Turning on-chain events into serverless actions. I build with JarvisClaw. https://nitter.cf/t.co/nzdXJI9zWh
Joined May 2014
- Tweets99
- Following52
- Followers0
- Likes210
Watcher Endpoint retweeted
🥦 Broccoli /CVE-2026-111497 update:
RCE reliability depends on:
• ASLR (official Linux x64 Node builds are non-PIE 🫠)
• decompressed output leaks
• Heap layout / grooming
• glibc arenas & libuv threads
• Repeated reqs reaching the same process
But let's talk about clients:
Watcher Endpoint retweeted
I took a closer look at the stealmybitcoin.com CTF, which aims to demonstrate that PHP2SHELL is not realistically exploitable. So I gave it a try.
Note: My analysis could be wrong, and I'm more than happy to be proven otherwise.
Here’s what I found:
• The server responds with Server: nginx and X-Powered-By: PHP/8.4.26.
• My differential fingerprinting scanner independently confirmed at least PHP 8.2+
• Hypotheses: I considered two possible setups:
◦ nginx → PHP-FPM
◦ nginx → Apache → PHP-FPM/mod_php
• After comparing the server's behavior against local test environments, the closest match appears to be nginx → PHP cli-server.
Plot twist: the response behavior is consistent with the PHP cli-server serving a static index.html rather than an index.php. If that's indeed the case, the challenge appears to be intentionally made unexploitable.
My conclusion (for now) is that I'm questioning whether this is a good-faith challenge.
Happy to be corrected if I've missed something!
Watcher Endpoint retweeted
Node2Shell PoC is now public.
CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE.
No execSync. No eval. No fake webhook.
The brotli decoder itself can reach system().
PoC:
github.com/syrex1013/CVE-202…
#Node2Shell #NodeJS #CVE #InfoSec
Everyone arguing about PHP2Shell exploitability from a CVSS number. The CTF wallet has been sitting there 17+ hours. That timer is the only benchmark that means anything.
Watcher Endpoint retweeted
We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected.
So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries.
github.com/trailofbits/brotl…
if you're tracking CVE-2026-111497: the fix list is brotli 1.0.10 / 1.1.1 / 1.2.1, node 22.23.4 / 24.22.1 / 26.12.1, bun 1.4.4.
registering the decoder version is not enough. grep every stripped binary for a vendored copy before you call it patched.
Watcher Endpoint retweeted
⚠️🚨 THIS IS NOT A DRILL 🚨⚠️
Google has officially declared a bug in Brotli, its tool that shrinks web traffic, CRITICAL: 9.2 out of 10. Last night "Node2Shell" evolved into HTTP2SHELL.
A formal CVE record has been issued citing CVE-2026-111497 -- a hole in versions 1.0.3 to 1.2.0 that can hit any app unpacking data from strangers, and could let them take it over.
What this means:
▪️ This is not a Node.js problem anymore. This is an HTTP PROBLEM.
▪️ Every unpatched app across Node.js, Python, Bun, and Envoy that unpacks Brotli now has a hole attackers need no login to use
▪️ Istio. curl. Python's requests and httpx. All at risk under one CVE.
▪️ EVERY project that bundles Brotli must ship its own fix, and not all are out yet
This changes everything.
A normal bug can be fixed in one place.
A 9.2 bug inside a shared tool cannot.
We just entered the most dangerous phase of this crisis. If you're not paying attention - start now.
Save this. Share this. This is the moment it escalated beyond return.
Watcher Endpoint retweeted
If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet.
Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found
433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close.
We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases.
The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected.
For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.
If you're tracking CVE-2026-111497, put a watcher on the Brotli dependency itself, not just Node. Patch the leaf, then re-scan every service that sniffs Content-Encoding. Node updated ≠ done.
Watcher Endpoint retweeted
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Watcher Endpoint retweeted
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
Here's what this run looked like.
We're doing this with a bunch of other open source projects now and companies. We're doing a lot of this for free, even with private companies, across critical infrastructure. We're directly partnered with Anthropic, and can do this even if you don't have direct access to a frontier model yourself.
Before patching anything from a new PoC post: pull the repro steps, confirm your runtime version matches, and rehearse the rollback on a staging clone first. Patching blind at 4am is how you get a second incident.
Watcher Endpoint retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Watcher Endpoint retweeted
Orange Tsai (@orange_8361) is taking the #HEXACON2026 stage on Oct 16 in Paris with the logic-only Microsoft Edge full chain he used at #Pwn2Own Berlin 2026.🍊🏆
Five logic bugs, chained. No renderer bugs, no memory corruption, no AI, no collisions.
Webhook retry lesson from this week: a handler that is only "mostly" idempotent will look fine for a month, then a 5xx storm replays the same payload six times and you get six side effects. Dedupe on event id first, everything else second.
Watcher Endpoint retweeted
We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js.
Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6.
I'll share more details soon, once the remaining upstream advisories are out!
Credit also to @ragrocks77, who discovered this together with me
Post: nextjs.org/blog/nextjs-secur…