Node.js: a fix for a remote code execution flaw in its Brotli compression

Aikido @AikidoSecurity 👀 This week brought a wave of security vulnerabilities. - PHP2Shell: two critical remote code execution flaws in PHP itself - Node.js: a fix for a remote code execution flaw in its Brotli compression - GitLab: a patch for a maximum-severity flaw - LiteLLM: a compromised release carrying an infostealer and a remote access trojan - eMudhra: eight certificates blocked by Google, Mozilla, Apple and Microsoft And that’s not even the whole list. @ AnthropicAI 's Deputy CISO says it’s going to get a lot worse before it gets better. Cyber is business critical now more than ever. We think defenders win after that. The same models get cheap enough to run on every commit, and software stops shipping these bugs. We’re building toward self-securing software. For now, the teams that fix fastest come out ahead. Know what you run, patch it fast and rotate your secrets. Chart via cve.0xosprey.com 4:24 PM · Oct 23, 2026 · 1,218 Views 5

Aikido @AikidoSecurity 36m Aikido @AikidoSecurity Oct 21 ‼️ Two critical RCE vulnerabilities have been found in PHP itself. Treat all versions as affected, with reports going back to 5.x. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have a CVSS v4.0 score of 9.2. The PHP security team will release fixes on October 1 Aikido @AikidoSecurity 36m Aikido @AikidoSecurity Oct 21 Another one 🚨 Gitlab is vulnerable to remote code execution. 1. Firewall your Gitlab server 2. Patch. CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE in GitLab’s regex compiler. It reaches self-managed CE/EE instances back to version 7.0, while @ gitlab .com is already Aikido @AikidoSecurity 36m Aikido @AikidoSecurity Oct 22 eMudhra, a certificate authority that all the major browsers trust, generated the private keys for eight of its signing certificates so badly that one of them is just the number 4. A properly generated key takes 10^115 guesses to find. These took at most 256, enough for 1 Aikido @AikidoSecurity 35m Aikido @AikidoSecurity Oct 22 ⚠️ Node.js is vulnerable to remote code execution. CVE-2026-111497 (high): A Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. You’re exposed if your app or a library decompresses bad Brotli data (e.g. the 1 Aikido @AikidoSecurity 30m Aikido @AikidoSecurity Oct 21 ❗️LiteLLM was compromised (Again). The latest version 1.107.0 contains an infostealer and RAT. All 7 compiled wheels are backdoored. Anyone who ran pip install litellm==1.107.0 on any platform should assume credentials are compromised. More details soon!

bounce @existencexo 30m its blacktober