Christoph Ott ⚡ retweeted
‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js.
Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability.
Read full details ↓ thehackernews.com/2026/10/br…
Christoph Ott ⚡ retweeted
‼️ After PHP2Shell comes Node2Shell, a critical bug found by OpenAI's Codex Security that can let attackers run code in Node.js apps.
It was successfuly demonstrated on the official Node.js 24.22.0 image.
Node 20, 23 and 25 (all EoL) get no fix.
Liked PHP2Shell? You’re gonna love Node2Shell.
We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!
imperva.com/blog/node2shell-…
Christoph Ott ⚡ retweeted
OMG
Today we announce 1Password for Agents platform, building with companies @Muse, SpaceX Super Intelligence Grok @Bot, @AnthropicAI’s @Claudeai, @OpenAI, @TownAI, @Browserbase, @Browser_use, @heydana_ai, Instinct, @usekernel, @Perplexity_ai, @tryramp, @Tomo, and @wajo_ai, with more integrations on the way. 🎉
We've heard from so many of our customers who want to use these new personal AI agents to help them get more done, but want more control over what the agent can access with the same trust and ease of use they get when using 1Password directly.
1Password for Agents gives your agents access without giving up your passwords. When an agent reaches a sign-in form, it requests a credential from your vault. If you approve the request, 1Password directly auto-fills the credential in the destination site so the agent can’t see or take possession of the credentials.
The agent gets the task done, but it doesn’t get your passwords..
You stay in control. 1Password for Agents free and optional for personal and family accounts. Unless you opt-in to an agent connector, agents cannot touch your vault.
➡️Learn more: bit.ly/487da6J
Christoph Ott ⚡ retweeted
🚨 CRITICAL: GitLab flaw (CVSS 10.0) affects 12 years of releases.
CVE-2026-110264 could allow unauthenticated remote code execution on self-managed servers.
Read - thehackernews.com/2026/10/cr…
Christoph Ott ⚡ retweeted
🚨 UPDATE: A public PoC demonstrates RCE on PHP 8.5.12, even after the October 21 security patches.
The attack is separate from the patched php2shell CVEs and requires specific session configurations and application weaknesses.
Our earlier concerns about PHP session handling remain relevant.
We've updated php2shell-protection with additional hardening guidance.
#php #cybercurity
github.com/syhunt/php2shell-…
Christoph Ott ⚡ retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Christoph Ott ⚡ retweeted
ngGlühwein returns on 27 Nov! 🍷
Join us for talks, shared ideas, community connections, and free food + drinks.
📅 Friday, 27 November 2026
📍 @Lean_Coders, Vienna
🎟️ Save your spot and a mug of Glühwein: meetup.com/angular-vienna/ev…
#Angular #ViennaTech #AngularAustria #Devs
Christoph Ott ⚡ retweeted
🚨 LEDGER SUPPLY CHAIN ATTACK: MORE EUROPEAN RETAILERS FLAGGED AS POTENTIALLY AT RISK
@Darkfost_Coc has expanded his watchlist of Ledger resellers after discovering a second tampered device at MediaMarkt.
Aqipa GmbH, an official Ledger distributor since August 2023, has been linked to the distribution chain, raising concerns about potential exposure at other European retailers, including Saturn, Fnac, and Boulanger.
Only CryptoBilis and MediaMarkt have been publicly linked to confirmed discoveries of compromised devices. There is currently no evidence that the other retailers’ inventory has been compromised.
Following the discovery of another compromised Ledger at MediaMarkt, I've updated the list of resellers/distributors that may be at risk.
Aqipa GmbH has been an official Ledger distributor since August 2023, mainly in Germany and Austria.
I've added the list of European distributors that may have been supplied by Aqipa, but once again, nothing is proven except for MediaMarkt and CryptoBilis.
Don't you find it crazy that random accounts on X give you more information on the risks, how to check, and which devices may be compromised than the manufacturer itself does ?
They didn't even offer to cover the shipping costs for the latest Ledger bought at MediaMarkt, even though they asked for it to be sent in.
Update on Ledger devices at MediaMarkt Saturn 🔽
As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported.
We have no indication that Ledger's infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: support.ledger.com.
If you have questions about a device you bought, contact Ledger Support at support.ledger.com. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
Readers added context they thought people might want to know
Ledger claimed MediaMarkt Saturn stopped selling Ledger devices in stores and online as of Oct. 13. Reports show a store was still selling them hours later with staff unaware, and products remain listed on MediaMarkt sites.
x.com/0xJohannes_/st…
cointelegraph.com/news/mediamark…
mediamarkt.de/de/product/_le…
mediamarkt.at/de/product/_le…
Gitea Runner 4.0.0 is here! 🚀
Highlights:
⚡ Built-in actions, starting with builtin:checkout
🗄️ Shared S3-compatible cache
🔭 OpenTelemetry tracing
🔗 self: action references
🐳 Improved container & cache handling
And much more.
Check out the full release:
blog.gitea.com/release-of-ru…
#Gitea #DevOps #CI #OpenSource
Christoph Ott ⚡ retweeted
We rewrote the vite dev server in rust.
By removing Node.js, we achieved 4x better memory usage and cold starts is 2x faster.
This has resulted in our sandboxes acquisition time to go from 14s to 3s (4.6x improvement).
When i say we, i mean @raphamorims
Today I am moving OJ to @Lovable
I started OJ out of frustration watching Vite eat gigabytes under my agents. Now it's open source at github.com/lovablelabs/oj and rolling out under real Lovable previews.
More to be shared soon 🍊
Christoph Ott ⚡ retweeted
The Legend of Zelda: Ocarina of Time -- first trailer!
November 5, 2026.
The Legend of Zelda: Ocarina of Time
Christoph Ott ⚡ retweeted
𝗧𝘆𝗽𝗲𝗦𝗰𝗿𝗶𝗽𝘁 𝟳.𝟬 𝗶𝘀 𝗵𝗲𝗿𝗲, 𝗮𝗻𝗱 𝗶𝘁 𝗿𝗲𝗮𝗹𝗹𝘆 𝗶𝘀 𝟭𝟬𝘅 𝗳𝗮𝘀𝘁𝗲𝗿 🚀
In March 2025, Microsoft said they will create a 10x faster TypeScript by porting the compiler to Go. TypeScript 7.0 shipped on July 8, and here are the numbers:
🔹 VS Code (2.3M LoC): full build 125.7s → 10.6s (11.9x faster)
🔹 Sentry (1.9M LoC): 139.8s → 15.7s (8.9x)
🔹 Playwright: 12.8s → 1.47s (8.7x)
🔹 First errors in the editor: 17.5s → under 1.3s
🔹 Memory: up to 26% less
Teams already said the following:
🔹 Slack cut type-checking in CI from 7.5 min to 1.25 min
🔹 Canva sees the first error after 4.8s instead of 58s
🔹 One Microsoft org saves 400 CI hours every month
This version (7.0) is also a cleanup. The ES5 target is no longer there, and baseUrl also, while strict mode is on by default.
The thing that remained is that there is no programmatic API until version 7.1, so if you are using Vue or Svelte, you still need TS 6 in the editor.
The interesting part is that they tried Rust first. Anders Hejlsberg said: "The borrow checker doesn't allow circular data structures. And our compiler is chock-full of circular data structures." So, Go won. Porting instead of rewriting kept the exact compiler behavior.
Will you move to TypeScript 7.0 now, or wait for 7.1?
Image: Microsoft.































