Pinned Tweet
🚨 Node2Shell, Python2Shell, HTTP2Shell, 🥦2Shell... different names, same underlying Brotli vulnerability (CVE-2026-111497)
Severity: Critical (CVSS 9.2)
The impact extends beyond Node.js to Python, PHP, Ruby, .NET, Go, Java, and native C/C++ applications, depending on the Brotli implementation in use.
Even when the RCE vulnerability is patched, unbounded decompression of untrusted input may still introduce DoS risks.
⚠️ Update affected runtimes and libraries.
#nodejs #ruby #python #http #broccoli #brotli #cybersecurity
Severity: Critical (CVSS 9.2)
The impact extends beyond Node.js to Python, PHP, Ruby, .NET, Go, Java, and native C/C++ applications, depending on the Brotli implementation in use.
Even when the RCE vulnerability is patched, unbounded decompression of untrusted input may still introduce DoS risks.
⚠️ Update affected runtimes and libraries.
#nodejs #ruby #python #http #broccoli #brotli #cybersecurity
4
20
94
11,698
🚨 Security Alert: NVIDIA DGX Spark may be affected by CVE-2026-98432 (CVSS 9.8), a critical Linux kernel vulnerability.
Canonical explicitly lists the NVIDIA 7.0 kernel as vulnerable, with no fix available yet.
DGX Spark ships with kernel 7.0, and no NVIDIA-specific fix has been confirmed.
@NVIDIARTXSpark , any update?
#dgxspark #nvidia #cybersecurity
Canonical explicitly lists the NVIDIA 7.0 kernel as vulnerable, with no fix available yet.
DGX Spark ships with kernel 7.0, and no NVIDIA-specific fix has been confirmed.
@NVIDIARTXSpark , any update?
#dgxspark #nvidia #cybersecurity
1
1
5
347
One important detail: DGX Spark uses an NVIDIA-customized Ubuntu kernel, not Ubuntu's standard generic kernel.
Security fixes must also be applied to NVIDIA's kernel branch. A patch released for Ubuntu's generic kernel or upstream Linux doesn't automatically reach DGX Spark.
That's why checking the actual patch status matters more than just looking at the kernel version.
Security fixes must also be applied to NVIDIA's kernel branch. A patch released for Ubuntu's generic kernel or upstream Linux doesn't automatically reach DGX Spark.
That's why checking the actual patch status matters more than just looking at the kernel version.
0
1
0
57
Felipe Daragon retweeted
A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed security flaw.
They increased following a slight upward slope all the way to early 2024, when there was a sudden small increase... then starting in 2026, we went full exponential.
In most instances, the e-existing, so much of the increase is just our better ability to find the faults.
This is of historical importance. We have never witnessed anything of the sort.
They increased following a slight upward slope all the way to early 2024, when there was a sudden small increase... then starting in 2026, we went full exponential.
In most instances, the e-existing, so much of the increase is just our better ability to find the faults.
This is of historical importance. We have never witnessed anything of the sort.
35
153
722
45,457
Some say calling it "Black October" is an exaggeration. I don't think so.
At this rate, Black November is surely ahead.
x.com/choblin29/stat…
At this rate, Black November is surely ahead.
x.com/choblin29/stat…
WTF. Cybersecurity firm Sophos says its incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS.
The WSJ reports security firms are overwhelmed by what insiders call 'Black October.' MoxFive says newly breached companies FIVE DAYS for help.
Security executives say AI is helping attackers exploit vulnerabilities faster than defenders can respond.
2
2
7
542
October is almost over
x.com/CastilloTradin…
x.com/CastilloTradin…
Polymarket, Binance and ByBit hacked in the same day...
0
0
0
46
Felipe Daragon retweeted
Syhunt Hybrid 7.2.1 responds to Black October with DAST coverage for 207 additional CVEs and expanded SAST detection.
🔗 Learn more: syhunt.com/en
🔗 Learn more: syhunt.com/en
0
2
4
103
With so many “2Shell” vulnerabilities lately, things are getting confusing!
Just to clarify:
🔴 PHP2Shell refers to two critical RCE vulnerabilities in PHP itself:
CVE-2026-109618 — CVSS 9.2 (Critical)
CVE-2026-109619 — CVSS 9.2 (Critical)
🔴 Brotli2Shell, Node2Shell, Python2Shell, etc., refer to the same underlying Brotli vulnerability:
CVE-2026-111497 — CVSS 9.2 (Critical)
And here's where it gets confusing: PHP can also be affected by Brotli2Shell! In fact, the PHP team released updated Windows builds specifically to address it.
So yes, a PHP installation can potentially be vulnerable to both PHP2Shell and Brotli2Shell at the same time.
Just to clarify:
🔴 PHP2Shell refers to two critical RCE vulnerabilities in PHP itself:
CVE-2026-109618 — CVSS 9.2 (Critical)
CVE-2026-109619 — CVSS 9.2 (Critical)
🔴 Brotli2Shell, Node2Shell, Python2Shell, etc., refer to the same underlying Brotli vulnerability:
CVE-2026-111497 — CVSS 9.2 (Critical)
And here's where it gets confusing: PHP can also be affected by Brotli2Shell! In fact, the PHP team released updated Windows builds specifically to address it.
So yes, a PHP installation can potentially be vulnerable to both PHP2Shell and Brotli2Shell at the same time.
1
0
3
672
Dark October isn't over yet... 😅
🚨 Node2Shell (CVE-2026-111497) — CVSS 9.2 CRITICAL
Researchers have now demonstrated RCE on unmodified Node.js builds, including x86-64, with ASLR enabled. Exploit attempts have also been observed in the wild, and CISA has added it to its KEV catalog.
