Yep, Anthropic contributed zero, literally zero value.
All it did was to announce Mythos, said Mythos is going to hack everything, got 50 or so companies to pay millions for access. They helped zero security researchers. Their safety classifier trips when even reading a vulnerability report.
OpenAI on the other hand, rolled out sensible KYC, gave access to Daybreak Blue, and see what the community has done with GPT-5.6-Sol (daybreak version).
One creates all the fear-mongering and delivers zero value, and the other quietly just carries everyone forward.
๐ Node.js security updates are now available!
New releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.
Review the details and update your systems to stay secure.
๐ https://t.co/W4kfzx5lxz
#NodeJS#Security
Lots of Security incidents today, here's some practical tips for those who just wanna protect yourself:
1) UPDATE EVERYTHING - main targets are:
a) Browsers - Chrome, Safari, Firefox
b) OS: ๏ฃฟ: Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes
c) Phones: Update it all
d) Desktop apps (Slack, Cursor, Discord, etc)
2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week.
3) Avoid untrusted Wifi networks until your devices are updated
4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates
5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through.
6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc
What advice did I miss?
๐จ BREAKING: Node.js just dropped its OWN security bombshell.
4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.
โ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated HIGH severity.
โ REMOTE CODE EXECUTION: CVE-2026-111497 is a serious flaw in Node.js's Brotli decoder that could allow attackers to execute malicious code remotely.
โ TLS SECURITY BYPASS: Two separate vulnerabilities could trick affected applications into accepting certificates for the WRONG server under certain conditions.
โ Think about that. Your application could establish an encrypted connection while failing to properly verify WHO it's talking to.
โ THREE MAJOR NODE.JS VERSIONS AFFECTED: Node.js 22, 24 and 26 all required emergency security updates.
โ RUNNING NODE.JS 18 OR 20? Those versions are END-OF-LIFE and aren't receiving these official security patches.
โ PATCH IMMEDIATELY: Update to Node.js 22.23.4, 24.22.1 or 26.12.1, depending on your release line. If you're using Docker, rebuild and redeploy your containers.
PHP AND Node.js both facing major security disclosures on the SAME DAY.
If you run a website or application, TODAY is the day to check your servers.
And remember: the public release of security patches can give attackers a roadmap to systems that haven't updated.
Don't be the last one to patch.