The Node2Shell vulnerability in Brotli is under active attack. Patch Node.js to 26.12.1, 24.22.1 or 22.23.4 now.

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Cloudflare announced an emergency update to its Cloudflare Managed Ruleset, adding two web application firewall rules for the ...

OpenAI Codex Security researchers reported CVE-2026-111497, a Brotli decoder flaw that prompted patches for Node.js 22.x, 24.x and 26.x.

OpenAI found a remote code execution flaw in the Brotli compression library, prompting Node.js, Bun, Envoy and PyPI maintainers to ship patches.

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has ...

The Node.js Project released security updates on October 21, 2026, addressing ten vulnerabilities across its 26.x, 24.x, and ...

OWASP API Security Top 10 (2023) with vulnerable code, working fixes and tests in Node.js: BOLA, auth, rate limits, SSRF and ...

On "Hacker News," a bulletin board where engineers and entrepreneurs from around the world gather, technical news and reading ...

Interviews with world-class product leaders and growth experts to uncover concrete, actionable, and tactical advice to help you build, launch, and grow your own product.

It's been a busy week for supply chain incidents. Yesterday the PHP Foundation disclosed PHP2Shell, a vulnerability that has existed in PHP for over a decade. We broke down how that worked in our post ...

Cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by Anthropic's Claude Opus large language model (LLM). The package ...