Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
88
- Mentions · 7d2
- Mentions · 30d10
- All mentions16
- First seenAug 19, 2026
- Last mentioned2d ago
Timeline
16 articles · newest firstUpwind Security raises $400 million Series C at $3.8 billion valuation
The round comes nine months after a $250 million raise and follows disputed reports that Datadog offered nearly $4 billion to acquire the startup.
25
PHP fixes two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619
Patched builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; PHP 5 through 8.1 stay vulnerable and unpatched.
86
Datadog tests security rules on coding agents' secure code
Without rules, Sonnet 5, Composer 2.5, and GPT 5.5 all left IDOR flaws in a document portal.
46
10 Best RASP Tools Compared (2026): Features & Pricing
A 2026 buyer's guide compares ten RASP and runtime-protection products, led by Contrast and Waratek.
22
Top 10 Best DevSecOps Platforms in 2026 [Ranked & Scored]
A 2026 ranking puts GitLab, GitHub Advanced Security, and Snyk atop DevSecOps platforms by developer fix rates.
22
9 Best IAST Tools Compared (2026): Features & Pricing
A 2026 comparison ranks nine IAST tools, led by Contrast Security, Seeker, Dynatrace, and Datadog.
24
Top 10 Best IAST Tools in 2026 [Ranked & Scored]
A 2026 IAST ranking puts Contrast Security first, then Black Duck Seeker and Datadog.
16
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
Datadog found harvesters testing stolen AWS keys specifically for Amazon Bedrock access.
66
Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals
Datadog found over 3,500 dangerous RBAC grants to Kubernetes built-in principals across 65,000 clusters.
62
Security Teams Can Now Monitor Claude Chats, Files and AI Agent Activity
Claude's Compliance API lets security teams monitor chats, files, and AI agent activity in SIEM and DLP tools.
58
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
Datadog demonstrates remote code execution in OpenCode AI coding agent via content-type confusion in the /global/upgrade endpoint, fixed in 1.18.22.
60
How we made claude.ai 3x faster in two weeks
Anthropic cut core claude.ai and desktop latency about 3x in two weeks, using Claude to find and ship fixes.
54
Password spraying campaign targets AWS root user accounts across 150+ organizations
Datadog researchers observed a password spraying campaign attempting to authenticate as AWS root users across 150+ organizations.
68
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
Datadog researchers detonated a new N4D Mesh Controller sample in microVMs, revealing rotated infrastructure, a UPX-packed go-titan agent, and persistence behavior.
55
Putting models to the secure coding test: Plan vs default mode
Datadog Security Labs tested Sonnet 5, Composer 2.5, and GPT 5.5 to see if plan mode yields more secure code than default mode.
45
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Datadogvendor · 6
- Contrast Securityvendor · 3
- Claude Codeproduct · 3
- HCLorganization · 3
- Checkmarxorganization · 3
- OpenTextvendor · 3
- Veracodevendor · 3
- Checkmarxvendor · 3
- Veracodeorganization · 3
- Anthropicvendor · 3
- Fortifyproduct · 3
- Contrast Securityorganization · 3
- HCLvendor · 3
- OpenTextorganization · 3
- Black Duckorganization · 2
- Amazon Web Servicesvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.