StoryFirst seen
The library is built into many downstream products, so fixes must reach them before servers are safe.
Everything it touches
3 names 3 voices 3 source posts
The story’s neighborhood
Explore the graph, or choose a connection below.
Follow the evidence
This brief comes from Tech Twitter’s edited headlines. The posts below are the sources grouped with the story; statements in them belong to their authors.
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library. it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:Read original on X
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and…Read original on X
OpenAI researchers found a Brotli remote-code flaw that could let malicious compressed data take over unpatched servers or clients, and Node.js has already pushed fixes.Read original on X
OpenAI finds remote code flaw in Brotli compression library used widely
OpenAI finds remote code flaw in Brotli compression library used widely
OpenAI finds unauthenticated remote code flaw in Brotli compression library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI finds code execution flaw in widely used Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in widely used Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli library
OpenAI finds remote code execution flaw in widely used Brotli library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI finds unauthenticated remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses remote code execution flaw in Brotli compression library
OpenAI discloses unauthenticated remote code execution flaw in Brotli library
OpenAI discloses remote code execution flaw in widely used Brotli library
OpenAI finds remote code execution flaw in widely used Brotli compression library
OpenAI discovers code execution flaw in widely used Brotli compression library
OpenAI finds remote code execution flaw in Brotli compression library
OpenAI finds remote code execution flaw in widely used Brotli compression library
Shared connections
The Yang-Mills Working Group plans to publish OpenAI's submitted code and its validation, so the claim can be checked by mathematicians.
Disney plans to use the Adobe models in its studios and at its theme parks, tailored to its own properties.
A chart from its blog suggests extra compute spent at answer time is not hitting diminishing returns.
Moving the law's author to Congress could reopen debate over whether new AI rules favor the largest companies.