What you need to know today.
Actively exploited Brotli decoder flaw (CVE-2026-111497) added to KEV, impacting Node.js, Python, and Microsoft products. Fortinet, Microsoft, and Atlassian also released critical patches.
A critical buffer overflow vulnerability in the Brotli decoder (CVE-2026-111497) has been actively exploited in the wild, prompting widespread patching efforts across various software, including Microsoft products, Node.js, and Python packages. This flaw allows remote, unauthenticated attackers to corrupt decoder state memory and potentially disclose sensitive information. As reported by Cyber Security News, CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the urgency for affected organizations to apply updates. The vulnerability