A critical buffer overflow in the Brotli compression library, affecting versions 1.0.3-1.0.9, 1.1.0 and 1.2.0, can let attackers craft malicious compressed streams that corrupt memory on vulnerable decoders. The bug, nicknamed HTTP2Shell, Broccoli2Shell or Node2Shell, originated in Node.js but also touches Python libraries like urllib3, requests, httpx and aiohttp, prompting Microsoft to ship an emergency .NET update on Sunday.
bleepingcomputer.com
· 2026-10-26
Microsoft has shipped emergency security updates for .NET 8, 9, and 10, plus .NET 11 Release Candidate 3, to fix a critical vulnerability dubbed Broccoli2Shell (CVE-2026-111497). Discovered by Imperva's Red Team, the bug is an out-of-bounds write in the Brotli decompression library that can let attackers crash apps, leak memory, or in some cases execute code remotely via crafted Brotli-compressed data.
bleepingcomputer.com
· 2026-10-26
A hacker breached an intentionally vulnerable server running unpatched PHP software, claiming a Bitcoin bounty posted on the Steal My Bitcoin website. The prize, initially worth around $502, grew through donations to 0.02511679 BTC ($2,021.22) before being claimed at 15:47 UTC on October 25, about 19.28 hours after the challenge began. The creator, 'cloudlandsdev', set up the test to see if the recently disclosed CVE-2026-109618 and CVE-2026-109619 PHP vulnerabilities, patched on October 21, could actually be exploited in practice.
tomshardware.com
· 2026-10-26
Researchers have confirmed the first successful real-world exploitation of PHP2Shell, two critical remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. Perplexity's Adel Karimi documented honeypot evidence showing confirmed RCE with memory disclosure against an Apache mod_php server running PHP 8.4.26, a finding corroborated by Expel's Marcus Hutchins. The PHP security team patched the flaws on October 21, after earlier leaks and unconfirmed exploitation attempts detected by several security firms.
bleepingcomputer.com
· 2026-10-26
Researchers from Germany, India and the Netherlands analyzed 80 real-world ChatGPT users' donated chat logs, obtained via EU data access rights, and found 2,050 memory entries across 65 users. The study, presented at the ACM Web Conference 2026, found 96% of these memories were created by ChatGPT itself rather than by user request, with 28% containing GDPR-defined personal data and 52% containing psychological insights about users.
futurism.com
· 2026-10-25
Comcast's Q3 2026 results showed total revenue of $29.3 billion, down 6.1% year over year, alongside a loss of 144,000 domestic residential broadband customers. The company gained 368,000 wireless lines in the same period, and CFO Jason Armstrong confirmed plans to expand AI agents across customer service operations. Reports indicate Comcast is preparing job cuts within its cable business as part of a broader restructuring.
techspot.com
· 2026-10-25
Researchers discovered two long-dormant vulnerabilities in PHP, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that let attackers break into password-protected servers running the widely used web language. The PHP Foundation released public patches on Wednesday after giving major internet companies and hosting providers early access, prompting banks, hospitals, retailers and government agencies worldwide to take sites offline to update their systems.
techcrunch.com
· 2026-10-24
A critical out-of-bounds write vulnerability in Google's Brotli decompression library, first disclosed in Node.js as CVE-2026-111497 on October 21, has been confirmed to affect Python, C++, bun, Envoy and other HTTP-related software. The bug lets an attacker send crafted Brotli-compressed data to corrupt memory, leak data, crash processes or potentially run arbitrary code; patches exist for some affected projects while others are still pending, and Apache and Nginx are not affected by default since they don't decode Brotli.
aikido.dev
· 2026-10-24
TechCrunch has detailed the speaker lineup for its Founder Summit 2026, set for November 4 at SoWa Power Station in Boston and run with Fidelity Private Shares. Confirmed speakers include Toast co-founder Steve Fredette, discussing how the company continually reinvents itself, and Bessemer Venture Partners' Kent Bennett, addressing how founders can tell when product-market fit is genuine.
techcrunch.com
· 2026-10-23
Researchers at Eye Security found that Time4Popcorn, a Popcorn Time fork, used an insecure HTTP updater pointing to an abandoned domain that accepted unsigned executables, letting anyone controlling the domain run code as SYSTEM or root. The firm registered the domain and 14 related ones, observed roughly 3 million Windows and 350,000 macOS connections, and between November 2025 and March 2026 pushed remediation code to disable the vulnerable updater, collecting no host data in the process.
bleepingcomputer.com
· 2026-10-23
The WSJ Leadership Institute released its Best Boards 2026 ranking, identifying corporate boards it considers most effective at overseeing company strategy. The report highlights that many top-ranked boards are actively involved in shaping how their companies approach artificial intelligence.
wsj.com
· 2026-10-23
Researchers estimate more than 50,000 people died from heat-related causes in European urban areas during the summer of 2026, which saw five consecutive heat waves push temperatures to record highs across the continent. The researchers say a significant share of these deaths can be directly linked to climate change.
fastcompany.com
· 2026-10-23
GoKawiil