Colby

We achieved RCE via Brotli in Linux labs: • Node.js 24.22.0 + Express 5.3.0 (x86-64/ARM64) through its standard JSON parser • Electron 41.10.7 (x86-64) using a custom-built decoding service Getting it to work requires a carefully matched setup and can take repeated attempts.

Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

We’re still testing how exploitable the Node.js/Brotli bug is, but we’ve found that it’s surprisingly hard to tell whether you’re even affected. So @ToBScottA built a scanner that finds hidden copies of the decoder, even in stripped binaries. github.com/trailofbits/brotl…

“You want to find the bugs, but it’s only good if you can also fix them.”—@anishrnaik on Risky Biz. Many open-source projects have only a handful of maintainers, and fixes are falling behind. We’re building a reusable toolkit to help. Full pod: youtube.com/watch?v=6SIgPjQ9…

Yesterday, rumors started circulating about two unpatched critical-severity bugs in PHP. Within 17 hours, Cloudflare was blocking attacks and Patchstack reported active exploitation. When AI can develop a working exploit in hours, bugs need to be patched just as fast. Each day without a fix carries the risk that an attacker will find and exploit the bug. But it takes time to create a working patch, and PHP's patch was more complex than most. The patch changed 402 files and added more than 11,000 lines, reworking core engine behavior that dozens of extensions depended on. The bug was reported on Aug 11, and fixes were shipped 71 days later. But less than a day after details leaked, systems running PHP were already under attack. Patching needs to keep up with the pace of bug discovery. For the past four months, we’ve worked directly with open-source projects as part of Patch the Planet to understand how AI can expedite patching. Our ongoing research and work show that project-specific documentation, skills, and plugins can be embedded at the repo level to give agents and contributors access to the context maintainers carry in their heads: what counts as a bug, how a fix should look, and what can't break. Our two new open-source plugins, patching-bugs and regression-hunt, are a first step toward a generalized set of tools and guidance for getting a working patch out faster: blog.trailofbits.com/2026/10… PHP’s account of the incident: thephp.foundation/blog/2026/…

"Every one of these maintainers has these two wolves in them." @thebensams on @hackaday's FLOSS Weekly, on why some maintainers go all-in on AI agents and others, a lot of them in Rust, won't unless they're forced to. youtube.com/watch?v=TaTxSyGM…

We're sponsoring @arbitrum's Open House Singapore, hosted in collaboration with Robinhood Chain, to support founders across both the online Buildathon and Founder House. From October 23-25, Founder House Singapore brings selected teams together for 3 days of product, technical, and go-to-market support to help turn early ideas into launch-ready onchain products, while competing for a share of $300K in prizes and grants. Founder House teams will get a remote mentoring session with @gintaria from our team. Apply here: luma.com/openhouse-singapore…

We've reviewed AvalancheGo, libevm, and Subnet EVM for @AvaLabs. We also built Slither, Echidna, and Medusa, and published 391 blockchain security reviews. Avalanche builders can now request an audit from us through the Avalanche Audit Marketplace. build.avax.network/audits/fi…