Daily Archives: Nov 2, 2026

Researchers have demonstrated "Node2Shell," a working exploit that allows an attacker to execute code inside a Node.js application by supplying specially crafted Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory vulnerability in the Brotli decoder that is bundled with Node.js. The Node.js security advisory published...

Attackers are actively exploiting a critical SQL injection vulnerability in VeloCloud Orchestrator (VCO) that enables authenticated users to escalate to superuser operator access. Arista Networks disclosed the flaw on October 22, 2026, warning that successful exploitation could compromise the orchestrator, its host, and the data it...

The operator behind the StealC service has resurfaced with a new Windows remote-access trojan named Stadia, which pairs credential theft with covert desktop control. First advertised on October 16, 2026, Stadia expands beyond data exfiltration to let attackers execute commands, browse files, manage processes, and deploy...