Details

Written by: MrHorda

A 9.2 critical out-of-bounds write in Google's Brotli decoder hits every version from 1.0.3 to 1.2.0. Node.js called it Node2Shell on 22 October. Python followed the next day, because requests, httpx and aiohttp load the vulnerable package automatically. Fix is Brotli 1.2.1 or brotlicffi 1.2.1.0, and you have to rebuild your images, not just your lock file. Here is the ugly part: advisory databases do not map the CVE to the PyPI packages yet, so your scanner will report you clean while you are exposed.

Details

Written by: MrHorda

For years the kill switch was doomsday thinking in London and Brussels. Then the US shut off intelligence and throttled Starshield for Ukraine, and according to the Wall Street Journal, one CEO ordered it personally. Steve Blank, in London all month, says the question in every room is now what happens if Microsoft, OpenAI or Oracle decide to cut you off. His argument: AI just made rebuilding that stack affordable. Sovereignty stopped being a moral argument and became an engineering one.