If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet. Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found 433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close. We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases. The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected. For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.

Semgrep is a launch partner in the @SpaceXSI Partner Network. In Grok Build, a Hook runs Semgrep every time the agent changes code. Not when the agent remembers to, every time. @spacerog on why that matters: semgrep.dev/blog/2026/mcp-vs…

“You can’t YOLO at enterprise scale.” @daghanaltas at #GartnerSYM this morning. Yesterday we said to come argue with him. Several people took us up on it.

PR volume: up 3.1x. Reviewers: up 1.5x. PRs getting any written feedback: 39% → 21%. Tomorrow at Gartner IT Symposium, @daghanaltas on what replaces reviewing every change by hand. Stage 3 (Pacific), 10am ET. Can’t make it: semgrep.dev/blog/2026/end-is…

Day 2 at Gartner. Edwin, our PMM: “There’s a solution for pretty much everything. What people are missing is a standard around how to secure AI.”

AI coding agents are generating more code, faster. Security needs to keep up. 🔒 Join us for a hands-on session with Semgrep Guardian to see how security fits directly into AI coding workflows with Claude and Codex. See how Guardian detects vulnerabilities as code is being written and helps teams address security risks earlier, without slowing developers down. 🧱 Build beyond the code! Join live for a chance to win one of three $50 LEGO gift cards. 📅 October 21 | 8 AM PT Get hands-on with Guardian → semgrep.dev/events/get-hands…

Your developers are shipping faster than ever. Your security team is trying to keep up. On Oct 22, Isaac Evans (CEO, Semgrep) joins Viraj Gandhi from ServiceNow and Varun Agaskar from Broadridge Financial for the session “Security at the Speed of Development” at the PBC Agentic AI Security Conference. It’s a conversation, not a slide deck. Here’s what they’ll get into: How the secure SDLC changes when AI writes more of the code What it takes to build security into developer and agent workflows, not just bolt it on at review time Which policies can become automated checks, and which still need a human call Why application and infrastructure risk belong in the same conversation Join us for real talk and practical steps you can take tomorrow. October 22, 10:00 - 10:30 AM PT ttps://armorcodeinc.registration.goldcast.io/events/0a66b331-f6fb-4bd2-897f-468a7c6ed390?__hstc=14956073.22adf95f00a7cb40122d709247769689.1791980575910.1791980575910.1791980575910.1&__hssc=14956073.1.1791980575910&__hsfp=a0a1851a45f4a97708ee74c66b52c7bc#Registration

They did not break in: they published. That line from the Beagle Brigade team sums up how package registry malware works. A stolen maintainer token becomes a new version of a package you already depend on, and it runs on every laptop and CI runner that installs it, before anyone opens a file. Their project took second place in our Semgrep Guardian challenge at the Cyberdefense Hackathon during SF Tech Week. Each new release on a registry like npm or pypi is pulled into a sandbox. It’s analyzed with Semgrep dataflow rules without ever being executed. Anything suspicious goes to an AI agent that returns a verdict. What we liked most is that the analysis never runs what it downloads. When the threat is code that executes on install, analysis that doesn’t execute anything is the safe place to start. It’s the same threat Semgrep Guardian’s malware firewall is built for with malicious dependencies. Congrats to the Beagle Brigade team! #SFTechWeek

Repos hosted in Cursor Origin can now connect to Semgrep. Automated scans, PR checks, and findings in the workflow you already use. semgrep.dev/blog/2026/cursor…

Only raise a security issue you can prove. That was the idea behind a hackathon project which took first place in our Semgrep Guardian challenge at the Cyberdefense Hackathon during SF Tech Week. A static deterministic check runs first, so most saves never reach a commit at all. The findings go into the model's context as evidence. Anything the model suspects is then run in a sandbox with canaries. Only proven issues reach the developer, and each comes with a fix that’s re-checked the same way. Static analysis is cheap and precise about what the code says. A model is good at asking whether it matters in a project. Of the 63 projects submitted, this was one of the clearest examples of each security layer doing the task it’s best at. Congrats to the Reva team! #SFTechWeek