Aikido

CVE-2026-111497 (CVSS 9.2) lets a crafted Brotli stream trigger an out-of-bounds write, and it works in both directions: a malicious server can hit a client, and a malicious client can hit a server.

The thread argued about the name. Whether HTTP is really exposed turned out to depend on one setting.

JavaScript dependency trees turn a tiny convenience library into a path for a compromise. The practical task is not merely to remove one package, but to find where it entered the build.

HN treated the episode as another reason that package provenance and update discipline belong to ordinary engineering work.