Know what changed. Know what matters.

A memory‑corruption flaw in Google’s Brotli decoder threatens many widely used packages—including Node.js, Bun, Python Brotli, brotlicffi, and Envoy—potentially allowing remote code execution when attackers supply crafted compressed data.

New firmware rootkit “BlackX” bypasses Secure Boot on patched Windows systems, targeting Central Asian diplomatic organizations linked to APT41.

A new remote code execution vulnerability could let attackers run arbitrary code on misconfigured PHP applications.

Arista issued an advisory on Oct. 22 about a zero‑day SQL injection flaw in its VeloCloud Orchestrator that lets logged‑in users gain operator privileges.

A compromised release pipeline pushed a credential‑stealer onto PyPI and Docker Hub.

A critical flaw allowing unauthenticated remote code execution across 12 years of releases was patched by GitLab on Oct 21.

Two critical PHP flaws called PHP2Shell will be patched at 14:00 UTC on Oct 21.

The private keys of eight eMudhra intermediate CAs were exposed on Oct 20, prompting Mozilla and Google to revoke them and warn that attackers can issue fraudulent TLS certificates for any site.

Attackers replaced five OVHcloud command-line tool releases via a hijacked contributor's GitHub account, spreading malware that harvests secrets from any machine that runs it.

A malicious update to the popular WordPress SEO plugin Rank Math PRO installed a self‑restoring backdoor on sites worldwide.

A fake Web3 accelerator has distributed information‑stealing malware and backdoors to Windows and macOS users through malicious npm packages.

ConnectWise disabled seven application identities after attackers compromised Microsoft 365 tenants.