Skip to main content

Aggregator

Morning news brief

22 hours 16 minutes ago
U.S. and Israel are planning for a possible attack on Iran, millions of Americans have voted early, judge orders President Trump to sit for deposition in BBC lawsuit.

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

22 hours 20 minutes ago
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

22 hours 25 minutes ago
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set