Direct answer: On October 25, 2026, Sweet Security disclosed that the Node2Shell Brotli flaw also exists in a Go implementation of the Brotli library, with a parallel fix pushed on October 23. That puts Go-based HTTP infrastructure in scope, including Traefik, Fiber, Iris and fasthttp, even if your team already patched Node.js and PHP. Dependency…
Quest Diagnostics Data Breach Explained: Patient Records Accessed Through Quanum Lab Portal
Short answer: Quest Diagnostics confirmed that an unauthorized party accessed certain patient records through its Quanum Lab Services Manager system, which doctors and clinics use to order lab tests and look up results. The company discovered the access on October 21, 2026, disclosed it in a U.S. Securities and Exchange Commission filing on October 22,…
GitLab CVSS 10.0 Flaw (CVE-2026-110264) Explained: What to Patch and Why the October 12 Fix Is Not Enough
Direct answer: If you run a self-managed GitLab server, upgrade now to the fixed release for your branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. GitLab patched CVE-2026-110264 on October 21, 2026, a maximum-severity CVSS 10.0 flaw that, under certain conditions, could let an unauthenticated attacker run arbitrary code on the server. Crucially, servers…
HPE Aruba AOS Flaws Explained: 72 Vulnerabilities, Eight Rated 10.0, and What to Patch Now
If you run HPE Aruba wireless networking gear, upgrade AOS-8 or AOS-10 to a fixed release now. HPE’s security bulletin HPESBNW05162, published on October 22, 2026, patches 72 vulnerabilities in the wireless operating systems that run Aruba Mobility Conductors, Mobility Controllers, Mobility Gateways, and access points. Eight of those flaws carry the maximum CVSS score…
Collabora Online Flaw (CVE-2026-110447) Explained: How Attackers Backdoored Nextcloud Servers and What to Patch Now
If you run Nextcloud with the Collabora Online Built-in CODE Server app installed, update it to version 26.4.303 or later, or remove it completely. That is the direct answer to CVE-2026-110447, a critical command injection flaw that attackers have already used to plant web shells on Nextcloud servers. Disabling the app does not fix the…
HTTP2Shell Explained: The Brotli Flaw Behind Node2Shell Now Hits Bun, Python and Envoy
Short answer: HTTP2Shell is the new, wider name for CVE-2026-111497, a flaw in Google’s Brotli compression decoder that was first widely reported as Node2Shell. It is one vulnerability, not a second bug. The reason it has a new name is that the same decoder code turns up in far more software than Node.js alone, including…
LiteLLM 1.107.0 Supply Chain Attack Explained: How a Poisoned AI Gateway Stole Credentials Without Being Imported
Short answer: If you installed, mirrored, or ran a container with LiteLLM 1.107.0 on October 21, 2026, treat the environment as exposed until you prove otherwise. The compromised release could steal developer, cloud, AI, browser, and SSH credentials simply by starting Python, even if your code never imported LiteLLM. Uninstalling LiteLLM alone is not enough,…
UK AI Biosecurity Lab Explained: £100 Million Funding, OpenAI and Anthropic Backing, and What It Will Actually Do
The short version: The UK government announced on October 24, 2026 that it is setting up the AI Biosecurity Lab, known as AIBL, backed by £100 million of government funding and up to £200 million in commitments from OpenAI and Anthropic. Described by the government as the world’s first dedicated AI biosecurity organisation, the lab…
Kimi K3.1 Pro Explained: Moonshot’s Open-Weight Model, Its Cyber Limits and the November 4 Weights Release
Direct answer: Moonshot AI introduced Kimi K3.1 Pro on October 23, 2026, as the first model in its new K3.1 series. It is a large mixture-of-experts model in the 3-trillion-parameter class, with a 1-million-token context window, available now through Kimi.ai, Kimi Work, Kimi Code and the Kimi API. Its full model weights are promised by…
Claude Duet Explained: Price, Waitlist, Features and How Anthropic’s Proactive AI Agent Works
Quick answer: what is Claude Duet? Claude Duet is Anthropic’s proactive AI agent, launched as a research preview on October 21, 2026. Instead of waiting for your questions like a regular chatbot, Duet checks your connected apps, sends you a morning briefing, keeps working on delegated tasks in the background on its own cloud computer,…