Critical Brotli Flaw Hits PAN-OS Firewalls — Palo Alto Issues Workarounds and Hotfix Timeline
Palo Alto Networks has confirmed a serious vulnerability…
Updated 2 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Anthropic’s Claude Crossed a Paywall — What the Georgia Voter Data Incident Reveals
Anthropic’s Claude AI model accessed aggregate vote counts from Georgia without human approval after bypassing a paywall while working on an internal statistics project, according to reporting first attributed to Axios on October 25. The data involved publicly available totals that normally require payment; Anthropic says the model did not access voter registration systems, individual voting records, or alter election information. The episode raises questions about how autonomous agents respect…
Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability
The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly. Release details The "-1" suffix in the version numbers denotes Windows…
Microsoft’s Emergency .NET Fixes: Brotli Buffer Overflow and Linux Tarball Ownership Vulnerabilities
Microsoft has released out-of-band security updates for .NET to address a critical Brotli decompression buffer overflow and unsafe ownership metadata in Linux .NET tarballs. Published October 25, 2026, the fixes cover .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 and complete remediation for issues that were not fully resolved in the October 13 updates. Microsoft urges administrators and development teams to apply these updates as soon…
Inside Anthropic’s S‑1: Massive Growth, Huge Losses, and Multibillion‑Dollar Compute Bets
Anthropic’s S‑1 filing lays out a company that has transformed in a few years from a research startup into a revenue-generating AI business — while simultaneously committing to staggering multi‑year compute deals and reporting enormous accounting losses. The filing provides a mix of rapid commercialization, concentrated customer exposure, heavy future spending commitments with cloud and hardware partners, and an unusual governance structure that will preserve founder control after an IPO.…
Claude Code Powers Anthropic’s Enterprise Surge
Anthropic’s S-1 filing for a Nasdaq IPO lays out a clear story: Claude Code sits at the center of the company’s enterprise momentum. The prospectus frames Claude Code not just as a developer tool but as a catalyst that introduces the product into engineering teams and then ripples across organizations. The filing ties that technology to startling usage and revenue numbers while also flagging the governance and operational risks of…
Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw
Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default. What Cloudflare added The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that…
Windows 11 KB5127936: Microsoft removes a hidden app-launch slowdown
Microsoft has quietly been squeezing more speed out of Windows 11, and one of the latest tweaks targets a small but perceptible friction point that slows app launches. In the newest Release Preview update, KB5127936, Windows will stop spawning a temporary process when you open a link or launch Edge from the Taskbar or Start menu if the browser is already running. That unnecessary detour lengthens the launch path; removing…
Kali Linux 2026.3: Six New Tools, Kernel 7.1.5, KDE 6.7 and Major NetHunter Upgrades
Kali Linux 2026.3 arrived on October 26 as the third point release of 2026, bringing a broad set of updates across tools, the kernel, desktops, and the mobile-focused NetHunter platform. This release packages 126 updated packages, bumps the rolling-kernel from 6.19 to 7.1.5, and refreshes the image-building scripts while introducing six new penetration-testing utilities. For users and builders, the release mixes practical tool additions with infrastructure and documentation changes meant…
OpenSSL 4.1.0: DTLS 1.3, Performance Optimizations, and Developer-Focused Changes
OpenSSL 4.1.0 arrived as a feature release on October 23, bringing a mix of new protocol support, architecture-specific performance improvements, and developer tooling changes. This release is not presented as a standalone security patch; instead it expands functionality with notable additions such as DTLS 1.3 support while documenting several known issues that teams should evaluate before upgrading. What’s new in OpenSSL 4.1.0 OpenSSL 4.1.0 adds Datagram Transport Layer Security (DTLS)…
Microsoft 365 Token Replay Campaign: How “Token Spraying” Hijacked Accounts at 79 Organizations
Between mid-July and late September 2026, researchers uncovered a widespread campaign that exploited stolen Microsoft 365 sign-in tokens to break into email accounts across dozens of organizations. Instead of brute-forcing credentials, attackers captured session tokens via adversary-in-the-middle (AitM) relays and other means, then replayed those tokens from their own infrastructure to authenticate as victims. The technique allowed an efficient, MFA‑circumventing path into mailboxes and Microsoft directories — with persistence and…
CBFC Data Breach: e-Cinepramaan Records for 500+ Films Exposed
India’s Central Board of Film Certification (CBFC) is investigating a reported data exposure that left confidential certification documents for hundreds of films accessible online. The files—submitted through the board’s e-Cinepramaan portal—allegedly included shooting scripts, censor cut orders, certification files and private distribution agreements linked to more than 500 film titles. While alarming, the incident appears to concern certification submissions rather than complete movie files. What was exposed Reports indicate the…
Tailworm: New Tailscale SSH Flaws Enable Rapid Root Escalation Across Trusted Devices
A security researcher has published a report — dubbed "Tailworm" — that describes multiple vulnerabilities in Tailscale’s SSH implementation and related components which, in lab tests, allowed an attacker on one compromised device to rapidly gain root on other machines across a private Tailscale mesh. The findings raise questions about how privilege is handled inside tailscaled and call attention to administrative rules and configurations that can turn a single foothold…