Brotli decoder flaw CVE-2026-111497 can lead to remote code execution
Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.
82
- Mentions · 7d0
- Mentions · 30d7
- All mentions15
- First seenSep 21, 2026
- Last mentioned17d ago
Timeline
15 articles · newest firstBrotli 1.2.1 published for CVE-2026-111497
An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.
46
Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
82
LiteLLM release pipeline hacked to distribute credential-stealing malware
Malicious version 1.107.0 stayed on PyPI for about two hours on October 21 before removal.
78
Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
78
Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
82
10 Best Secrets Detection Tools Compared (2026): Features & Pricing
A 2026 comparison ranks ten secrets-detection tools, from GitGuardian and TruffleHog to free GitHub and Gitleaks scanning.
18
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
Malicious tensorlake@0.5.144 on npm delivers a Shai-Hulud worm that steals developer secrets and can wipe hosts.
82
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.
77
Exposed GitLab project email addresses let attackers push code
Aikido warns published GitLab incoming-email tokens can let outsiders open merge requests and push code as the owner.
61
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
80
Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT
Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.
75
The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
75
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
73
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
Appears with
- Socketorganization · 5
- GitHuborganization · 5
- Wizorganization · 5
- npmproduct · 5
- Graphalgomalware · 3
- Terraformproduct · 3
- LiteLLMproduct · 3
- BerriAIvendor · 3
- SafeDeporganization · 2
- PyPIproduct · 2
- Tensorlakevendor · 2
- GitHubvendor · 2
- Shai-Huludmalware · 2
- Brotliproduct · 2
- tensorlakeproduct · 2
- GitGuardianorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.