Node2Shell: npm audit can't see the Node.js Brotli RCE
CVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.
Categories
Developer Tools
The editors, CLIs, runtimes and infrastructure that shape how software gets built.
eMudhra quits TLS, but your servers still trust its broken CAs
The exit announcement fixes nothing on your machines. Why the cracked eMudhra keys still work outside browsers, and the audit to run before mitmproxy users find you.
PHP2Shell: patch the PHP engine tonight, not your app
Two critical PHP engine bugs give attackers code execution before your app even runs. Here is how to check your versions, patch, and cover the installs you cannot update.
Claude Code skips AGENTS.md when telemetry is off: check your setup
Opting out of telemetry quietly stops Claude Code reading AGENTS.md. A fix is promised in 2.1.281 but hasn't reached npm's latest tag. Here's a five-minute audit.
WordPress CVE-2026-87902: how to tell if you are exposed
CVE-2026-87902 touches every WordPress release since 4.7, but code execution needs a specific theme and PHP setup. Here is how to check yours, and your logs.
Google's AX names agent workloads as a Kubernetes-native problem
AX treats AI agents as a distinct Kubernetes workload. Its four primitives are worth studying even if you never run the runtime itself.
Plugin4Shell breaks SHA pinning in four AI coding agents at once
A shared design flaw lets attackers swap pinned plugin code in four major AI coding agents without any user action. Two vendors still have no fix.
Homebrew 7.0.0: what breaks on Monday and what to adopt
A migration walkthrough for Homebrew 7.0.0: the Intel Mac cliff, the CI and Brewfile flags that vanished, the Linux sandbox swap, and the two new commands worth adopting today.