What you need to know today.
Critical vulnerabilities disclosed in Brotli decoder, Oracle Java, and Google Chrome; multiple other high-impact flaws affect various products.
A critical buffer overflow vulnerability in the Brotli decoder (CVE-2026-111497) affects Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote, unauthenticated attackers to corrupt decoder state memory and potentially disclose sensitive information. The vulnerability has been linked to a Node.js RCE exploit known as Node2Shell, and also impacts Bun and Python. As The Hacker News reported, this bug could allow remote code execution in all supported versions of Node.js. Patches are available for Node.js, and users are urged to update.
Oracle has released an emergency update to address critical vulnerabilities in Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. Specifically, CVE-2026-114820 and CVE-2026-91403, both rated Critical with a CVSS score of 9.1, affect the JSSE component. These flaws could allow remote attackers to compromise systems. Cyber Security News highlighted that Oracle issued an emergency Java update for a critical HTTPS trust vulnerability. This is part of Oracle's October 2026 Critical Patch Update, which addresses over 1,200 vulnerabilities across its product lines.
Google Chrome versions prior to 150.0.7871.46 contain numerous critical vulnerabilities, including several that could allow remote attackers to escape the browser sandbox. Among these are use-after-free flaws (CVE-2026-14398, CVE-2026-14390, CVE-2026-14417), out-of-bounds reads/writes (CVE-2026-14416, CVE-2026-14397, CVE-2026-14392), insufficient input validation (CVE-2026-14382, CVE-2026-14411), uninitialized use (CVE-2026-14405), and integer overflows (CVE-2026-14387). Vypr Intelligence noted that 25 vulnerabilities were disclosed, with several rated as critical. Users should update to the latest version of Chrome to mitigate these risks.
JetBrains has released updates to address a critical code execution vulnerability in IntelliJ IDEA. CVE-2026-59792, a path traversal flaw in project workspace ID handling, could allow remote attackers to execute arbitrary code. Cyber Security News reported that JetBrains fixed this critical vulnerability along with four TeamCity vulnerabilities. Users of IntelliJ IDEA are advised to update to version 2026.1.4 or 2026.2 to patch this issue.
Several other critical vulnerabilities have been disclosed across various products. These include SQL injection flaws in UTT nv518G (CVE-2026-52186) and MediaWiki's Cargo Extension (CVE-2026-58521), an OS command injection vulnerability in IEATASICS M300 Wi-Fi Repeater (CVE-2026-58457), and a remote code execution vulnerability in Pivotal CRM (CVE-2026-51947). Additionally, Unitree Robotics Go2 (CVE-2026-115995) has a vulnerability in its set_volume function, and Dell PowerFlex Manager (CVE-2026-56688) has an OS command injection flaw. Patches and updates are recommended for all affected systems.