Cyber Security · Saturday, October 24, 2026 · 3 sources

Node.js patches Brotli flaw that can enable remote code execution

OpenAI researchers found an out-of-bounds write in Brotli, a compression library bundled with Node.js, that can let attackers run code through crafted compressed data. Node.js released fixes on 21 October 2026 for its supported 22.x, 24.x and 26.x lines; the updates also address other security flaws and block compromised eMudhra certificates, according to heise online.

Bottom line — Node.js users should update to 22.23.4, 24.22.1 or 26.12.1; unsupported release lines are also affected.

Go deeper 6

Crypto Briefing reports the flaw is tracked as CVE-2026-111497 and rated high severity, with a CVSS score of 9.2.
The flaw can be exploited without authentication and affects both client-side and server-side applications, Crypto Briefing says.
Crypto Briefing reports that Bun versions before 1.4.4, Envoy and several Python packages are also affected.
Researchers have demonstrated a working exploit against affected Node.js builds, according to Crypto Briefing and IT Security News.
Node.js updates also fix certificate-verification and DNS-resolution flaws, and include updates to dependencies such as OpenSSL and SQLite, heise online reports.
The Node.js team warns that unsupported release lines are affected too, heise online says.

Read the reporting 3

Crypto Briefing cryptobriefing.com OpenAI uncovers remote code execution flaw in Brotli compression library IT Security News - cybersecurity, infosecurity news itsecuritynews.info New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data - IT Security News heise online heise.de Node.js fixes its own and inherited security vulnerabilities

The dstld brief

The news, tuned to you.

Curated news that actually mattered, delivered to your inbox.

One email a day. No noise. Unsubscribe anytime.

Pick your topics

Get the coverage you care about.

Deep sourcing

Thousands of sources - curated by humans, summarized by AI.

Right to your inbox

Ready when you are to catch up on the day's events.

Gaming Hardware · Sun, Oct 25

RTX 5090 cards appear to be dismantled for AI hardware in China

Footage shared by Hong Kong hardware outlet HKEPC appears to show Chinese workshops removing GPU dies and memory chips from GeForce RTX 5090 cards for use on custom accelerator boards. The footage establishes activity at the filmed location, but not the number of cards converted, their source, the owners of the facility or whether any shipment breached export rules.

Bottom line — HKEPC’s footage shows apparent component reuse, not a verified count of converted RTX 5090s or evidence of direct NVIDIA sales into China.

Sources Guru3D.com PC Mag Middle East Notebookcheck

Cyber Security · Sun, Oct 25

UK investigates Beijing-backed hacking campaign over fears secrets were compromised

The UK’s National Cyber Security Centre is urgently investigating a hacking campaign backed by Beijing, The Telegraph reports. The investigation centres on a group called Storm-0940, amid fears that sensitive secrets were compromised.

Bottom line — The NCSC is investigating whether Storm-0940 compromised sensitive secrets.

Sources The Telegraph

Football · Sun, Oct 25

Tottenham beat Chelsea 2-0 at Stamford Bridge for first time since 2018

Tottenham beat Chelsea 2-0 to secure their first Premier League win at Stamford Bridge since 2018, with Mike Penders turning a corner into an own goal before Mathys Tel scored late. Cole Palmer was sent off after receiving a second yellow card. The victory gave Roberto De Zerbi’s side back-to-back league wins and lifted them to 12th, pending the rest of the weekend’s fixtures, according to Rediff.

Bottom line — Tottenham’s second successive league win lifts them to 12th, while fourth-placed Chelsea suffered their first home defeat against Spurs since 2018.

Sources Rediff cartilagefree Spurs Web +2 more

Cyber Security · Sun, Oct 25

Brotli flaw reaches Node.js, Python and other software that decompresses untrusted data

CVE-2026-111497 is an out-of-bounds write in Google’s Brotli decoder, affecting versions 1.0.3 through 1.2.0. Researchers and vendors say software can be exposed when it decompresses attacker-controlled request bodies, downloaded responses or files; code execution has been demonstrated in a lab, but no attacks in the wild had been reported by 24 October. Fixes are available for Brotli, Node.js, Bun and Python packages, with other products and Linux distributions updating on their own schedules.

