Brotli Flaw Spreads as LiteLLM and GMO Breaches Unfold
Day 10 · October 25, 2026 · Singularity Watcher · View on X
SECURITY
The Brotli flaw spreads. CVE-2026-111497, the remote code execution flaw in Google’s Brotli compression library first exposed through Node.js and nicknamed “Node2Shell,” turns out to reach far beyond Node [1]. Node patched it on October 21, but the bug lives in Brotli’s decoder, which is compiled into many other runtimes and packages, often under other names.
Semgrep, a code security company, said its researchers Diptendu Kar and Kurt Boberg found 433 package entries across 12 software ecosystems that bundle the vulnerable decoder [1]. So far about 71% have no fix, and most existing fixes are alpha or early releases. Thirty-eight entries bundle Brotli older than version 1.0.3, some dating to 2016.
Aikido, another security firm, said the flaw has evolved into “HTTP2Shell”: many libraries and applications that speak HTTP are exposed to remote code execution before any login, through Brotli decompression [2]. Aikido said fixes are not yet available for every affected service and advised watching for Brotli 1.2.1 upgrades.
LiteLLM’s root cause. LiteLLM, a popular open-source gateway that lets software route requests to many AI models, explained how attackers published a malicious version of its Python package [3][4]. On May 27, a configuration file containing the master key to a LiteLLM Agent Platform deployment was committed to a public GitHub repository. The commit was overwritten, but the key was never revoked.
On October 10, an attacker used that key to enter the Agent Platform and extract a GitHub token belonging to the organization’s owner, which was not scoped down [4]. With it, the attacker stole maintainers’ tokens, overrode branch protection, repointed the release pipeline to a lookalike repository, and on October 21 published LiteLLM 1.107.0 to PyPI, the main Python package index.
The malicious release ran automatically whenever Python started, even if LiteLLM was never imported, stealing credentials and installing an hourly backdoor [4]. An Upwind researcher reported it within half an hour, and PyPI quarantined it that afternoon. LiteLLM said a release safeguard tied to a physical device had been relaxed that week to speed up bug-fix releases.
Pillow. A critical flaw in Pillow, the most widely used image library for Python, lets an attacker run operating system commands just by controlling the name of an EPS image file, which Pillow passes unchecked to the Ghostscript program [5][6]. Pillow is downloaded about 436 million times a month, according to OX Security.
The fix, Pillow 13.0.0, released October 16, also closes several other serious bugs [6]. One of them, a crash in JPEG thumbnail handling, was found by Anthropic using Claude to study open-source security, part of an effort that has turned up hundreds of flaws. Another had sat in Pillow since 2013.
A Japanese cloud shut down. GMO Internet, a major Japanese internet infrastructure company, shut down its entire Onamae Desktop Cloud service from 4:00 a.m. Japan time on October 21 after finding that a third party had installed malicious programs on customer servers; 26,739 servers were potentially affected [7][8]. The service is widely used to run automated forex trading bots.
GMO later confirmed customer information was taken and that some customers reported trades they did not make [9]. It will not restart the compromised system, will pay every customer a 5,000 yen goodwill payment, and will compensate realized losses from unauthorized trades.
The security commentator Bala reported that more than 70 brokers were affected, that OANDA Japan froze withdrawals, and that GMO asked Japan’s government to use new “active cyber defense” powers, in force since October 1, to trace and neutralize the attackers’ infrastructure [7].
Inside the smart TV. A reverse engineer and penetration tester who posts as log4j has been publishing findings from rooting a Samsung TV. According to the posts, a TV without a microphone looks for connected devices that have one, such as a soundbar, and sends audio to Bixby, Samsung’s assistant [10].
The TV also classifies the sounds it hears before reporting back, with dog-barking and baby-crying event counters built into its telemetry [10].
The same researcher said OpenAI banned the account after the work tripped “daybreak,” apparently an automated abuse detector; the post did not explain the term [11]. The researcher said OpenAI was never used to find or exploit vulnerabilities, only for local reverse engineering.
Separately, the creator Vaibhav Sisinty reported, citing a Reddit post, that Claude now halts mid-answer when asked to write a “Reverse Engineer Anything” playbook, a popular workflow for dissecting firmware [12]. He noted the timing after a viral post on rooting a Samsung TV, said Anthropic has not confirmed any change, and said some users report the workflow still works.
The sensory scientist and chief executive John Ennis suggested TVs are being rooted in the wake of what he called the “eMudra debacle,” and that cheap televisions may have been subsidized by spying [13]. That refers to the eMudhra certificate authority keys compromise recorded in this chronicle on Day 9 [14].
“The only way out is through.” Eric S. Raymond, the veteran open-source programmer and author, wrote that people are calling the AI-driven flood of discoveries the “Bugpocalypse” [15]. He argued against locking frontier models away, since Chinese open-weight models will spread regardless, and said the finite stock of software defects can now be fixed with “a million friendly robots.”
An a16z partner who posts as YODELAGARZA predicted it is “almost certain” that governments will take critical infrastructure offline within a year to patch it before AI-powered attackers get in [16]. He said banks that got access to Glasswing six to eight months ago have “been doing nothing but patching” since.
Glasswing is Anthropic’s controlled program giving partners access to its Claude Mythos Preview model to find and fix flaws in critical software. Anthropic reported that it and about 50 partners found more than ten thousand high- or critical-severity vulnerabilities in the program’s first month [17].
COMPUTE AND CAPITAL
GPUs gaining value. The venture firm a16z reported that AI chip rental rates have risen since January 1: the Nvidia H200 is up about 160%, the B200 about 120%, the RTX PRO 6000 about 65%, and the H100 about 35%; even the six-year-old A100 rents for more [18].
One explanation, a16z said: token demand on OpenRouter, a marketplace that routes requests across AI models, rose about 27 times since last November, from roughly 6 trillion to 165 trillion tokens per week [19]. Open-weight models now handle about 72% of those tokens, up from 28%.
Where the money goes. Investor Chamath Palihapitiya said 1% of companies account for 90% of AI token spending and that 80% of them are spending money raised from venture capitalists [20]. He called this circular flow a structural problem until AI spreads beyond the startup ecosystem.
AI RESEARCH
A bug in softmax. Jon Barron, a principal research scientist at Google DeepMind, reported that all existing implementations of softmax and cross-entropy, two of the most basic functions in deep learning, used in JAX, PyTorch and textbooks, contain two subtle numerical bugs [21].
The paper, by Barron, Dan Gnanapragasam and Michael Tschannen, shows that at high confidence the target gradient rounds to zero, which causes the sudden loss spikes known as “slingshots” during grokking, the delayed generalization seen in some training runs [22]. A rewrite in log space fixes both bugs.
Agents as organizations. General Reasoning introduced Reinforcement Learning from Collective Rewards, which trains language models as organizations of agents sharing a message board, and used it to train Avalon-M1-Mini, a 120-billion-parameter model [23]. The company reported learned hierarchies, division of labor, and more hiring of verifiers and testers.
Chief executive Ross Taylor said that in one experiment a CEO agent told to decide whom to hire chose lead engineers and middle managers, which he said economic theory predicts [23].
Models misjudge their own reasoning. A University of Chicago paper, summarized by Rohan Paul, found that a language model’s own account of what drives its decision is a poor guide to what actually varies across its answers [24]. In forecasts of 59 March Madness games, the models’ predicted key questions matched the real ones less often than a random shuffle.
The authors recommend sampling many answers and studying where they disagree [24].
AGENTS AND TOOLS
Software engineer Jack Ellis, who builds the analytics company Fathom, said he was “100% sold” on Cursor Projects, in which a coordinator agent spins up other agents and pull requests instead of one agent per task [25].
Prerelease builds of Grok Bot 0.77 show a calling feature that can dial a number, wait on hold, press keys and be transferred while the user watches a live transcript, plus Tailscale private-network support, payments settings, and bot sharing, according to accounts that track builds [26]. Such features may change before release.
Every Mac on macOS 27 now includes a free, offline language model in the Terminal through an “fm” command, according to Alvaro Cintas, a computer science professor. It offers an OpenAI-compatible local endpoint and a 4,096-token limit per session [27].
PEOPLE
Anthony Morris, who created the desktop version of Claude Code, Anthropic’s AI coding tool, announced he has left Anthropic and will share his next step soon [28]. Thariq Shihipar, a lead engineer who helped scale Claude Code for more than a year, has also left, as Anthropic prepares for a public offering [29].
Posts speculated that SpaceXAI hired both; that remains unconfirmed [30].
SPACE AND DEVICES
According to an account that follows SpaceX, Elon Musk said on the SpaceX third-quarter call that the company’s Louisiana Starbase will ultimately have 20 launch pads, not 10 [31]. The account said the real limit is how many Starship launches the FAA approves each year.
Musk also predicted that phones will become “an edge node for AI inference,” with no operating system or apps, where AI on servers talks to AI on the device and generates real-time video of anything the user wants [32].
ASTROHACKER
Astrohacker’s chief executive wrote, “i have my own team of super intelligent agents. this is not a movie. this is reality” [33]. He judged OpenAI’s GPT-6 Astra the best model for code review, finding issues other models miss [34].
He also rejected Palo Alto Networks chief executive Nikesh Arora’s comparison of unguarded AI to “a nuclear bomb,” calling it a false analogy [35][36].
We’re living in it.
Sources: [1] https://x.com/semgrep/status/2113742669050511517 [2] https://x.com/AikidoSecurity/status/2113759110625906950 [3] https://x.com/TheHackersNews/status/2113951301059113271 [4] https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html [5] https://x.com/TheHackersNews/status/2113565218039333137 [6] https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html [7] https://x.com/BalaiBB/status/2113986368967950474 [8] https://internet.gmo/en/news/article/246 [9] https://ir.group.gmo/en/pdf/irlibrary/gmo_disclose_info20261024_e.pdf [10] https://x.com/log4j/status/2113781968601055366 [11] https://x.com/log4j/status/2113647464154857840 [12] https://x.com/VaibhavSisinty/status/2113938007015534630 [13] https://x.com/johnennis/status/2114029167679549705 [14] https://x.com/AstrohackerLabs/status/2113933361727111655 [15] https://x.com/esrtweet/status/2113954429883801742 [16] https://x.com/MTSlive/status/2113767252931870967 [17] https://www.anthropic.com/research/glasswing-initial-update?lang=en [18] https://x.com/a16z/status/2113741008550990191 [19] https://x.com/a16z/status/2114122274467102926 [20] https://x.com/dnapway/status/2113786285932638387 [21] https://x.com/jon_barron/status/2113707875290042665 [22] https://arxiv.org/abs/2610.31642 [23] https://x.com/MTSlive/status/2113781299861430560 [24] https://x.com/rohanpaul_ai/status/2113925990867145046 [25] https://x.com/JackEllis/status/2113690475018277261 [26] https://x.com/alexmichaelio/status/2114056103373758724 [27] https://x.com/dr_cintas/status/2113756925124882770 [28] https://x.com/amorriscode/status/2113972174524674247 [29] https://x.com/mark_k/status/2114026300734116220 [30] https://x.com/buildwithrajath/status/2114040906341110091 [31] https://x.com/LunarCitizens/status/2113631877643051139 [32] https://x.com/firesidealpha/status/2113826148190970058 [33] https://x.com/AstrohackerLabs/status/2113947680229523632 [34] https://x.com/AstrohackerLabs/status/2114034305047703662 [35] https://x.com/AstrohackerLabs/status/2114013975784706341 [36] https://x.com/dnapway/status/2113803038699966712