DAILY BRIEFING
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used…
Today's briefing covers widespread Brotli decoder bugs, a supply chain leak in LiteLLM, and new active exploits flagged by CISA.
5 stories3 min read
Software supply chain risks and unpatched infrastructure flaws dominate today's security developments. Organizations relying on open-source components and enterprise appliances face urgent maintenance tasks.
First, a memory-corruption vulnerability in Google's Brotli decoder impacts widely used software ecosystems including Node.js, Bun, Python, and Envoy. At the same time, CISA has added actively exploited vulnerabilities in Collabora Online and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog.
Security teams should immediately audit exposed secrets in developer repositories, apply vendor patches for perimeter systems listed in the CISA catalog, and update Brotli dependencies across environments.
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
An Agent Platform master key leaked in a public GitHub repository (LiteLLM-Labs/lite-harness) in late May 2026 allowed attackers to steal GitHub tokens. The threat actor subsequently used the stolen access to hijack LiteLLM's release pipeline and publish a malicious version of the Python package.
- What to do
- Rotate exposed API keys and GitHub tokens, audit CI/CD release pipelines, and verify LiteLLM package integrity.
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
CISA added CVE-2026-110447 in Collabora Online Built-in CODE Server and CVE-2026-114625 in Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog following active exploitation in the wild. The bugs allow OS command injection and SQL injection respectively.
- What to do
- Update Collabora Online Built-in CODE Server to version 26.4.303 or later and apply patches for Arista VeloCloud Orchestrator.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.
- Why it matters
- Because each affected application bundles its own copy of Google's Brotli decoder, organizations relying on these runtimes and proxies must track and apply individual vendor updates to prevent code execution.
- What to do
- Update affected runtimes and packages including Bun, Envoy, and Python Brotli dependencies to patched versions.
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google updated its privacy policy effective October 16, 2026, clarifying that data shared from Google Photos, Gmail, and Drive with AI features in Search or Gemini Apps may be processed to deliver targeted advertisements.
- Why it matters
- Users and organizations integrating personal or Workspace data into Google Search and Gemini AI features may expose content from Gmail, Photos, and Drive to personalized ad targeting.
- What to do
- Review Google account privacy settings to restrict cross-service data sharing between Workspace apps and Search/Gemini.
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Dutch security firm Eye Security conducted Operation IXIM, issuing over two million remote updates to disable a vulnerable background updater (Updater.exe) in the abandoned Time4Popcorn application. The unregistered domain queried by the updater posed a risk of being hijacked for a large-scale botnet.
- What to do
- Hunt for and remove unauthorized legacy software like Time4Popcorn and block connections to unverified update domains.
Key takeaways
- Update Brotli decoder implementations across Node.js, Bun, Python, and Envoy to patch memory-corruption flaw CVE-2026-111497.
- Patch Collabora Online Built-in CODE Server (CVE-2026-110447) and Arista VeloCloud Orchestrator (CVE-2026-114625) following CISA warnings.