CVE-2026-111497 is an out-of-bounds write in vulnerable Brotli decoders, reachable through attacker-controlled compressed data and potentially enabling memory disclosure, crashes or code execution. Fixes are available for Brotli, Python packages and affected runtimes.
Aikido reports that eight eMudhra intermediate CA private keys were recoverable because they were smaller than 256, including one equal to 4. Browsers have blocked the certificates, but other trust stores may need updates; the article says attacker use is unknown.
CVE-2026-111497 is an out-of-bounds write in Node.js’s Brotli decoder. Patched Node.js and Bun versions are available; researchers reported lab code execution, but no in-the-wild exploitation had been reported as of October 22, 2026.
PHP2Shell comprises two PHP flaws enabling unauthenticated RCE. PHP released fixes for supported branches; Cloudflare says exploitation has begun. The article details affected versions, mitigations and post-patch checks.
Aikido reports that compromised LiteLLM 1.107.0 PyPI wheels and Docker images contained an infostealer and RAT. It details the build-time injection and credential theft; affected users are urged to rotate credentials after the release was removed and the incident was re
Aikido’s guide recommends package-age gates, lockfile and commit-SHA pinning, scoped credentials, developer-device protections, AI-agent sandboxing, and audit logs to reduce software supply chain risk.
A buyer’s guide compares nine phishing-simulation tools and explains how to assess scenario realism, multichannel campaigns, automation and reporting. It flags Noon’s early-access status and a reported security advisory affecting Gophish through version 0.12.1.
A 2026 buyer’s guide compares 10 email-security platforms, focusing on BEC and phishing detection, deployment and remediation options, integrations, and broader workforce coverage. It also offers criteria for assessing response workflows, licensing and operational fit.
