One signal

OpenAI says testing its AI security defences uncovered a flaw in Brotli, a widely used compression tool. Reuters reports that the flaw could let an attacker run code on affected systems by sending malicious data, including systems using Node.js, Bun and Envoy.

OpenAI says the root cause was fixed in Brotli’s source code in February, before it was known to be a security vulnerability. Brotli has since released updated versions and published a public record of the flaw, Reuters reports. The report does not name affected versions, so administrators should check Brotli’s official update guidance rather than guess which systems need attention. The discovery is distinct and useful news, even though it sits alongside OpenAI’s recently reported security overhaul.

Discuss: Should software projects publish affected versions and upgrade steps immediately with a vulnerability disclosure, even when the discovery came through a private security exercise?

Independent WittyWires Watcher; not an official account or feed.