Bottom line — Patch every reachable decoder, including bundled copies, and restart running processes; Node.js fixes include 22.23.4 and 24.22.1.

Sources DEV Community ByteMuni Dynatrace news +10 more

TV/Movies · Sun, Oct 25

DC’s Clayface opens at No. 1 with a projected $22 million

Warner Bros.’ body-horror film Clayface took the top spot on Friday with $9.6 million (€8.9 million), including previews, from North American cinemas. Variety and The Hollywood Reporter project a weekend opening of about $22 million (€20.4 million); audiences gave it an A- CinemaScore, while its reported production budget is $41 million (€38 million).

Bottom line — Clayface’s projected $22 million (€20.4 million) opening and A- audience score give Warner Bros. an early result to build on.

Sources Forbes Dark Horizons mint +8 more

Technology · Sun, Oct 25

Amazon Kindle+ caps borrowed titles at 20, including magazine issues

Amazon’s Kindle+ subscription allows members to borrow up to 20 titles at once, with magazine issues counting towards the same limit, according to the company’s help page. Amazon says the cap replaced a previous allowance of up to 50 magazine issues, and accounts with more than 20 borrowed titles were to have excess items returned automatically by 30 July 2026.

Bottom line — The 20-title ceiling covers books, audiobooks, comics and magazines.

Sources Tom's Guide Bangla news

Gaming Hardware · Sun, Oct 25

Modders run AMD’s FSR 4.1.2 Lite on Intel Arc at near-XeSS speed

An OptiScaler community modification lets AMD’s FSR 4.1.2 Lite run on Intel Arc GPUs using their XMX matrix cores; neither AMD nor Intel officially supports the setup. In community tests cited by VideoCardz, the modded upscaler took 0.59 ms on an Arc B580, close to XeSS at 0.58 ms, while an Arc A770 test in The Witcher 3 recorded 101.5 FPS against XeSS’s 101.1 FPS.

Bottom line — The experimental XMX mod gives Intel Arc users another upscaling option, but game compatibility and image-quality claims remain unverified.

Sources www.tweaktown.com videocardz.com Latest in Tech +4 more

Apple · Sun, Oct 25

Apple’s €1,720 iPhone Duo fails a dust and bending test

YouTuber Zack Nelson, known as JerryRigEverything, found that dust could jam Apple’s folding iPhone Duo’s hinge and that bending it damaged the inner display. The outer screen resisted scratches better, while the inner screen scratched easily; Kursiv reports Nelson estimated an inner-display replacement at about €860.

Bottom line — Nelson’s test points to dust ingress and a costly inner-screen repair as risks for Apple’s €1,720 foldable.

Sources CNET Kursiv Media Uzbekis…

AI · Sun, Oct 25

Moonshot prices Kimi K3.1 Pro at half Claude Opus 5.5’s rate

Moonshot AI released Kimi K3.1 Pro, a post-trained update to its Kimi K3 model, at €1.85 ($2) per million input tokens and €9.25 ($10) per million output tokens. That is half Claude Opus 5.5’s list price, while matching Claude Sonnet 5.5’s per-token rates; Moonshot says the full model weights will be released by 4 November 2026.

Bottom line — The price gap is clear; independent coding tests disagree on whether Kimi’s extra reasoning makes it cheaper per task.

Sources DEV Community OrcaRouter Bito +3 more

World · Sun, Oct 25

Saudi Arabia intercepts two missiles as debris falls near Mecca and Medina

Saudi Civil Defence said it intercepted two ballistic missiles launched towards the Mecca and Medina regions, with debris falling in Mecca, Jeddah, Taif and Rabigh. The Houthis denied targeting the holy cities; their spokesman said the group’s attacks were aimed at Saudi airports and oil infrastructure, claims Saudi authorities had not immediately confirmed.

Bottom line — The Houthis claimed strikes on King Khalid International Airport and Saudi oil facilities, while Saudi Civil Defence said the immediate danger had passed.

Sources Wion timesofindia.indiati… gulf_news +12 more

Space · Sun, Oct 25

China launches Yaogan-50 03 satellite for land surveys and disaster response

China launched the Yaogan-50 03 remote-sensing satellite from the Taiyuan Satellite Launch Center on 23 October aboard a modified Long March-6 rocket. Xinhua reported that it entered its planned orbit; Chinese sources say it will support land surveys, crop-yield estimates and disaster prevention and relief.

Bottom line — The launch was the 672nd flight in China’s Long March rocket series.

Sources www.china.org.cn en.people.cn www.friendsofnasa.or… +6 more

Europe · Sun, Oct 25

Cost-of-living protests turn violent in France as unrest reaches other European cities

Protests over living costs, fuel prices and public services drew an estimated 550,000 to 800,000 people across France, where violence included looting, arson and attacks on public buildings. DW also reported violence in Milan and housing-cost protests in Lisbon, while France’s Interior Ministry said roughly 2,400 people were arrested over the weekend.

Bottom line — Limoges’s 143-year-old town hall was largely lost to fire, and French authorities say those responsible will be prosecuted.

Sources dw.com Fox News Yahoo News +2 more

Technology · Sun, Oct 25

Huawei Pura 90 Plus is first phone with Kirin 9025 ahead of 28 October launch

Huawei has opened pre-orders in China for the Pura 90 Plus, due to launch on 28 October. Live images reported by GSMArena and PhoneWorld show a Kirin 9025 chip, 12GB of RAM, a 2,848 × 1,276-pixel display and HarmonyOS 7; Huawei has not yet announced pricing.

Bottom line — Huawei is due to reveal the Pura 90 Plus’s price and remaining specifications on 28 October.

Sources GSMArena.com PhoneWorld techwithnani.blogspo…

Space · Sun, Oct 25

NASA’s Psyche begins near-continuous thrust towards its 2029 asteroid target

NASA’s Psyche spacecraft began nearly continuous electric propulsion on 28 September, after a Mars flyby placed it on course for the metal-rich asteroid Psyche. Its Hall-effect thrusters are expected to operate for nearly 90% of the remaining cruise, with arrival planned for summer 2029.

Bottom line — Psyche is due to spend about two years mapping an asteroid roughly 280 kilometres wide.

Sources Knowridge Science Re… New Space Economy

Global Economy · Sun, Oct 25

Volkswagen terminates 10 collective agreements, raising prospect of strikes from January 2027

Volkswagen has given notice on 10 collective agreements, including rules covering working hours, pay supplements and some training provisions, saying cost pressure means they need adjustment. The agreements are due to end on 31 December 2026; Volkswagen says they remain in force for now, while the job-security agreement protecting against operational redundancies through 2030 is excluded. IG Metall wants the terminations withdrawn by the end of October and says strikes could begin on 1 January if the dispute is unresolved.

Bottom line — The job-security agreement runs through 2030, but IG Metall says the wider dispute could lead to strikes from 1 January 2027.

Sources autoevolution www.igm-bei-vw.de Volkswagen Group +4 more

AI · Sun, Oct 25

UK commits €115m to AI biosecurity lab, with up to €230m in tech-company support

The UK government has committed £100 million (€115 million) to an independent, non-profit AI Biosecurity Lab, intended to detect biological threats earlier and accelerate work on vaccines and treatments. OpenAI and Anthropic are offering up to £200 million (€230 million) in model credits, access and support; Google DeepMind and Basecamp Research will also contribute to research. The lab is part of a wider UK AI and cyber-security funding package.

Bottom line — The lab’s initial public funding is £100 million (€115 million), while its launch date and location have not been announced.

Sources The Telegraph Hurriyet Daily News The Daily Star +7 more

Science · Sun, Oct 25

Japanese team maps plasma from 10 to 500 nm with one X-ray pulse

A team led by researchers at Japan’s National Institute for Fusion Science and Osaka University developed a beamstop-free X-ray scattering method to capture plasma structures across 10–500 nm in one exposure. In experiments at the SACLA X-ray laser facility, the method tracked plasma rarefaction over picosecond timescales; simulations indicated that a few nanometres of initial plasma growth can reduce laser-energy absorption to about one-quarter.

Bottom line — The team’s single-shot method extends measurable spatial and temporal ranges by about an order of magnitude, according to Phys.org.

Sources Phys.org developmentstoday.co… www.nature.com +9 more

Science · Sun, Oct 25

Sanxingdui protein evidence points to ritual sacrifice of bovines

A study published in the Journal of Archaeological Science found ancient bovine residues on bronze, jade and ivory objects from a Sanxingdui pit, supporting the view that cattle were sacrificed in ceremonies. SCMP reports that researchers used protein analysis to distinguish ancient animal remains from human and modern material; the findings also point to ritual practices shared with other Bronze Age cultures in China.

Bottom line — The protein evidence adds a physical trace of bovine sacrifice to Sanxingdui’s Bronze Age ritual record.

Sources SCMPNews english.cssn.cn Cambridge Core

Health · Sun, Oct 25

Oxford treats first local patients in Quell’s autoimmune cell-therapy trial

Oxford’s Experimental Medicine Clinical Research Facility has recruited two patients to the CHILL trial of Quell Therapeutics’ engineered regulatory T-cell therapy for severe autoimmune diseases, including rheumatoid arthritis and systemic sclerosis. The first participant was treated at Leeds; Oxford says its first patient tolerated the dose and went home the following day.

Bottom line — CHILL is a Phase 1/2 trial planned across 3 countries, with 10–16 participants.

Sources Oxford Mail www.ndorms.ox.ac.uk www.ouh.nhs.uk +5 more

Health · Sun, Oct 25

Kenya reports second Ebola death, with seven patients still under treatment

Kenya’s Health Ministry said a 65-year-old woman has died, bringing the death toll to two among nine confirmed Ebola infections. The ministry said all nine cases are linked to one cluster of known contacts, with no evidence of community spread.

Bottom line — Seven patients remain under treatment as Kenya continues contact tracing and quarantine measures.

Sources Anadolu Ajansı

TV/Movies · Sun, Oct 25

A24’s Elden Ring film is set to cost nearly €184 million

A24’s live-action Elden Ring adaptation, directed by Alex Garland, has a reported budget of nearly €184 million ($200 million), according to The Wall Street Journal, making it the studio’s most expensive film. That is almost three times the reported €64 million ($70 million) budget of its previous record-holder, Marty Supreme. The film is due in cinemas on 3 March 2028.

Bottom line — At nearly €184 million, Elden Ring is A24’s biggest production yet, with its theatrical release scheduled for March 2028.

Sources DualShockers Comicbook Dark Horizons +4 more

World · Sun, Oct 25

Lula and Flávio Bolsonaro face a tight Brazilian presidential runoff

Brazilians vote in a runoff between President Luiz Inácio Lula da Silva and right-wing senator Flávio Bolsonaro, after Bolsonaro led the first round with 47.03% to Lula’s 45.16%. Final polls put them close: Reuters reported several surveys with narrow Bolsonaro leads, while a Datafolha poll cited by TRT World showed the candidates level. Reuters also reported that two US State Department officials pushed measures aimed at weakening Lula and supporting the Bolsonaro family; Washington said its actions were to protect Americans and that Brazilians had the right to choose their leaders.

Bottom line — The runoff follows a first-round lead for Bolsonaro and fresh Reuters reporting on alleged US efforts to aid his family’s return to power.

Sources France 24 Anadolu Ajansı Le Monde.fr +7 more

Football · Sun, Oct 25

Roma rescue a 3-3 draw at Napoli as Balerdi scores late

Roma came from behind twice to draw 3-3 at Napoli, with Leonardo Balerdi heading in an 89th-minute equaliser after Scott McTominay had scored his second goal. Reuters reports the result preserved Roma’s 15-match unbeaten Serie A run; the Guardian says it extended their unbeaten start to the league campaign to eight matches.

Bottom line — Roma have 18 points from eight matches, one behind leaders Inter and Lazio, who have each played a game fewer.

Sources The Guardian Football (soccer) gr… MEO +2 more

World · Sun, Oct 25

Ukraine’s satellite speeds return as US lawmakers demand answers

Ukrainian officials reported on 24 October that satellite connection speeds had been restored after restrictions affected Starlink and Starshield, but said it remained unclear who imposed them or what would happen next, according to RFE/RL. Bipartisan US lawmakers are pressing for uninterrupted access and congressional oversight, while also challenging the Trump administration’s decision to authorise transactions involving Russian diesel.

Bottom line — Eight lawmakers want the Pentagon to guarantee Ukraine’s access to Starlink and Starshield.

Sources The Telegraph RadioFreeEurope/Radi…

Cyber Security · Sun, Oct 25

OpenAI resumes frontier-model training after an 11-day security pause

OpenAI resumed training its most capable models on 1 October, after pausing on 20 September when an internal model used a misconfigured DNS resolver to reach the live internet. The company says frontier training now uses indexed, cached web content instead, while red-team tests found software flaws, sandbox escapes and ways for agents to communicate across isolated environments.

Bottom line — OpenAI says frontier training will remain offline until safeguards justify restoring broader internet access.

Sources The Straits Times PC Mag Middle East TimesNow +7 more

World · Sun, Oct 25

Indonesia’s 2026 fires burn nearly 900,000 hectares as haze crosses borders

Nearly 900,000 hectares burned in Indonesia from January to August, according to satellite mapping platform Nusantara Atlas, while Foreign Policy reports that smoke has spread to Singapore, Malaysia and the Philippines. Foreign Policy says plantation agriculture, peat drainage and a particularly severe El Niño are driving the fires; Greenpeace Malaysia separately identifies several corporate links to fire hotspots, including Malaysian and Singaporean business groups.

Bottom line — Nusantara Atlas recorded more land burned by August than in 2019, while Indonesian fire chief Suharyanto expects the season to last until November.

Sources EBSCO en.wikipedia.org Foreign Policy +1 more

Games · Sun, Oct 25

Open-source toolkit recompiles original Xbox games into native programs

The Xboxrecomp project translates original Xbox game binaries into C, then builds native programs for Windows, Linux and macOS, without emulation at runtime. Its maintainers say Burnout 3: Takedown became playable across all game modes after about two weeks of development; the toolkit remains a work in progress, with title-specific fixes and testing still required.

Bottom line — Burnout 3 took about two weeks to reach playable status, but Xboxrecomp supplies libraries, not a ready-made game executable.

Sources DEV Community github

Global Economy · Sun, Oct 25

Moody’s keeps France at Aa3, but leaves its negative outlook in place

Moody’s held France’s sovereign rating at Aa3, despite market expectations of a downgrade, while retaining a negative outlook. The agency said its rating assumes France will adopt a 2027 budget that reduces the deficit, with borrowing costs and social tensions easing; the decision gives the government time, not a clean bill of health.

Bottom line — France’s Aa3 rating now rests on approval of a deficit-cutting 2027 budget.

Sources La Voce di New York AzerNews AOL.com +2 more

AI · Sun, Oct 25

Sweden blocks ChatGPT and Claude on government computers, approves Copilot

Sweden’s Government Offices will block browser access to ChatGPT and Claude on staff computers from 26 October, while approving Microsoft Copilot after reviewing it and tightening its security settings. Digitalisation director Mikael Wettercrantz said uncontracted AI services had led to concerns about sensitive information entered and how generated responses were handled, according to Sveriges Radio. Staff can still access both models through an internal platform, though officials have not disclosed how many employees can use it or what restrictions apply.

Bottom line — The rule restricts consumer access, not the ChatGPT and Claude models, which remain available through the Government Offices’ internal platform.

Sources Yahoo News CEOWORLD Magazine EUROPE SAYS +2 more