Tech · Culture · Fiction
Article Microsoft pushed an emergency .NET patch Sunday
CVE-2026-111497 (HTTP2Shell/Node2Shell) is a Brotli decoder buffer overflow enabling RCE across Node.js, Python, and .NET. Patched versions and why blocking inbound requests isn't enough.
Forever Security found a malicious AGENTS.md in Downloads
A malicious AGENTS.md dropped into ~/Downloads can steer an AI coding agent into installing rogue packages or leaking its OAuth token.
On October 21, Ovi detailed Telegram spyware copying 2FA passwords
uCreator, a rentable Android spyware kit, hides inside tampered Telegram and WeChat apps to steal 2FA passwords in plaintext and clone accounts.
SBI leak put Central KYC numbers on BreachForums
SBI disclosed a leak of 3,897 customer records, including hard-to-rotate KYC data that feeds India's live PII lookup market.
Unit 42 flagged an attack packaged for an AI
PHP2Shell hit a European government network; Unit 42 saw agentic-AI post-exploitation and CYFIRMA tracked a Lazarus-linked scan of 216 hosts.
Arista's October 22 VeloCloud flaw turns read-only into operator
Arista's VeloCloud Orchestrator has an exploited zero-day SQL injection, CVE-2026-114625 at CVSS 9.9, escalating read-only accounts to operator.
By October 23, one Brotli flaw reached every language
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that lets unauthenticated attackers run code via crafted compressed streams.
The Wire — latest
All →- Apple 27.2 Updates Bring Memory-Enabled Siri, Expanded Language Support
- Apple Overhauls iPad mini With OLED, AI Accelerators
- Building Security for the Next 250 Years
- Cloudflare Patches KV Cache Bug That Exposed Customer Data
- Critical PHP Vulnerabilities Exploited in Active Attacks
- Dahua Cameras Hijacked via Predictable Serial Numbers in Ukraine
- GPT-6.1 Terra: OpenAI's Practical Midrange Model
- iPad Mini Overhaul: OLED Screen and A20 Pro for $699
- Joseph Bell: The Surgeon Who Inspired Sherlock Holmes
- Meta Employees Condemn Electoral Bias in Brazil
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.