Critical HTTP2Shell flaw in Brotli compression exposes Python servers to remote code execution

·2 views

A critical vulnerability tracked as CVE-2026-111497, nicknamed HTTP2Shell, affects Python servers that rely on Google's Brotli compression library. Packages such as urllib3[brotli] and aiohttp[speedups] pull in the affected dependencies, and they were reportedly downloaded 4.2 million times from PyPI in a single day. Attackers can exploit a malformed request to trigger memory corruption and potentially execute arbitrary code on the server. Versions brotli 1.2.0 and earlier, and brotlicffi 1.2.0.2 and earlier, are identified as vulnerable, and developers are urged to update immediately and audit for compromise.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Essay Likens Current AI Anxiety to Fears Around Early Capitalism

A Hacker News post linked to an essay titled "Cognitive Mercantilism" argues that today's worries about artificial intelligence resemble the apprehensions that accompanied the rise of early capitalism. The essay, hosted on a personal site, was submitted on October 26, 2026, and drew four points but no comments. Its title frames AI as a possible instrument of economic power, similar to how mercantile policies once shaped national wealth. The author appears to suggest that historical responses to market upheaval, such as regulation and labor organization, could inform current debates over AI oversight. The post's modest engagement suggests the piece has so far attracted only niche attention.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free-Tier Batch Job Survives Restart by Caching Model Calls as Files

A developer ran an overnight log-classification batch on a free server, only to find that a silent restart caused the job to re-ask questions it had already answered. The root problem was an incorrect definition of completion, along with appending output without any safeguard against duplication. Temperature zero was found not to guarantee identical responses, so the developer shifted focus to durably recording what the model actually returned. The solution borrows record-and-replay techniques from HTTP tooling: each request payload is hashed, and its response is saved under that hash. Repeat requests are then served from disk, and a replay mode allows the whole pipeline to run with the network disabled.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Client-Side PDF Viewers: Local Processing Alone Does Not Guarantee Security

Running PDF processing in the browser can reduce exposure from server-side handling, but it is an architectural choice rather than a full security guarantee. Developers should verify where document data actually travels, including uploads, external APIs, OCR or conversion services, logs, analytics, and temporary storage. Browser risks such as malicious extensions, injected scripts, and cross-site scripting can still expose content the page can access. Security also needs to cover operations like search, annotation, redaction, and export, since hiding text visually does not necessarily remove it from the file. Reviews should combine network inspection, source-code review, and testing across every workflow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

iOS 27 Adds LongRunningIntent and Related App Intents APIs for Siri Integrations

Apple's iOS 27 update expands the App Intents framework with new APIs, including LongRunningIntent, CancellableIntent, EntityCollection, and SyncableEntity, as presented at WWDC26 Session 345. The changes aim to make Siri integrations more resilient to long-running work and keep entities consistent across devices. Previously, the system gave a standard intent only about 30 seconds to finish, which could cause complex tasks like batch photo processing to fail. LongRunningIntent extends background execution time and builds on the progress-reporting infrastructure that has existed since iOS 17.0. The core purpose of App Intents, making app content discoverable to Siri, Spotlight, Shortcuts, and widgets, remains unchanged.

0 comments Read more at DEV Community