Security
HTTP2Shell Brotli bug reaches Node.js, Python clients, Bun and Envoy
Fixes for CVE-2026-111497 are out; code execution has been shown in a lab on one Node.js build, and no attacks in the wild have been reported.
Security
AI
PHP patches critical PHP2Shell flaws that were targeted before disclosure
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; the AI-found bugs are in PHP itself, so WordPress or Drupal updates won't fix them.
AI
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer
An attacker drove LiteLLM's own release pipeline with stolen GitHub tokens; pin 1.106.2, check for three dropped files and rotate keys.