Daily brief: Tuesday 27 October 2026
The Brotli 'HTTP2Shell' flaw sees its first reported attack attempt, Apple backports an exploited iOS fix, OpenAI launches GPT-6.1 Terra, Anthropic files to list on Nasdaq, and fake Claude download pages spread malware through Google Ads.
HTTP2Shell Brotli flaw: patches out for Node.js and Python, first attack attempt reported
A buffer overflow in Google's Brotli decompression library (CVE-2026-111497), also called HTTP2Shell, Node2Shell or Broccoli2Shell, affects Node.js, Python HTTP clients set up with a vulnerable Brotli decoder, and other software that bundles Brotli. Fixed versions include Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, and Python Brotli 1.2.1. BleepingComputer reported on 26 October that proof-of-concept exploits were public but no attacks had been confirmed. On 27 October, Cyber Kendra reported that threat intelligence firm ELLIO recorded what it calls the first real exploitation attempt on 26 October, aimed at Node.js 24.22.0.
Source: BleepingComputer · Cyber Kendra
Fake Claude download pages on claude.ai spread malware through Google Ads
Gen Digital researchers found attackers hosting fake 'Download Claude' pages as user-generated shared chats and public Artifacts on claude.ai, then paying for Google Ads to push them up search results. Because the pages sit on the real domain, the address, padlock and logo all look genuine, though Claude shows a 'user-generated and unverified' banner. Visitors are told to paste a command into Terminal or the Windows Run box, which installs Atomic macOS Stealer on Macs or a .NET remote access and wallet-stealing tool on Windows.
Source: Cyber Security News
Apple backports an exploited CoreGraphics fix to older iPhones and iPads
On 26 October Apple released iOS 18.7.11 and iPadOS 18.7.11 to fix CVE-2026-86950, a CoreGraphics flaw Apple says may have been exploited against specific targeted individuals. CISA added it to its Known Exploited Vulnerabilities catalogue on 29 September. The update covers devices that can't run newer iOS versions, including the iPhone XS, XS Max and XR.
Source: SecurityOnline
OpenAI launches GPT-6.1 Terra, a cheaper model for computer use
OpenAI released GPT-6.1 Terra, which it describes as a fast, efficient model for visual reasoning and computer use, such as filling in forms and automating repetitive desktop work. It is available to Plus, Pro, Enterprise and Edu users in ChatGPT and Codex, and in the API as gpt-6.1-terra at $1 per million input tokens and $5 per million output tokens. OpenAI says this is 50% cheaper than GPT-5.6 Terra and GPT-6.1 Sol; its speed and accuracy figures are its own and not independently checked.
Source: BleepingComputer
Anthropic files to list on Nasdaq under the ticker ANT
Anthropic made its S-1 filing with the US Securities and Exchange Commission public on 26 October, planning to list Class A shares on Nasdaq as 'ANT'. The filing reports $16.3bn of revenue for the first half of 2026 and a net loss of $80.7bn, mostly from a non-cash charge on convertible notes. It says more than 11,900 customers pay over $100,000 a year, and the company remains a public benefit corporation. The price range and share count were left blank.
Source: The Next Web
University of Copenhagen breach exposes data on 525,000 people through a test system
The University of Copenhagen says attackers got into one of its test environments, which held personal data on about 525,000 people, including names, Danish national ID numbers, phone numbers and email addresses. A later update added about 20,000 staff and students whose PIN codes were exposed, and the university restricted access to some campus locations while it issued new access codes. It says the attack is contained and it has reported the breach to the Danish data protection authority.
Source: BleepingComputer
Weather
Live forecastLoading the forecast…