StoryFirst seen
The library is built into many downstream products, so fixes must reach them before servers are safe.
Everything it touches
3 names 3 voices 3 source posts
The story’s neighborhood
Explore the graph, or choose a connection below.
Follow the evidence
This brief comes from Tech Twitter’s edited headlines. The posts below are the sources grouped with the story; statements in them belong to their authors.
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:Read original on X
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and…Read original on X
OpenAI researchers found a Brotli remote-code flaw that could let malicious compressed data take over unpatched servers or clients, and Node.js has already pushed fixes.Read original on X
OpenAI finds remote code flaw in Brotli compression library used widely
OpenAI finds remote code flaw in Brotli compression library used widely
OpenAI finds unauthenticated remote code flaw in Brotli compression library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI finds code execution flaw in widely used Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in widely used Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli library
OpenAI finds remote code execution flaw in widely used Brotli library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI finds unauthenticated remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli library
OpenAI discloses remote code execution flaw in widely used Brotli library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI discovers code execution flaw in widely used Brotli compression library
OpenAI finds remote code execution flaw in Brotli compression library
OpenAI finds remote code execution flaw in widely used Brotli compression library
Shared connections
One claimed result would show the Exponential Time Hypothesis is false, a central conjecture in complexity theory.
Businesses can automate more office work when a cheaper model scores the same on real tasks.
Price cuts are pulling large AI spending contracts away from Anthropic and intensifying competition between the labs.
Agents that click and type through software without an API could automate work in tools that lack integrations.