AJ Stuyvenberg retweeted
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
174
186
3,204
454,365
AJ Stuyvenberg retweeted
I want to see answers, because eMudhra’s explanation of how they mis-generated the private key for a certificate doesn’t add up.
It also doesn’t add up how they claim the process was faulty one day; but not the next; and they did nothing about it for 1.5 years (???)
It also doesn’t add up how they claim the process was faulty one day; but not the next; and they did nothing about it for 1.5 years (???)
Folks at Mozilla seem to have caught on and are asking the right questions 🫡
bugzilla.mozilla.org/show_bug.cgi?i…
45
61
1,029
75,128
Observability, especially in this wild world is:
"By far the highest return on investment you can make"
- @DanielLockyer performance enthusiast, extreme jogger, expert poster
"By far the highest return on investment you can make"
- @DanielLockyer performance enthusiast, extreme jogger, expert poster
I love adding observability to a system that previously had none
Not only do you learn a lot about what your code/infra is doing, but even the process of adding observability reveals a lot
By far the highest return on investment you can make
1
2
46
3,397
setting aside the disclosure drama, Chainguard CEO says they were able to independently find the issue with their harness, a frontier model, and...
a prompt of "find bad vulnerabilities in PHP"
a prompt of "find bad vulnerabilities in PHP"
2
2
22
2,018
AJ Stuyvenberg retweeted
I'm on the ballot for the OpenTelemetry Governance Committee. Four seats, and voting opens Monday. I'd be glad to serve this community.
Candidates and details: opentelemetry.io/blog/2026/gc-c…
Candidates and details: opentelemetry.io/blog/2026/gc-c…
0
4
7
774
AJ Stuyvenberg retweeted
To be direct about it: every company that considers themselves a “tech” company is currently building a much worse version of something they could buy off the shelf, and furthermore they often have several teams competing on this front
Then they launch it after 3-6 months of building in a silo and can’t get their colleagues to use it for entirely predictable reasons
Coding agents and their adjacent products are among the most competitive markets of all time. The benefits of a highly competitive market accrue to customers by virtue of this intense competition among suppliers. Econ 101
Is the internal team working on your agent platform really keeping pace with the market? Even if they put in the same hours (they don’t), they don’t have the breadth of customers and hard contact with the market to get the feedback necessary to make the product any good
Big corporates that call their devs “IT” don’t delude themselves in this way. They buy the best, recognize their relative advantage (vendors will build almost anything for you because the competitive pressures demand it), and get back to work
Then they launch it after 3-6 months of building in a silo and can’t get their colleagues to use it for entirely predictable reasons
Coding agents and their adjacent products are among the most competitive markets of all time. The benefits of a highly competitive market accrue to customers by virtue of this intense competition among suppliers. Econ 101
Is the internal team working on your agent platform really keeping pace with the market? Even if they put in the same hours (they don’t), they don’t have the breadth of customers and hard contact with the market to get the feedback necessary to make the product any good
Big corporates that call their devs “IT” don’t delude themselves in this way. They buy the best, recognize their relative advantage (vendors will build almost anything for you because the competitive pressures demand it), and get back to work
13
13
216
62,051
AAAWWWWWOOOOOOOOOGGGGAAA
It looks like a subset of the GitLab vulnerabilities stem from an issue in Ruby’s regexp compilation library
Time to patch ruby-lang.org/en/news/2026/1…
It looks like a subset of the GitLab vulnerabilities stem from an issue in Ruby’s regexp compilation library
Time to patch ruby-lang.org/en/news/2026/1…
We released Ruby 4.0.9, 3.4.12, and 3.3.13, and published an announcement about Regexp compilation fixes.
ruby-lang.org/en/news/2026/1…
If your application compiles a regular expression from an untrusted string, please update your Ruby to one of those versions.
3
3
39
3,986
AJ Stuyvenberg retweeted
datadog's ai agents now get a risk score on each shell command they write, before it runs.
the check uses openai's new decisions api, which returns a yes/no, a choice or a score instead of writing a full reply.
@astuyve from @datadoghq says it was "40x faster p95 with an frontier models, fast enough to run the check inside each fix.
the check uses openai's new decisions api, which returns a yes/no, a choice or a score instead of writing a full reply.
@astuyve from @datadoghq says it was "40x faster p95 with an frontier models, fast enough to run the check inside each fix.
3
1
3
251
If you’re the PM who made the call, and gave up a reinvent keynote slot because this was necessary - DM me in the AWS Hero channel.
I want to get you something nice in Vegas.
I want to get you something nice in Vegas.
I wonder if this was originally a re:Invent release that just got shoved out the airlock given the current state of the internet.
1
0
50
5,587
AJ Stuyvenberg retweeted
This morning, we have revoked and disabled all API keys related to the Railway leak
Everyone affected will have received an email in their inbox
Thank you to the OR team for working overnight while on our offsite to keep our devs safe
Let me know if you have any questions!
Everyone affected will have received an email in their inbox
Thank you to the OR team for working overnight while on our offsite to keep our devs safe
Let me know if you have any questions!
8
3
59
2,155
AJ Stuyvenberg retweeted
things are going to get worse before they get better, but overall I think the outcome of all of this will be the global infrastructure the masses use becomes a lot more secure while slop sites that few people use are still insecure pieces of shit
9
9
151
7,958
AJ Stuyvenberg retweeted
If you're in line to announce a CVE stay in line I guess
AAAAWWOOOOOOOGAAAAAAAAA
A high severity vulnerability in "the most widely deployed DNS software on the internet" just dropped
kb.isc.org/docs/cve-2026-…
1
1
1
295
AAAAWWOOOOOOOGAAAAAAAAA
A high severity vulnerability in "the most widely deployed DNS software on the internet" just dropped
kb.isc.org/docs/cve-2026-…
A high severity vulnerability in "the most widely deployed DNS software on the internet" just dropped
kb.isc.org/docs/cve-2026-…
71
231
1,999
192,718
Nothing for you to update so I guess unless you own a public DNS you can go back to patching those kernels
2
1
101
19,751