A memory-corruption vulnerability in Google's Brotli decoder has a much wider reach than initially thought, extending well beyond the Node.js remote code execution issue that first brought it to attention. The flaw, tracked as CVE-2026-111497, allows specially crafted compressed data to write past the end of a buffer, corrupting the affected program's memory. Because the decoder is embedded in a broad range of software that unpacks Brotli-compressed data, the exposure is not limited to a single platform. Confirmed affected software includes: Bun Microsoft .NET The Python Brotli and brotlicffi packages Envoy proxies configured to decompress Brotli Any application or service that accepts untrusted Brotli-compressed input and relies on an unpatched decoder should be treated as potentially at risk. Administrators are advised to identify where Brotli decompression is exposed to external input and apply vendor updates as they become available. Source: The Hacker News Does your organization rely on any of the affected Brotli implementations, and how are you handling the patch?

An unknown threat actor has compromised 953 online stores, the majority of which run Magento, in a campaign that has been active since July 2025. The activity was detailed by Dutch e-commerce security firm Sansec, which describes the operation as designed to inject a small piece of code into store pages so that malicious JavaScript loader code is served to unsuspecting visitors through Magento CMS blocks. The loader is reportedly built to evade detection by scanners, making it harder for store operators and security tools to spot the compromise through routine checks. Sansec notes the campaign has persisted for months, suggesting the attackers are maintaining access across a large number of storefronts rather than conducting a short-lived burst of activity. Key facts so far: 953 online stores infected Most affected stores run Magento Campaign active since July 2025 Malicious JavaScript loader delivered via Magento CMS blocks Code is designed to evade scanner detection Store owners running Magento should review their CMS blocks for unexpected or obfuscated code and audit recent administrative changes, particularly anything dating back to July 2025. Given the scanner-evading nature of the loader, manual inspection of page content and block configurations is advisable rather than relying solely on automated scanning. Source: The Hacker News Is your organization running Magento, and have you checked your CMS blocks for signs of this loader?

South Korean police have identified seven suspects tied to a cybercrime operation that compromised more than 90 organizations across the country. According to investigators, the group relied on the ARTEX AI pentesting framework to carry out most of the attacks, a detail that stands out given the tool's origins in legitimate security testing. The operation reportedly led to the theft of 8.2 million data records, and the case has drawn attention because at least one of the accused is a former pentester — someone with hands-on experience in offensive security techniques. That background likely made it easier to adapt professional-grade tooling like ARTEX AI for criminal purposes rather than authorized assessments. Key points from the report: Police in South Korea identified seven suspects in connection with the campaign More than 90 organizations were breached The ARTEX AI pentesting framework was used in the majority of the attacks A former pentester is among those accused Roughly 8.2 million records were stolen The case underscores a familiar concern in the security community: tools built for authorized penetration testing can be repurposed with little friction when they fall into the wrong hands. It also highlights how AI-assisted frameworks are lowering the effort required to scale attacks across many targets. Source: Unknown Does your organization have controls in place to detect abuse of legitimate pentesting tooling, and how are you handling that risk?

The University of Copenhagen has disclosed a data breach after hackers gained access to one of its internal test environments. The exposed environment contained personal data belonging to approximately 525,000 people, making this one of the larger education-sector breaches reported in Denmark. According to the university's confirmation, the compromised system was a test environment rather than a production system, though it still held real personal data. Details on exactly what categories of information were exposed, how the attackers got in, or when the intrusion was detected have not been fully detailed in the initial reporting. Key facts as confirmed so far: Affected organization: University of Copenhagen (Denmark) Number of individuals exposed: 525,000 System involved: a test environment containing personal data No specific CVE ID or advisory identifier has been cited in connection with this incident The university has stated it is investigating the incident and will likely provide further guidance to affected individuals as the review progresses. Those who may be impacted should watch for official communications from the university and be cautious of phishing attempts referencing the breach. Source: Unknown Do you think test environments holding real personal data are an underrated exposure risk in your organization?

DreamHost is requiring password resets for email and FTP/SFTP users following an ongoing incident that disrupted connections to its File Manager interface, according to reports. The hosting provider has moved to force credential changes as part of its response to the disruption. Details remain limited at this stage, and no specific indicator of compromise, advisory identifier, or root-cause information has been disclosed in the reporting. Customers who rely on DreamHost for email or file transfer access should treat their credentials as potentially affected and complete the reset process if they have not already done so. Affected services: email and FTP/SFTP accounts Reported symptom: disrupted connections to the File Manager interface Action taken: forced password resets for affected users Source: Publication Name Have you received a reset notice or noticed File Manager issues on your DreamHost account?

