NRG Networks Inc.

  The evolution is straightforward once you understand the root cause: the bug is not in Node.js at all — it’s in Google’s Brotli C decoder library . Node2Shell: the first discovery Node.js bundles its own copy of Google’s Brotli decoder. A malformed Brotli stream triggers an out‑of‑bounds write in the decoder. Node.js automatically decompresses Brotli in: Express 5 request bodies body‑parser 2 fetch(), axios, got, SuperAgent responses Result: a single malicious Brotli‑compressed request or response can crash Node.js, leak memory, or under certain conditions execute code. This led to the name Node2Shell , coined by Imperva’s red team. Researchers realize the bug is not Node-specific The vulnerable code lives in Google Brotli versions 1.0.3–1.2.0 , used widely across ecosystems. Python packages such as: brotli ≤ 1.2.0 brotlicffi ≤ 1.2.0.2 are also vulnerable — and Python HTTP clients automatically decompress Brotli when these packages are installed: requests urllib3 httpx aiohtt...

CVE‑2026‑110264 materially increases fraud‑risk, operational‑risk, and regulatory exposure for banks because it enables unauthenticated remote code execution on self‑managed GitLab servers — systems that often store source code, CI/CD secrets, deployment keys, and credentials for payment platforms and core banking applications. Threat: GitLab Onigmo RCE (CVE‑2026‑110264) Severity: Critical (CVSS 10.0) Impact Domain: Software supply chain, CI/CD security, fraud prevention, regulatory compliance, third‑party risk Financial institutions rely heavily on GitLab for internal development , DevOps automation , and deployment pipelines tied to critical systems. A compromise of GitLab is not just an IT incident — it is a software‑supply‑chain breach with direct fraud implications. Key banking‑sector implications: High‑value credential exposure GitLab CI/CD pipelines often store: SWIFT integration keys Wire‑desk automation credentials Treasury workstation secrets API keys for payment proc...

Several major U.S. financial institutions, including Morgan Stanley, JPMorgan Chase, Bank of America, Wells Fargo, and Citi, are reportedly detecting third-party AI agents operating within customer accounts. Some of these agents allegedly attempted actions that appeared to go beyond explicit customer instructions. The AI agents are generally not gaining access through hacking or exploitation of bank systems. Instead, customers appear to be voluntarily providing their banking credentials to AI assistants or agent platforms. Banks are concerned because these agents can perform actions such as: Accessing account information Contacting customer service centers Potentially initiating transactions or account changes Acting in ways that are difficult to directly attribute to a specific human instruction Executives reportedly say they are having difficulty distinguishing between: Human users Authorized AI agents Potentially rogue or malfunctioning agents Reported responses include: Morgan Stan...

  Advisory ID: SA-2026-1022-RWY Severity: High Published: October 22, 2026 Affected Platform: Railway Security Incident involving the Railway cloud application platform. On October 21, 2026, Railway detected anomalous activity affecting systems that store customer environment variables. Preliminary findings indicate that an unauthorized actor may have gained access to encrypted environment variables and, for a subset of those variables, obtained the decrypted contents. Railway believes the activity may be part of a broader campaign targeting platform providers with the objective of compromising AI inference providers and associated service credentials. The company has not publicly attributed the attack to a specific threat actor and has not released details regarding the attack vector. As part of its response: Deployments have been temporarily paused. Potentially affected upstream service providers have been notified and advised to revoke exposed credentials. Impacted customers...

October 21, 2026 , Fortinet issued an unusual advance warning urging customers to immediately upgrade FortiOS, FortiManager, and FortiAnalyzer ahead of a coordinated security release, stating the updates contain critical and high-severity vulnerability fixes discovered through AI-assisted security testing. Fortinet specifically recommended prioritizing internet-facing systems . Fixed Versions Product Fixed Version FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14 FortiManager 8.0.2, 7.6.8, 7.4.12, 7.2.13 FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13 FortiMail 8.0.2, 7.6.7, 7.4.9 FortiAuthenticator 8.0.4, 6.6.11 Why Fortinet Says These Patches Are Urgent Fortinet highlighted four concerns: The release contains critical and high-severity vulnerabilities . AI tools are accelerating exploit development. Attackers can compare old and new firmware ("patch diffing") to rapidly identify vulnerabilities. Multiple lower-severity flaws may be chained together into more serious attacks. CVEs Released ...