Know what changed.
Trace why it matters.

JFrog researchers reported that the testmetest Miasma-family npm worm had armed 42 real GitHub repositories belonging to 11 owners, despite earlier findings that activity was limited to operator test accounts. The worm steals credentials, modifies repositories and CI configurations, spreads through npm packages, and can install a wiper that deletes the home directory when a victim revokes the stolen GitHub token.

The payload blobs were 12.9–13.7 MB and reportedly large enough to evade GitHub search and API paths normally used to locate this type of compromise.

CVE-2026-111497 is a critical buffer overflow in Google-developed Brotli, a decompression library bundled into many open-source components, applications, and cloud services; it can cause system crashes and remote code execution. OpenAI Codex Security discovered the vulnerability, and Node.js disclosed it in an October 21 security advisory.

Wiz researchers reported that 91% of cloud environments had resources vulnerable to CVE-2026-111497 and 82% had publicly exposed Node.js instances; watchTowr said exploitation impact depends on how Brotli is implemented and used in each software component.

COVESA vsomeip versions 3.7.3 and earlier contain a memory-allocation vulnerability in reliable (TCP) SOME/IP endpoints. Before validating that the declared bytes arrived, a reliable endpoint grows its receive buffer to the attacker-declared message size; a remote unauthenticated peer can therefore exhaust host memory and deny service.

In the default configuration, reliable endpoints have no size limit, allowing a peer to declare up to roughly 4 GB; a single short message claiming a 3 GB payload OOM-killed a service limited to 1.5 GB.