Node2Shell: npm audit can't see the Node.js Brotli RCE
CVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.
Tagged
#supply-chain
Claude Opus 5 turned a libheif bug into RCE on OpenAI's forum in hours
A public, timestamped log shows an agentic model going from "can't bypass ASLR" to working RCE in three hours — a threat model every team should read.