Uh oh: ⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well. ht @jerry@infosec.exchange https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497