A 12-Year-Old Security Flaw Was Just the Beginning | Threat Wire

A 12-Year-Old Security Flaw Was Just the Beginning | Threat Wire

MediaVideo
Yanac

How did a 12-year-old critical security vulnerability go undetected for so long—and why are flaws in GitLab, Node.js, and widely used software libraries putting so many systems at risk? In this episode of Hak5 Threat Wire, Ali Diamond breaks down a CVSS 10.0 GitLab vulnerability, a dangerous Brotli security flaw, a certificate authority shutdown, and a massive 10-terabyte data breach at PingCAP. Plus, discover how the Railway breach and a compromised LiteLLM Python package put developer credentials, API keys, and sensitive data at risk.

Part One

⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️

@endingwithali →
Twitch: https://twitch.tv/endingwithali
Twitter: https://twitter.com/endingwithali
YouTube: https://youtube.com/@endingwithali
Everywhere else: https://links.ali.dev

Want to work with Ali? hak5@endingwithali.com

[❗] Join the Patreon→ https://patreon.com/threatwire
Links
eMudhra
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
https://x.com/snakeyesV1/status/2112720612313407762y
https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
https://www.reuters.com/legal/litigation/indian-firm-emudhra-exits-global-digital-certificates-business-after-2026-10-22/
Java
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
https://openjdk.org/groups/vulnerability/advisories/2026-10-21
https://socprime.com/blog/cve-2026-91403-analysis/
https://x.com/jordy_4sd/status/2113068484959588719
GitLab and Ruby
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
https://x.com/k0kubun/status/2113492557045129589
https://x.com/jaydrogers/status/2113587369958048123
Railway
https://blog.railway.com/p/preliminary-report-october-security-incident
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
TiDB Leak
https://www.pingcap.com/trust-hub/security/ceo-note-october-2026/
https://nebusec.ai/research/pingcap-security-incident/
https://fulcrumsec.vg/pingcap/
NodeJS CVES
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
https://x.com/itsMikeKipruto/status/2112846839720341572
Brotli
https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/
—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆—–☆
Our Site → https://www.hak5.org
Shop → http://hakshop.myshopify.com/
Community → https://www.hak5.org/community
Subscribe → https://www.youtube.com/user/Hak5Darren?sub_confirmation=1
Support → https://www.patreon.com/threatwire
Contact Us → http://www.twitter.com/hak5
____________________________________________

Founded in 2005, Hak5’s mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong.Hak5Read More