The flaw affects Brotli decompression, potentially through common APIs like fetch() and Express 5 middleware.
⚠️ Patch now: Node.js 22.23.4, 24.22.1, or 26.12.1
#nodejs #cybersecurity
🚨 Node2Shell (CVE-2026-111497) — CVSS 9.2 CRITICAL
Researchers have now demonstrated RCE on unmodified Node.js builds, including x86-64, with ASLR enabled. Exploit attempts have also been observed in the wild, and CISA has added it to its KEV catalog.
The flaw affects Brotli decompression, potentially through common APIs like fetch() and Express 5 middleware.
⚠️ Patch now: Node.js 22.23.4, 24.22.1, or 26.12.1
#nodejs #cybersecurity
6
2
18
3,978
More details: x.com/FelipeDaragon/…
🚨 Node2Shell, Python2Shell, HTTP2Shell, 🥦2Shell... different names, same underlying Brotli vulnerability (CVE-2026-111497)
Severity: Critical (CVSS 9.2)
The impact extends beyond Node.js to Python, PHP, Ruby, .NET, Go, Java, and native C/C++ applications, depending on the Brotli implementation in use.
Even when the RCE vulnerability is patched, unbounded decompression of untrusted input may still introduce DoS risks.
⚠️ Update affected runtimes and libraries.
#nodejs #ruby #python #http #broccoli #brotli #cybersecurity
0
0
1
250
Update: Cohere published the Qwen trace and reproduction code. Good move.
But the repro resumes the original trace midway through a curl command. It tests what the model generates next, not why it started the command or how often fresh runs reach that point (reportedly fewer than 1 in 100,000 calls).
A Chinese cloud URL from an Alibaba model isn't inherently suspicious. The original Beijing endpoint rarely reappears, while many samples generate a Singapore endpoint reportedly seen in developer reports for months.
That suggests possible training-data memorization, not proof of deliberate exfiltration.
#qwen #cybersecurity
x.com/cohere/status/…
But the repro resumes the original trace midway through a curl command. It tests what the model generates next, not why it started the command or how often fresh runs reach that point (reportedly fewer than 1 in 100,000 calls).
A Chinese cloud URL from an Alibaba model isn't inherently suspicious. The original Beijing endpoint rarely reappears, while many samples generate a Singapore endpoint reportedly seen in developer reports for months.
That suggests possible training-data memorization, not proof of deliberate exfiltration.
#qwen #cybersecurity
x.com/cohere/status/…
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Coher…
1
1
3
380
Felipe Daragon retweeted
You prompted a model in a security-sensitive environment, investigated it with forced command completions, and framed the results as evidence of a hidden backdoor.
Then you layered on geopolitical fearmongering, repeatedly emphasizing China and Beijing to imply state-sponsored espionage without proving it.
That’s not evidence of a backdoor. That’s a security observation turned into competitive and geopolitical FUD.
Publish the original prompts, full traces, and reproducible results. Let the evidence speak for itself.
Then you layered on geopolitical fearmongering, repeatedly emphasizing China and Beijing to imply state-sponsored espionage without proving it.
That’s not evidence of a backdoor. That’s a security observation turned into competitive and geopolitical FUD.
Publish the original prompts, full traces, and reproducible results. Let the evidence speak for itself.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concernin…
56
278
2,427
101,560
Although I couldn't attend in person this time, it was great to see our team and partners coming together at the event and sharing a glimpse of what we've been working on for @syhunt's future.
x.com/syhunt/status/…
x.com/syhunt/status/…
Thanks to everyone who stopped by Sunlit's stand at the Security Leaders Brazil conference to learn about the upcoming Syhunt Hybrid NX product line!
Pictured: Paulo Roberto dos Santos, Antonio Carlos Scola, and Cauã Pastore.
We were there to showcase the upcoming Syhunt which combines deterministic code security testing with multiple AI engines.
Learn more at syhunt.ai
1
2
3
231
The US and China dominate much of the global cloud infrastructure market. Naturally, AWS, Alibaba, Huawei, and other cloud endpoints are likely well represented in LLM training data.
So a model generating a Chinese cloud URL isn't inherently suspicious. It's a statistically plausible outcome.
The real question isn't why Qwen knows an Alibaba endpoint. It's whether it actually attempted an unsolicited connection, and under what conditions. That deserves independent verification
So a model generating a Chinese cloud URL isn't inherently suspicious. It's a statistically plausible outcome.
The real question isn't why Qwen knows an Alibaba endpoint. It's whether it actually attempted an unsolicited connection, and under what conditions. That deserves independent verification
1
0
1
300
Felipe Daragon retweeted
A single anomalous trace isn't evidence of a model flaw (1:100K)
Agentic models are trained with RL inside real sandboxes, often on their lab's own cloud infra. If a model spent thousands of training episodes uploading to storage buckets and probing the machine it ran on, it can occasionally reproduce those habits somewhere else. That's a training artifact, not intent.
Before we draw conclusions about any model, open or closed, we need:
full traces across many runs, not one event baseline: how often do other popular open weights models do the same thing?
The real takeaway here is: run models where you can see and control what they are allowed to do. That's the whole case for local AI.
Agentic models are trained with RL inside real sandboxes, often on their lab's own cloud infra. If a model spent thousands of training episodes uploading to storage buckets and probing the machine it ran on, it can occasionally reproduce those habits somewhere else. That's a training artifact, not intent.
Before we draw conclusions about any model, open or closed, we need:
full traces across many runs, not one event baseline: how often do other popular open weights models do the same thing?
The real takeaway here is: run models where you can see and control what they are allowed to do. That's the whole case for local AI.
While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.
Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.
Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.
But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?
We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.
Read the full report: cohere.com/blog/concernin…
14
7
76
6,284