The Hacker News

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one ...
ABS-CBN on MSN

PHP, Node.js, eMudhra, and LiteLLM lead busy week for security teams

Security roundup: PHP2Shell, eMudhra certificate failures, Node.js security fixes and the LiteLLM supply-chain attack reshape ...
xenospectrum

DeepSeek Chrome Exploit Claim Lacks Evidence, While AI-Driven Attacks Are Confirmed Elsewhere

A viral post says DeepSeek's new model broke Chrome's V8 Sandbox in 12 hours, but no code, CVE, or independent verification ...
Cybernews

PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...

The specification is only 3 lines long. Yet it doesn't work — Calling a local app from a browser extension

Browser extensions live inside a box.They can touch the page's DOM. They can peek at network traffic. They can have storage. But they cannot "launch an app installed on this PC." That would be a major ...