October 27, 2026
- Brotli CVE-2026-111497 keeps expanding its footprint. The out-of-bounds write in Google's Brotli decoder (versions 1.0.3–1.0.9, 1.1.0, 1.2.0; CVSS 9.2) now has emergency patches from Microsoft for .NET, plus Node.js, PowerShell and Python packages (SecurityWeek, BleepingComputer). PHP rebuilt all supported Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) with Brotli 1.2.1; the flaw is reachable there via the cURL extension's automatic HTTP response decompression, which is off by default but commonly enabled by HTTP client libraries (The Hacker News) (earlier coverage).
· Vulnerabilities & Exploits
- Cisco IOS XR routers and Meraki cameras trust eight compromised eMudhra CAs. Apple has been blocking the 12 affected TLS intermediate certificates since October 19 and added the emSign ECC Root CA - G3 on October 23; macOS command-line tools like
curl and git that check /etc/ssl/cert.pem can still accept them until a future update (Apple) (discussion).
· Vulnerabilities & Exploits - A dozen curl advisories went public on HackerOne, several of them TLS-trust failures worth attention: CVE-2026-111483 (GnuTLS treats any stapled OCSP response as valid, letting revoked certs pass), CVE-2026-111484 and CVE-2026-111953 (SecTrust paths accepting forged or stale staples despite
--cert-status), CVE-2026-115528 (wolfSSL builds completing handshakes against certificate-less anonymous-DH servers and then sending HTTP Basic credentials), and CVE-2026-111950 (session-cache key omits the URL scheme, so a constrained MitM can have FTPS data treated as a verified HTTPS response body) (curl on HackerOne).
· Vulnerabilities & Exploits
in Brotli's Blast Radius Widens as PHP2Shell Lands on KEV
October 24, 2026
- Imperva demonstrated Node2Shell code execution on an official Node.js build, running attacker code on the stock 24.22.0 Linux arm64 image with no debugger or custom build by feeding crafted Brotli data to the bundled decoder (CVE-2026-111497). It took several attempts and covers that one build and app setup; 22.x and 26.x and other architectures were not tested, and 24.22.1 rejects the input. Reachable via
fetch() on Brotli responses or Express 5 body parsers; no in-the-wild exploitation reported as of October 22 (The Hacker News). The same decoder bug reaches curl and Git (GitHub advisory), and Python packages are also affected (NCSC-NL) — a step up from Thursday's weakened-build PoC. (discussion)
· Vulnerabilities & Exploits
in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug
October 15, 2026
- curl 8.23.0 closes an HTTP/2 upload bug with a client-side RCE PoC. A malicious receiving server can trigger CVE-2026-92392, a use-after-free in curl 8.22.0; reliable execution depends on the client build and memory layout, with crashes more likely. This completes the previously pending disclosure batch (earlier coverage). HackerOne report, The Hacker News
· New Tools & Releases
in A Crafted Attachment Can Root Cisco’s Secure Email Gateway
September 4, 2026
- curl disclosed a large batch of HackerOne reports, several with real exploitation relevance: an OpenLDAP SASL flaw letting a malicious server bypass authentication and inject LDAP responses (CVE-2026-13608), a pinned-key validation bypass with anonymous ciphers and
--insecure (CVE-2026-80230), plus cookie-parsing bugs that store Secure cookies insecurely and Windows Negotiate connection reuse with the wrong ambient credentials.
· Exploitation & Vulnerabilities
in Malware That Gaslights the AI Analyst
June 26, 2026
- curl shipped fixes for a large batch of CVEs including its oldest-ever reported bug (~24–25 years old), with HackerOne reports detailing several credential-leak and connection-reuse flaws — stale proxy passwords (CVE-2026-9079),
.netrc password mispairing (CVE-2026-8926), an SSH host-key mismatch silently accepted (CVE-2026-9547), STARTTLS session reuse enabling MITM (CVE-2026-8286), and ASan-validated UAF/Referer leaks (CVE-2026-9546). Aisle, SecurityWeek
· Vulnerabilities & Exploits
in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine