October 25, 2026
A Brotli Out-of-Bounds Write Patched in February Without Security Tagging Spreads from Node.js to Python, C++, and Envoy, Turning "HTTP Compression On by Default" into an Industry-Wide Patch Window; Meanwhile National Bodies Vote Down C++26, and Roku Migrates Repos to GitLab with a Warning That Search Indexes Expire Silently — Today's Breakages Stem from Overlooked Defaults
BrotliCVE-2026-111497node2shellhttp2shell