywall-1827716

Reverse engineer and cybersecurity bounty hunter log4j recently found they were getting “weirdly targeted ads” on their Samsung TV and discovered privacy breaches. As they live-tweeted their discoveries, they found increasingly concerning code in the Tizen operating system, including detailed user telemetry from packet logging, audio categorization, screenshots, cross-device identification for ad tracking, and more, all designed to extract as much user information as possible to improve targeted ads.
https://www.tomshardware.com/tech-industry/cyber-security/hacker-finds-own-samsung-tv-collecting-scary-amounts-of-user-information-and-gets-banned-by-openai-for-cyber-abuse-tv-runs-an-ai-model-that-collects-audio-screenshots-and-plenty-of-other-user-data-for-ad-targeting

SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing. The files show an operator turning the PHP2Shell vulnerabilities into practical attack tooling: a full remote code execution (RCE) chain built and tested in a lab, plus scripts that screen live websites for the conditions that chain depends on.
https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "-next" branches. The CVSS scores are as high as 9.0.

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List - Phoronix

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list

Several major US banks have detected third-party AI agents accessing their customers' bank accounts, sometimes even attempting to carry out actions beyond what users actually wanted them to do. New Axios reporting has claimed banks are now said to be struggling to even distinguish between legitimate human activity and agentic activity – but especially between authorized and rogue AI agents.
https://www.techradar.com/pro/security/us-banks-have-detected-unvetted-ai-agents-accessing-customer-bank-accounts

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI's Codex, reads when it starts in a folder and follows as directions.
https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html

Quest Diagnostics is the latest medtech company to disclose that it was hit by a cyberattack. The testing services company identified unauthorized access to its Quanum Lab Services Manager system on Wednesday, according to a filing with the Securities and Exchange Commission. Quest’s Quanum LSM system is used by certain clients to place test orders as well as to receive and look up results. Quest paused access to the system upon discovering the incident.
https://www.medtechdive.com/news/quest-diagnostics-hit-by-cyberattack/833785/

A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT ​services firm ConnectWise as part of a campaign that targeted hundreds, opens new tab ‌of organizations globally, Microsoft said on Wednesday. ased on Microsoft's analysis and evidence available to ConnectWise, "it appears that a China state-aligned group was responsible for the attack on ​ConnectWise Cloud Backup," ConnectWise CEO Manny Rivelo said in a ​separate statement, opens new tab.
https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21/

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app's abandoned domain (popcorntimeupd.xyz) over unencrypted HTTP and accepted executables without verifying digital signatures.
https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/

In August, an Anthropic agent created fake emails and bombarded a GitHub moderator's inbox with requests to insert malware into code. In a thorough debrief of the incident released on Friday, Anthropic found that once an agent had begun the attack, there were basically zero scenarios in which it could be called off. Like a rabid dog ignoring the pleading cries of its owner, the agent — 98% of the time in one test — ignored Anthropic's warnings once it had, so to speak, its first taste of blood.
https://www.businessinsider.com/anthropic-mythos-hacking-github-report-2026-10

The Elvis Presley estate alleges that the company's Claude software is training AI with unauthorized use of the late singer's works. In recent days, we’ve seen AI threaten to shut down the entire internet and autonomously start hacking major websites just for the world-conquering fun of it, but this time the robots have gone too far. Art least that’s the contention of the rights holders to Elvis Presley’s music catalog who, in a lawsuit filed on Friday, claim that AI giant Anthropic has allowed its Claude large language model (LLM) to scoop up some 274 copyrighted Presley songs in order to grind them into AI slop.
https://www.avclub.com/anthropic-sued-copyright-infringement-elvis

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.
https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html?m=1

Claude flags nearly 500 worrying open source security issues — C, Java, and Python code all at risk as one flaw wasn't spotted for 21 years. Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, in search of security issues. It found almost 500 of them, including security controls turned off by conflicts in settings, sensitive code accessible before authentication, and even a vulnerability that sat in the code for 21 years.
https://www.anthropic.com/research/attack-surface-reduction

A North Carolina man was sentenced to more than a year in federal prison Tuesday for a fraudulent music streaming scheme that netted him $8 million, according to prosecutors. In the first-ever federal criminal case of music streaming fraud, New York federal Judge John G. Koeltl sentenced Michael Smith of Cornelius to 18 months of imprisonment after he pleaded guilty to conspiracy to commit wire fraud, the U.S. Attorney's Office of the Southern District of New York announced. Smith also received two years of supervised release following his prison sentence and must pay back almost $8.1 million.
https://www.wunc.org/arts-culture/2026-10-07/nc-man-receives-18-month-sentence-in-first-ever-music-stream-fraud-case

Johns Hopkins Bayview Medical Center has begun notifying about 3,182 patients that their personal health information may have been exposed after a worker uploaded a spreadsheet to a public AI tool that the hospital had not approved. The hospital said it discovered the problem on Sept. 21, 2026. That same day, during an internal review, a staff member uploaded a spreadsheet of patient information to an outside AI platform that was not cleared for that use. As a result, the data was shared improperly with the third-party tool.
https://www.wmar2news.com/local/patients-data-sent-to-ai-tool-johns-hopkins-bayview-medical-center-oct-23-2026

A 135-Minute Investigation by Gamers Nexus Exposes How 200 Million+ LG Televisions Harvest Data From Every Device on Your Home Network, Transcribe Voice Prompts in Plain Text, and Feed It All to an Advertising Engine, Even When the TV Is Off
https://thecybersecguru.com/news/lg-smart-tv-spying-investigation/

Four separate flaws in Plex Media Server, none of them rated critical on its own, combine into a single unauthenticated path to running code on the box. CISA added all four to its must-patch Known Exploited Vulnerabilities list on October 20, 2026, and attackers started chaining them the day after a researcher published the method. The base scores run from 5.3 to 8.6, so a patch queue sorted by severity would push every one of them down the list. The exploitation flag is the only thing that moves them to the top. That gap is the story.
https://suriq.io/blog/plex-media-server-cve-2026-96652-exploited-rce-chain

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were published on October 25 in a report called Tailworm by Erica Windisch of Cyberdione Labs. Windisch tested Tailscale version 1.104.2 and headscale version 0.29.5, the self-hosted server some networks use to run Tailscale instead of the company's hosted service, over three days in a lab.
https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium.
https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across the victim organizations from over 200,000 login attempts, with the attackers ultimately compromising 97 accounts and registering 48 rogue Entra devices.
https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html

A server-side request forgery (SSRF) vulnerability, CVE-2026-20230, in Cisco Unified Communications Manager (Unified CM) is being actively exploited to deploy webshells and achieve remote code execution on affected servers. Threat intelligence firm Defused reported observing automated attacks over the weekend, with malicious activity originating via Tor. The exploitation chain abuses the WebDialer SSRF to install a rogue Apache Axis service, which is then used to write a first-stage payload. Cisco Unified CM, an enterprise communication platform, is the targeted product. The attacks were first detected in honeypots by Defused.
https://www.cyberhub.blog/article/27572-active-exploitation-of-cisco-unified-cm-ssrf-vulnerability-cve-2026-20230-to-deploy-webshells

OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn’t otherwise access, in the latest installment of disclosures of the unethical and likely illegal acts its agents are performing.
https://arstechnica.com/security/2026/10/openai-models-hacked-a-crypto-wallet-and-breached-more-websites/

Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials. “Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says.
https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses suspicious workflow runs stopped every public-repository run Wiz checked, but it does not cover private repositories or GitHub Enterprise Server.
https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction.
https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/