Security intelligence for a world that doesn't wait.

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. It can expose services and clients that decompress attacker-controlled HTTP data to crashes, memory disclosure, or potentially code execution. Node.js, Bun, Envoy, Istio, and .NET have issued fixes, with exposure depending on how each application uses Brotli.

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can let unauthenticated requests reach remote code execution on vulnerable servers. The PHP project released fixes for PHP 8.2–8.5 on October 21. Here is what each bug does, which deployments need attention, and what to do now.

PwnEscape (CVE-2026-99999) is a Linux kernel networking flaw that lets a malicious virtual-machine guest target its host. Researchers confirmed host-memory disclosure in production sandboxes and demonstrated host crashes and host-root execution in controlled environments. Here is what the reports establish and what host operators should do.

Copy Fail (CVE-2026-31431) is a newly disclosed Linux local privilege escalation bug with a public proof of concept, broad distro impact, and serious consequences for shared servers, CI runners, and container hosts. Here is what is confirmed so far, how to check exposure, and how to remediate.

Late March 2026 brought a dense run of package compromises across CI tooling, PyPI, and npm. Here is what happened, why it matters, and what engineering teams can do right now to reduce exposure.

React2Shell (CVE-2025-55182) is a remote-code-execution risk in React Server Components that also affects Next.js App Router deployments built with vulnerable React versions. Here’s what was reported, who is exposed, and how to remediate and harden going forward.