For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.

https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497

#infosec #cybersecurity #CVE_2026_111497

The week only keeps getting better... apparently, multiple not yet fixed Linux kernel vulnerabilities were disclosed by accident when they were posted to the public mailing list rather than the private one. Oops.

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities

#infosec #cybersecurity

You can just drop the #eMudhra CA certificate to #mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive...

https://docs.mitmproxy.org/stable/concepts/certificates/#the-mitmproxy-certificate-authority

#pentesting #cybersecurity #infosec

The long term impact of this #eMudhra intermediate CA cert private key disclosure: It is now possible to perform TLS MiTM to millions and millions of older #IoT devices (or other devices that won't or can't get updated). The root certificate that has signed the affected intermediate certificate was added to trust stores in about beginning of 2019 (*). It expires only in 18-feb-2043.

This opens the avenue for all kinds of nasty things.

*) https://bugzilla.mozilla.org/show_bug.cgi?id=1442337

#infosec #cybersecurity

You peeps remember when it was a big deal that #CVE ID format would have to be changed because more than 9999 vulnerabilities would get reported per year?

Simpler times, eh…

https://www.cve.org/Resources/Media/Archives/OldWebsite/data/board/archives/2007-01/msg00000.html

#infosec #cybersecurity

#Debian [DSA 6528-1] linux kernel #security update has fixes to 1313 CVEs.

https://lists.debian.org/debian-security-announce/2026/msg00441.html

So yeah #Debian DSA 6466-1 fixed 239 CVEs. Were any of them of practical impact? No freaking idea.

https://lists.debian.org/debian-security-announce/2026/msg00377.html

#enshittification

I recently discovered a command injection vulnerability (CWE-78) from Info-ZIP (zip). Advisory: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt

The fix is now available in #Debian as DSA 6439-1: https://lists.debian.org/debian-security-announce/2026/msg00350.html

Other platforms shipping zip command should also pick up the patch: https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch

NOTE: macOS included zip command is not affected.

#advisory #vulnerabilityresearch #cybersecurity #infosec

It appears that AI companies target open source contributors with their marketing spam:

"we noticed you contributed to curl/curl — thanks for helping build open source. We're running a small program for Github OSS contributors and would love to invite you.

You'll receive $25 in XXXXXXXXX credits to use frontier AI models (this time YYYYY) through a single OpenAI-compatible endpoint."

#enshittification

Back when the "internet" involved expensive phone calls and modems, someone figured out that a video backup system (VBS) could be used to distribute hundreds of megabytes of "backups" between friends by shipping a VHS cassette in a padded envelope.

You just needed a VCR (everyone had one), and a small harness that could sample the video signal from the VCR for the software to decode.

Interestingly, the Video Backup System website is still up: http://www.hugolyppens.com/VBS.html

I'm sure someone used this thing for actual backup purposes as well...

LG monitors quietly install adware. https://www.youtube.com/watch?v=Q9uefFYe6bM

#privacy #enshittification