sanitation@lemmy.today to Programming@programming.dev · 8 days agoBroccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and morebroccoli2shell.comexternal-linkmessage-square18linkfedilinkarrow-up129arrow-down11file-textcross-posted to: cybersecurity@sh.itjust.works
arrow-up128arrow-down1external-linkBroccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and morebroccoli2shell.comsanitation@lemmy.today to Programming@programming.dev · 8 days agomessage-square18linkfedilinkfile-textcross-posted to: cybersecurity@sh.itjust.works
minus-squaretribut@infosec.publinkfedilinkarrow-up3·7 days agoNot if your threat model is “bots that scan the internet for vulnerable installations of X”.
minus-squarepcouy@lemmy.pierre-couy.frlinkfedilinkarrow-up2·7 days agoA lot of these bot requests come from what seems to be compromised hosts turned into scanners and residential proxies.
minus-squaretribut@infosec.publinkfedilinkarrow-up2·7 days agoTrue, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.
Not if your threat model is “bots that scan the internet for vulnerable installations of X”.
A lot of these bot requests come from what seems to be compromised hosts turned into scanners and residential proxies.
True, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.