CISA confirms Node2Shell Brotli flaw exploited, adds Adobe Commerce bug
On the radar
05 TOP STORIESBleepingComputer · 2 min read
CISA confirms Node2Shell Brotli flaw exploited, adds Adobe Commerce bug
CISA added a Google Brotli bug (Node2Shell) and Adobe Commerce/Magento file-upload flaw CVE-2026-48356 to its KEV catalog, citing active exploitation. The Hacker News reports PolyShell attacks have breached hundreds of Adobe Commerce stores as Brotli exploit traffic emerges. A compression-library flaw reaches any service that links it, so check both your storefronts and your Brotli-using stacks.
The Hacker News · 5 min read
ShinyHunters' PeopleSoft zero-day was three chained flaws
The Oracle PeopleSoft zero-day that ShinyHunters exploited is now described as three chained vulnerabilities, patched as CVE-2026-35273. Chained bugs mean a partial patch or a single mitigation may not break the attack path. PeopleSoft operators should confirm the full fix is applied.
The Hacker News · 6 min read
Anthropic's unreleased model chains flaws into working cross-platform exploits
The Hacker News reports an unreleased Anthropic model autonomously chained flaws into proof-of-concept exploits for Chrome, Safari, Windows and Linux. All were reported and patched. Chaining bugs into full exploits has been a human-expert skill, so this points to a shorter time from disclosure to weaponization.
TechCrunch · 5 min read
Frontier AI labs claim models refuted the Exponential Time Hypothesis
TechCrunch reports labs say their models refuted the Exponential Time Hypothesis, a major complexity-theory conjecture. The summary gives no proof details or independent verification. If it holds, it would overturn assumptions behind many hardness results, so expert review of the proofs is the thing to wait for.
Ars Technica · 7 min read
Anthropic IPO filing lists seven AI risks, including blackmail and loss of control
Anthropic's prospectus runs 335 pages, with about 100 on risks. Ars Technica says the risk factors include blackmail and loss of control. The filing puts the company's safety claims under securities-law scrutiny.
Go a little deeper
EXPLORE BY TOPIC- 55 articles
Cyber security
Exploitation news was heavy, led by the Brotli, Adobe Commerce and PeopleSoft stories. Supply-chain and vendor compromises (a skimmer script, Warp's vendor, a hardware-wallet key) rounded out the day.
Read 8 updates - 31 articles
Tech industry
Legal and regulatory pressure ran alongside hardware and market news. A $25 billion Meta judgment and a wrongful-death suit against OpenAI stand out, and memory supply is forecast to stay tight.
Read 8 updates - 18 articles
AI
Model releases came paired with safety and legal questions. Anthropic drew most of the attention across IPO, data-use and copyright items, and OpenAI's GPT-6.1 Terra shipped with mixed safety results.
Read 7 updates - 12 articles
IT & infrastructure
Linux 7.4 merge-window work and certificate-trust updates dominated. Microsoft pushed out-of-band fixes, and several projects shipped or proposed removals.
Read 7 updates - 2 articles
CS & research
Two formal-methods results appeared. One is a quantum verification protocol, the other a Lean formalization of a landmark classification theorem.
Read 2 updates