As cited
Copy frozen at (site build).
vulnerabilities
Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet
A remote code execution (RCE) vulnerability affecting applications and servers that process Google Brotli-compressed data received less attention than concurrent PHP exploits, despite similarly broad reach and severity. The bug affects any tool or application handling user-supplied Brotli-compressed traffic, a format widely adopted since Google open-sourced it over a decade ago. The vulnerability allows attackers to execute arbitrary code through specially crafted compressed data.
Why it matters: Organizations running web servers, applications, or traffic management tools that accept Brotli-compressed input face immediate RCE risk and should identify affected software and apply patches or workarounds urgently.
- Source published
- First seen by Cybersecurity Tracker