🚨CVE-2026-111497 (Node2Shell): a critical flaw in Google's Brotli decoder may let remote attackers execute code on servers that decompress untrusted Brotli data. Affects Node.js and Bun. Patch now: Node.js 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4. ethiack.com/info-hub/researc…

🟢 Last call to join the Speed Pwning bracket-based CTF at @BsidesLisbon on Thursday, October 29! Two players go head-to-head. Each match presents both competitors with the same CTF challenge at the same moment. The first to submit a valid flag advances. Check out all the details below ↓

Attackers don’t wait for the CVE. Neither does Ethiack Zero, now live for 3 days. Here’s why we built it 👇 ethiack.com/info-hub/researc…

If you haven't checked out zerodayclock.com lately, go take a look. It tracks zero-day exploitation pressure, showing CVEs exploited (KEV) upon public release surging to about 154% compared to the same quarter last year. Attackers often exploit new vulnerabilities before defenders can react, sometimes before the vulnerability even gets a public CVE ID. The Zero Day Clock documents the problem. Ethiack Zero is the live tracker built to keep you ahead of it. Explore it live ↓ zero.ethiack.com/

Attackers often exploit new vulnerabilities before defenders can react. The clock runs out before the CVE even drops. In the first half of 2026, 487 vulnerabilities were listed as exploited. For 137 of them (>25%), the exploitation record existed on or before the day the CVE was published. We built Ethiack Zero to track emerging vulnerabilities from the first public signal (a patch commit, a GitHub advisory, a researcher's post) and validate actual exploitability before the CVE is even minted. Explore Ethiack Zero ↓ zero.ethiack.com/

Zero is already watching CVE-2026-109619. 👀 zero.ethiack.com/e/CVE-2026-…

Yesterday we asked: what if you could turn back the clock? We can’t, but we can see it sooner. Ethiack Zero is live: a public record of emerging 0-days. Open feed, API, MCP and methodology. Check our numbers and tell us what’s missing. zero.ethiack.com

For a long time, the CVE publication was the starting gun. Today, exploitation often starts before that. Tomorrow, we’re sharing something with the community about that gap.

Manual retesting of every AI-generated code change is not a scalable security strategy in 2026. It creates gaps between the speed of releases, and attackers don’t wait for your next pentest. Our AI-powered continuous testing helps teams reassess their exposure as systems change at the same speed. Human experts remain essential for interpreting risk and deciding what to do next. Continuous AI-powered security testing, with human expertise guiding what happens next.

Testing an AI pentesting agent only once means you're only seeing half the picture of how it actually performs. 👀 Because LLMs are probabilistic, outputs change from run to run. In agentic pentesting, small shifts in early exploration multiply, leading to entirely different results by the end of an engagement. A single run tells you almost nothing. But running dozens of end-to-end tests is expensive, so most teams test only 2 or 3 times. In this low-replication zone, standard p-value testing stops being reliable: with so few runs, a non-significant result often just means your sample size is too small to detect a real difference, not that the upgrade failed. We built Ethibench to test AI pentesting agents properly, with the replication these systems actually need. Find out more in the repo👇