Where does Brotli hide in your stack, and would you have known before this week? Follow @PredictaLabOff for more cyber and OSINT news.

No in-the-wild exploitation confirmed yet. That makes this the rare giant bug you can patch before the breach stories start. Trail of Bits shipped brotli-checker to find out if your code even touches Brotli.

Like PHP2Shell, the bug was found with AI tools: Node.js credits Khai Tran and Sylvie Mayer of the OpenAI Codex Security team. That is two internet-scale RCEs surfaced by AI in a single week.

The queue behind it: Python Brotli libraries, the Bun runtime, the Envoy proxy, Istio. Because the flaw lives in the format's shared code, maintainers expect confirmations and fixes to keep landing for months.

Node.js patched first on October 21: versions 22.23.4, 24.22.1 and 26.12.1. Node 20 is end of life and gets no fix. Apps that decompress untrusted data with node:zlib risk crashes, memory disclosure or remote code execution.

CVE-2026-111497 is a memory corruption bug in the Brotli format's code. Crafted compressed data sent to a server writes outside the decoder's buffer and can execute code. No authentication needed.

Everyone spent last week patching PHP2Shell. Meanwhile a second RCE, just as broad, was sitting in Google's Brotli compression code, used by every language on the internet. ⬇️

Audits waved these keys through twice. What would actually have caught them: better tooling, transparency logs, or just more paranoid reviewers? Follow @PredictaLabOff for more cyber and OSINT news.

The web's trust model rests on key ceremonies nobody re-checks. DigiNotar died of a hack in 2011; eMudhra leaves after a defect no attacker even needed. If your certs chain through a low-cost CA: inventory, reissue, watch the CT logs.

Chrome, Firefox and Apple distrusted the certificates. eMudhra says it revoked all eight within 14 hours, denies any breach, and is now withdrawing from the global SSL/TLS certificate business, about 1 percent of its revenue.

The defect came from one broken step in an April 2025 key ceremony. It survived two independent audits and 18 months in plain sight, until researcher Scott Helme published the finding.

With those keys, an attacker could forge valid HTTPS certificates for sites they do not own and silently intercept traffic. Unit 42 reports no confirmed abuse, but the certificates were set to stay valid until April 2040.

Eight intermediate CA certificates from Indian authority eMudhra were built on keys with almost no randomness. Instead of a random 384-bit number: 4, 56 and 115. Anyone who does the math can derive the private keys from the public certificates.

A root-trusted certificate authority generated a private key that was literally the number four. Not a metaphor: 4. The fallout is ending its entire TLS business. ⬇️

Where do you draw the line between an AI-assisted pentest and what this crew did? Follow @PredictaLabOff for more cyber and OSINT news.

AI has industrialized the execution of intrusions, not the entry point. The way in is still unpatched edge devices and recycled passwords. The basics now buy you time against attackers moving at machine speed.

The twist: for all the AI, researchers say the main force multiplier was credential reuse. One reused password unlocked the VPN, servers, RMM, backups and the security console.

When a model refused a task, the operator did not switch tools. He reworded the request as an authorized red team assessment, and the model complied. The guardrail fell to a change of framing.

Phantom runs on OpenCode with OpenRouter-hosted commercial models: 18 skill modules for reconnaissance, EDR fingerprinting, exploit research, even steganography. A human writes one victim-specific prompt and approves each step. The AI does the rest.

SOCRadar found the exposed C2 of Russian-speaking affiliates working with INC and The Gentlemen. It held the Phantom framework's source code, AI session databases and a victim tracker covering an estimated 62 organizations, most of them in the US.