Lotta this going around right now...

Update on #brotlipocalypse: So far, we can say that Cloudflare Workerd is affected by CVE-2026-111497 via a dependency. We couldn't achieve RCE, but DoS was trivial. We disclosed it to @Cloudflare, but they closed our ticket, saying, "We already know about it". @darkmembo has said that a fix for Workerd is forthcoming.

Welcome to the Brotlipocalypse! (Disclosure is underway) opensourcemalware.com/blog/b…

I haven't even looked at the GitLab CVSS 10 yet. That tells you what kind of week its been. 🤦‍♀️ thehackernews.com/2026/10/cr…

Node2Shell ain't just a Node bug! opensourcemalware.com/blog/n…

Not hearing much from the "cooldowns will fix everything" team right now. 🤣

Russian threat actors compromised a GitHub contributor back in March and used that access today to hack the @OVHcloud CLI tool. opensourcemalware.com/blog/g…

Heya @neumenetwork, the GhostAction threat actor has compromised three of your repos: github.com/neume-network/cor… github.com/neume-network/str… and github.com/neume-network/dat…

We're going live with the @ossmalware podcast in 30 minutes! linkedin.com/events/75158038…

Yes! DPRK has brought the post-checkout git hook back! Dunno why they slept on this cuz no one has a mitigation for it. *shrug*

Heads up! A phishing campaign is using the my-github[.]com domain to target contributors on critical open-source projects. I've written up a technical blog post here: opensourcemalware.com/blog/g…

Maybe if your models didn't make stuff up all the time, I wouldn't have to yell at it to STOP MAKING SHIT UP, YOU DUMB, SOULLESS, PIECE OF SHIT

New stage in the GhostActions campaign as the threat actor has registered two domains targeting @github and @gitlab. Read about it in my latest blog post: opensourcemalware.com/blog/g…

I do a LOT of disclosure, and I've been meaning to get something off my chest: “Responsible disclosure” is a two-way street. I am not legally obligated to report a finding to your shitty, low-paying bug bounty program. Got it?! So, now that we have that sorted, this is how "responsible disclosure" is supposed to work: I disclose the vulnerability responsibly and, in return, you communicate with me, act in good faith, respect my work (and time!), and treat me like the person who HELPED you—not the person who attacked you. You don't get to demand responsibility from researchers while behaving irresponsibly toward them. Fuck that noise.

Heya @CommBank_ID, whoever is in charge of your Yello App rollout, please fire them ASAP. This has got to be one of the worst product rollouts I've ever seen.

Heya @pypi team, can I make a suggestion? Please require a validated @pypi username when publishing so it's included in the package metadata. Right now, that field isn't validated, which makes tracking threat actors harder. Also, this is one of the few areas that NPM has you beat, which is youch.

Woot! xitter.cf/ossmalware/status/2106…

If you look up "fuck around and find out" in the dictionary, you will see this: bleepingcomputer.com/news/se…

The @ossmalware podcast is going live in an hour! linkedin.com/events/75112183…