What should a city council do when residents show up with a map of every camera in town? Follow @PredictaLabOff for more cyber and OSINT news.

Why it matters: a Washington Post review found at least 50 officers accused or charged with misusing plate readers, 46 of those cases involving Flock's system. An invisible surveillance layer is now something anyone can audit.

In leaked audio published by 404 Media, Flock's CEO told police chiefs the nationwide backlash is not real, blaming paid Russian bots without evidence and tying a drop in online chatter to a Ukrainian drone strike on a Russian data center, a disproven theory.

On September 24, a trademark complaint was filed on Flock's behalf by brand-protection vendor Doppel, targeting the site's disclaimer that it is not affiliated with Flock. Proton called the claim frivolous and republished the map on Swiss servers, searchable by ZIP code.

The map, built by security researcher Joshua Michael, lists over 170,000 license plate readers. Flock publicly cites about 120,000 cameras: roughly 40 percent fewer than its real footprint. The flaw that exposed the data has since been patched.

Flock's own website leaked an access token exposing the locations of 300,000 of its surveillance devices. A researcher turned it into a public map, and the company has been trying to kill it ever since. ⬇️

Where does Brotli hide in your stack, and would you have known before this week? Follow @PredictaLabOff for more cyber and OSINT news.

No in-the-wild exploitation confirmed yet. That makes this the rare giant bug you can patch before the breach stories start. Trail of Bits shipped brotli-checker to find out if your code even touches Brotli.

Like PHP2Shell, the bug was found with AI tools: Node.js credits Khai Tran and Sylvie Mayer of the OpenAI Codex Security team. That is two internet-scale RCEs surfaced by AI in a single week.

The queue behind it: Python Brotli libraries, the Bun runtime, the Envoy proxy, Istio. Because the flaw lives in the format's shared code, maintainers expect confirmations and fixes to keep landing for months.

Node.js patched first on October 21: versions 22.23.4, 24.22.1 and 26.12.1. Node 20 is end of life and gets no fix. Apps that decompress untrusted data with node:zlib risk crashes, memory disclosure or remote code execution.

CVE-2026-111497 is a memory corruption bug in the Brotli format's code. Crafted compressed data sent to a server writes outside the decoder's buffer and can execute code. No authentication needed.

Everyone spent last week patching PHP2Shell. Meanwhile a second RCE, just as broad, was sitting in Google's Brotli compression code, used by every language on the internet. ⬇️

Audits waved these keys through twice. What would actually have caught them: better tooling, transparency logs, or just more paranoid reviewers? Follow @PredictaLabOff for more cyber and OSINT news.

The web's trust model rests on key ceremonies nobody re-checks. DigiNotar died of a hack in 2011; eMudhra leaves after a defect no attacker even needed. If your certs chain through a low-cost CA: inventory, reissue, watch the CT logs.

Chrome, Firefox and Apple distrusted the certificates. eMudhra says it revoked all eight within 14 hours, denies any breach, and is now withdrawing from the global SSL/TLS certificate business, about 1 percent of its revenue.

The defect came from one broken step in an April 2025 key ceremony. It survived two independent audits and 18 months in plain sight, until researcher Scott Helme published the finding.

With those keys, an attacker could forge valid HTTPS certificates for sites they do not own and silently intercept traffic. Unit 42 reports no confirmed abuse, but the certificates were set to stay valid until April 2040.

Eight intermediate CA certificates from Indian authority eMudhra were built on keys with almost no randomness. Instead of a random 384-bit number: 4, 56 and 115. Anyone who does the math can derive the private keys from the public certificates.

A root-trusted certificate authority generated a private key that was literally the number four. Not a metaphor: 4. The fallout is ending its entire TLS business. ⬇️