VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
The bug, nicknamed Node2Shell, Broccoli2Shell and HTTP2Shell, was added to CISA's Known Exploited Vulnerabilities catalog with a November 10 federal patch deadline.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
An out-of-bounds write in Google's Brotli decoder affects Node.js, .NET, PowerShell and Python packages, and researchers say it can lead to code execution.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.22 min read
A buffer overflow in Google's Brotli C decoder can corrupt memory and expose data. Node.js, .NET and Python packages have shipped fixes, and proof-of-concept exploits are public.
VulnerabilitiesBrief2 min read
Google promoted Chrome 156 to the stable channel with patches for 353 vulnerabilities, including six rated critical, and said none were known to be exploited in the wild.
VulnerabilitiesBrief2 min read
Chrome now flags lower-confidence "suspicious" sites, scrubs copied commands for analysis, and asks before connecting over unencrypted HTTP.
Threat intelBrief2 min read
Elastic reported that a fake Web3 accelerator used malicious npm packages, pitched with free AI credits and security audits, to deliver information stealers and backdoors to Windows and macOS machines.
VulnerabilitiesExploitedCVE-2026-111497CVSS 9.21 min read
A buffer overflow in Google's Brotli decoder lets crafted compressed data corrupt memory, and the affected code ships inside many programs that unpack Brotli streams.
VulnerabilitiesBrief1 min read
Mozilla and Google's Chrome Root Program confirmed the compromise of private keys for eight eMudhra intermediate CA certificates, a failure that could let a key holder mint trusted certificates for any site.
