Brotli RCE bug, Starshield throttling in Ukraine

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0, on all platforms. A crafted compressed stream from an unauthenticated attacker can corrupt memory, leak data, crash the process or potentially run code. It scores 9.2 (CVSS v4.0) and affects Node.js through its bundled Brotli. OpenAI found the flaw in February and reported it as remote code execution that works in both directions, against servers and against clients that accept compressed responses. The root cause was fixed in the Brotli source in February.

aikido.dev, HN

TechCrunch looks back at two critical PHP bugs that threatened much of the web. On HN, a Show HN called Steal My Bitcoin invites people to show whether anyone has worked out how to use the PHP remote code execution bug. Separately, the PHP Foundation's director says it is under-funded with one full-time staff member.

TechCrunch, stealmybitcoin.com, reuters.com, HN

Around a dozen banking apps began specifically permitting GrapheneOS. Separately, Apple is accepting applications through October 30, 2026 for its Security Research Device, a specially fused iPhone with shell access, offered as a 12-month renewable loan. Vulnerabilities found with it are automatically considered for Apple Security Bounty.

grapheneos.social, security.apple.com, HN

Ukraine says Starshield, the military version of Starlink, was working normally again on Saturday morning. Speed restrictions from SpaceX had hampered Ukraine's drone forces since Oct. 14, and Elon Musk reportedly ordered them. US officials said Trump asked Musk to restore the service. An opinion piece on HN argues the episode gives Europe a reason to replace American technology.

Techmeme, TechCrunch, steveblank.com, HN

The Guardian reported that Google cleared 816 acres, an estimated 250,000 trees, near Muhos in northern Finland, before completing the Environmental Impact Assessment Finnish law requires. Finnish officials suspended development at two of Google's data center sites to assess the impact. A resident said wolves came into a nearby village after wildlife left the forest.

nypost.com, HN

Block introduced Dessa, which it calls a true speech-to-speech AI model trained on nothing but human conversation. Block says it runs locally on a MacBook Pro M4 Max or newer.

Techmeme, TechCrunch

Torsten Slok of Apollo Global Management says revenue per worker and profit margins are rising for the Mag 7 but flat for the other S&P 493. He sees no sign of AI lifting productivity growth. He says mainstream companies increasingly view token spending as a cost center that weighs on margins, while VC-backed firms keep spending more on tokens.

Techmeme, apollo.com, HN

The Information reports that Replit recently moved most of its AI spend from Anthropic to OpenAI. OpenAI gave 30%+ off in a deal worth $100M+ a year, after Anthropic discontinued its discount.

Techmeme

Dream Labs launched Dream-1, a model it says controls robots it has never seen, on tasks it was never shown, with no fine-tuning or demonstrations from that robot. It is available through a public API from $3/hour. The company is coming out of stealth with $90M in seed funding.

dreamlabs.ai, HN

Balloting on C++26 has completed and it was disapproved. One poster describes it as turned down by the national bodies, reportedly unprecedented.

linkedin.com, Lobsters

The UK plans to invest £100M in a national AI Biosecurity Lab to strengthen defences against biological threats, supported by OpenAI, Anthropic and Google DeepMind. Pennsylvania Governor Josh Shapiro signed a law requiring disclosure labels on ads significantly modified or generated by AI.

Techmeme, The Verge