Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled data.
Get the latest international news and world events from around the world.
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the server to use thousands of times more memory than it received, enough to run a default server out of memory.
The flaws cause only denial-of-service attacks, with no evidence of data theft or code execution and no public reports of attacks in the wild. Fixes are out for quic-go, Cloudflare quiche, lsquic and Wireshark, but Bun, the h3 Rust library and aioquic were still unpatched at disclosure.
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon detected a PHP2Shell exploit attempt on October 17, before disclosure, followed by further attempts after patches were released.
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab fixes CVE-2026–110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
Compromised LiteLLM 1.107.0 packages run a credential stealer at Python startup and can fetch and execute additional code.
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements.
Mouse Button Lock, one of the new mouse tools, makes it easier to select items on screen by locking a mouse button while you hold down a key.
“With Mouse Button Lock, press and hold a button for a moment, then let go. Windows keeps treating it as held, so you can continue dragging or selecting until you click any button,” Microsoft senior product manager Niels Laute explained.
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks.
The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection.
Chrome is also adding a new “suspicious site” warning for pages that show deceptive patterns but haven’t reached the confidence level required for its existing full-page red warning.
How an AI math breakthrough ignited a controversy
An article discussing the OpenAI Navier Stokes Millenium Prize problem solution.
OpenAI spent millions to solve the Navier-Stokes problem, but who should get credit?
Memory stays strong in old age when this brain enzyme is active
Data from mouse brains and 13 human brains show a link between levels of a lipid-degrading enzyme and cognitive resilience.
Flying car
Finally, a car I can rely on to never be late again. 😎✈️Instagram: https://www.instagram.com/hashem.alghaili/Facebook: https://www.facebook.com/ScienceNatur…