Microsoft has pushed out emergency security updates for .NET to address a critical vulnerability that has been given the name Broccoli2Shell, and is also tracked as Node2Shell and HTTP2Shell. The flaw is rated critical and affects the Brotli decompression component within .NET. Microsoft is treating this seriously enough to release the patches outside of its normal update schedule, so administrators running affected .NET deployments should prioritize testing and deployment. At this time, the details available are limited to what Microsoft has published in its emergency advisory. The company has not disclosed the full technical specifics of the vulnerability, and no specific CVE identifier has been provided in the source reporting. That means defenders should rely on Microsoft's official guidance and patch information rather than assuming a particular CVE number. Given the critical rating and the emergency nature of the release, the practical takeaway is straightforward: Identify any systems, services, or applications that depend on .NET and the Brotli decompression path. Apply the emergency .NET updates as soon as possible. Monitor Microsoft's advisory channels for further technical details and any updates to the tracking information. Because the disclosure is still developing, expect additional details to emerge in the coming days. Source: Unknown Are any of your environments running .NET services that could be exposed to this Brotli flaw, and how are you handling the emergency patching window?

Well done! keep ️

A critical vulnerability dubbed HTTP2Shell has been identified in Brotli, the C decoder library bundled with Node.js. The flaw could allow attackers to corrupt memory and gain access to sensitive data, prompting emergency patches from maintainers. Because the issue affects the decoding library that ships with Node.js, applications and services that process Brotli-compressed input may be exposed. Memory corruption issues of this kind can potentially be leveraged beyond a simple crash, making prompt patching important for anything relying on the affected library. At this stage, the available details center on the memory corruption impact and the emergency patch response. Administrators running Node.js or other software that embeds Brotli should treat this as high priority and apply vendor updates as soon as they are available. Review your Node.js and Brotli dependencies for affected versions Apply the emergency patches released by maintainers promptly Monitor vendor advisories for further technical details and updated guidance Given the severity, don't wait for a full exploit breakdown before patching. Source: Unknown Are your Node.js services already patched, or are you still assessing exposure?

Two critical vulnerabilities have been disclosed in Wasmtime, a WebAssembly runtime that can be embedded into other software. According to the project's maintainers, both flaws could allow a malicious WebAssembly module to break out of the sandbox that is meant to contain it. Exploitation requires the attacker to get a vulnerable Wasmtime build to compile a module they control — the flaws are not remotely triggerable on their own. One of the two issues impacts only ARM64 systems, so exposure depends heavily on the underlying architecture in use. Fixed versions of Wasmtime have been released, and operators running the runtime — directly or as a dependency inside another application — should upgrade to the patched release as soon as possible. Mitigation guidance: Identify any software in your environment that bundles or embeds Wasmtime. Upgrade to the fixed release published by the maintainers. Pay particular attention to ARM64 deployments, which are affected by one of the two flaws. Avoid compiling or running untrusted WebAssembly modules on unpatched builds. Source: The Hacker News Does your organization embed Wasmtime in any production software, and have you already patched it?

Kali Linux 2026.3 has arrived as the distribution's third release this year, bringing a set of new offensive security tools alongside desktop environment refinements and updated build scripts. The headline addition is a batch of new hacking tools packaged into the release. The update also includes improvements across the desktop experience and refreshed build tooling, keeping the platform current for penetration testers and security researchers. Key points from the release: Six new tools added to the Kali toolset Desktop environment improvements Refreshed build scripts Third release of the year, continuing Kali's regular cadence Users are encouraged to update existing installations or grab fresh images from the official Kali downloads page to take advantage of the new tooling. Source: Unknown Have you tried any of the new tools in this release yet, and how do they fit into your workflow?

A developer's AI coding agent was nearly tricked into installing a known-malicious npm package by a malicious instruction file placed in their Downloads folder, according to a report published last week by Forever Security. The security firm detected the attempt on a real customer's machine and intervened before any code was executed. Investigators were unable to determine how the file ended up in the Downloads folder in the first place. Key points from the report: The attack relied on a malicious instruction file dropped in a commonly used directory (Downloads) rather than a traditional exploit. The file attempted to direct the AI coding agent to install a known-malicious npm package. Forever Security stopped the agent before any code ran, so no execution occurred on the affected machine. The initial infection vector remains unknown, as the firm could not establish how the file was placed in the folder. This incident highlights a growing risk surface around AI coding assistants, which often read files and act on instructions from the local environment. Developers running such agents should be cautious about unexpected files in download or working directories and review what their tools are permitted to install automatically. Source: The Hacker News Does your organization restrict what your AI coding agents are allowed to read or install from local directories?

PHP has pushed out emergency updates addressing two critical vulnerabilities in the PHP language itself that could allow an unauthenticated attacker to execute code on a web server. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and according to the PHP team, only applying the update provides full protection for a server. The two flaws, collectively tracked as PHP2Shell, reside in the PHP runtime rather than in any application layer. This means a site can be exposed even when its own code is not at fault, since the weakness exists beneath whatever application is running on top of the interpreter. Key points for defenders: The vulnerabilities are unauthenticated, requiring no account or credentials to exploit. Because the flaws sit in the runtime, patching the application code or hardening the site will not remediate them. The affected update branches are 8.5.x, 8.4.x, 8.3.x, and 8.2.x, with fixes landing in the point releases listed above. The PHP team's guidance is clear: updating is the only complete protection. If your organization runs PHP in any capacity, treat this as urgent and verify which version your servers and containers are running before the weekend. Source: [email protected] (The Hacker News) Has your team already confirmed which PHP versions are running across your environments, or are you still mapping affected hosts?