Oren Yomtov of Accomplish showed two ways out of the OpenAI Codex sandbox, one from read-only mode. OpenAI fixed both within eight days.
An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.
The Node2Shell vulnerability in Brotli is under active attack. Patch Node.js to 26.12.1, 24.22.1 or 22.23.4 now.
Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.