If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet. Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found 433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close. We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases. The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected. For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.

I recommend everyone upgrade Ruby immediately. This is a DoS and RCE vector if you accept user input into Regexp.new() ruby-lang.org/en/news/2026/1…

Day 18/ Decisions API is GA, OpenResponses joined the Linux Foundation, we shipped some performance improvements and Uber is going all-in on codex & work. But yes… that’s a reset!

wait, PHP was actually scanned by Anthropic’s Claude Mythos earlier this year. they also had access to OpenAI’s Daybreak Red for validating exploits. the PHP Foundation revealed this JUST yesterday. keeping frontier cyber models in the hands of a selected few doesn’t seem to be working well for the internet. thephp.foundation/blog/2026/…

Interesting. @brave was paused for new report submissions on @Hacker0x01. They've unpaused, but have set a signal requirement of 7.0 (max value on H1) in order to submit. Seems like a much better way to manage volume. Your doing @bcrypt? Other programs with custom signal levels:

Day 17/ Bet you thought we forgot, but no, it’s reset day today. Also good time to remind you to get Daybreak Blue access, it only takes 15 mins and you don’t want to have to do it in the middle of an incident.