HTTP2Shell flaw exploited, stolen GitHub tokens, Magento PolyShell | Cyber Security News Oct 28
Attackers are exploiting the Brotli flaw behind HTTP2Shell and Magento's PolyShell, and stolen GitHub tokens are dumping private repo secrets. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: How do you find the services that quietly bundle a library like Brotli? Reply in the comments or at feedback@defensivesecurity.org.
1. Update: Brotli flaw now listed as exploited - CVE-2026-111497 - Do: Patch every service that decompresses Brotli - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
2…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.