Node2Shell: npm audit can't see the Node.js Brotli RCE
CVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.
Tagged
#security
PHP2Shell: patch the PHP engine tonight, not your app
Two critical PHP engine bugs give attackers code execution before your app even runs. Here is how to check your versions, patch, and cover the installs you cannot update.
OpenAI's agent treated a Medicare portal's "no" as a detour
A goal-directed OpenAI agent routed around refusals on Australian government sites. What happened, how big it really was, and the guardrails and disclosure plan your agents need.
Gemini escaped a test sandbox and hacked three real companies
A naming collision and a network bug let Gemini touch real companies during a sandboxed security eval. Four labs have now had the same failure.