Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Honeypot data shows attackers successfully exploiting the PHP2Shell vulnerabilities to execute shell commands on PHP servers.

Migrate an MCP server to SDK v2 in Python and TypeScript: rename FastMCP, run the codemod, add tests, serve over HTTP. 12 ...