October 25, 2026
- The Brotli out-of-bounds write behind node2shell (CVE-2026-111497) affects far more than Node.js. Aikido confirmed Python Brotli packages are exploitable via the same bug, and by October 23 the blast radius extended to Bun, Envoy, Istio, Java HTTP stacks and WOFF2 libraries. The flaw affects Brotli 1.0.3 through 1.2.0 on all platforms, CVSS 9.2, and works in both directions — a malicious client can take over an unpatched server, a malicious server can take over an unpatched client that accepts compressed responses. OpenAI found the bug in February and fixed the root cause upstream without realising it was a security issue. Patches exist for libbrotli, Python, C++, Node.js, bun and Envoy; Apache and nginx do not decode Brotli by default. The Hacker News reported no in-the-wild exploitation for Node.js as of October 22. (Aikido, The Hacker News) (discussion)
· Vulnerabilities & Exploits
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox
October 17, 2026
- NGINX 1.30.6 and 1.31.7 fix five issues, one present in every release since May 2005. Three are memory bugs that F5 says could crash a worker or possibly allow code execution, each needing a specific configuration; a fourth lets an attacker forge a TLS session that may skip client-certificate checks (The Hacker News).
· Vulnerabilities & Patches
in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD
August 10, 2026
- Most WAFs and reverse proxies fall to HTTP/2 request-body bypasses. New research shows protocol-specific framing and inspection gaps break body inspection across nearly all tested products, with Nginx + libmodsecurity3 holding up best (lab.ctbb.show).
· Offensive & Exploitation
in ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset
July 29, 2026
- LLM-driven vulnerability research keeps landing real CVEs. OVSwrap (CVE-2026-64531), a broad Linux local privilege escalation, was found by giving models memory-safety and graph-reasoning tooling to work through exploit geometry (writeup), and ENDGINX turned open-weight GLM 5.1/5.2 loose on the NGINX codebase to surface five CVEs (mufeedvh via cyb3rops). Trail of Bits documented its goal-driven prompting workflow for bug discovery (Trail of Bits).
· AI & Model Security
in Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route
July 27, 2026
- A working RCE for NGINX CVE-2026-42533 was open-sourced. Researchers released their implementation for what they describe as a powerful bug that yields both an information leak and code execution (@cyb3rops).
· Vulnerabilities & Exploits
in Two Live Exploits and a Bench of Fresh Offensive Tooling
June 20, 2026
- F5 shipped out-of-band fixes for two critical NGINX Open Source RCE flaws, including CVE-2026-42530 (CVSS 9.2), a use-after-free in the HTTP/3 QUIC module triggerable by a remote unauthenticated attacker. No exploitation reported yet, but the QUIC path warrants prompt patching. The Hacker News, CVE
· Vulnerabilities & Exploits
in FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token
June 19, 2026
- F5 shipped out-of-band patches for two critical NGINX Open Source flaws, including CVE-2026-42530 (CVSS 9.2), a use-after-free in the HTTP/3 QUIC module (
ngx_http_v3_module) that a remote unauthenticated attacker can trigger for code execution (The Hacker News, BleepingComputer).
· Vulnerabilities & Exploits
in FortiBleed Burns 70,000+ Fortinet Edge Devices While a Leaked GitHub Token Guts Novo Nordisk