Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
2026-10-25T07:24:00Z•01461e346f5b55527abb8dd251f3f6a504d22ced088e91130596fc53907bfd69
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-111497CVE-2026-112900CVE-2026-115560AI-securityBrotliCISA-KEVGitLabNode.jsPHPPillowPythonUEFI-bootkitVeloCloudactive-exploitationcredential-exposuremalwarenetwork-edge-devicesransomwareremote-code-executionstate-sponsored-threatssupply-chain-compromisevulnerabilityzero-day
What happened
The Hacker News feed highlights multiple critical cybersecurity developments, including actively exploited vulnerabilities, remote code execution flaws in widely used software, supply-chain compromises, exposed credentials, ransomware activity, and attacks against network edge devices. Notable issues include the Brotli decoder flaw CVE-2026-111497 affecting Node.js and other ecosystems, PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, Pillow EPS command execution CVE-2026-112900, and actively exploited Collabora Online and Arista VeloCloud flaws. The feed also reports compromised
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 01461e346f5b55527abb8dd251f3f6a504d22ced088e91130596fc53907bfd69
- Enrichment time
- 2026-10-25T07:24:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.