---
title: "Security digest: October 25, 2026"
url: https://erroneo.us/security/2026-10-25/
description: "October 25, 2026 vulnerability digest: 1 brief (Node2Shell). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2026-10-25
date_modified: 2026-10-26
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 25, 2026

1 editorial brief.

## Take stock

- Patch this week: Node2Shell . Teams running Node.js, .NET, Python with Brotli or brotlicffi installed, PHP for Windows with cURL decompression, or Envoy/Istio with a Brotli decompressor, where request bodies or fetched responses can come from untrusted parties.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Patch this week** [Node2Shell Brotli Flaw Reaches .NET, Python, PHP, Envoy](https://erroneo.us/security/briefs/brotli-cve-2026-111497-node2shell-beyond-nodejs/index.md): The bug sits in the shared Brotli decoder, so the fix has to reach every runtime and proxy that decodes untrusted Brotli data. Patch this week. Exploitation is unreported, and code execution has only been shown in a lab.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2026-10-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt