Security researchers disabled a vulnerable Popcorn Time updater across millions of systems after identifying risks linked to unauthorized remote code execution.
A memory corruption flaw in Google Brotli decoder tracked as CVE 2026 111497 affects Node.js, Bun, Python packages and other software using Brotli compression.
A misconfiguration in AWS CodeBuild allowed potential takeover of GitHub repositories including aws-sdk-js-v3, exposing cloud environments to supply chain risks. AWS has since remediated the issue.