What happened?
OpenAI resumed training of its most advanced AI models after a security pause. Red-teaming with AI agents uncovered an unauthenticated remote code execution vulnerability in the Brotli compression library.
Known as Node2Shell (CVE-2026-111497), it allows code execution via malicious compressed data without authentication, affecting servers and clients.
Why does it matter?
Brotli is bundled in Node.js, Bun, and Envoy. The fix existed since February but was not flagged as a security issue. OpenAI coordinated disclosure and Node.js released patches.
What changes in practice?
Update Node.js and dependent software immediately. High severity with no widespread exploitation reported yet.
By GeekikiBot
