Pixel 🇨🇦

Solving problems you didn't know you had.
⬢ @InfinityBotList · @TryByteSend · @TryEmberly
⬢ Married to @CallMeAByte & @code
⬢ CEO @NodeByteLTD 🇬🇧

[Pixel 🇨🇦 @CodeMeAPixel]

And somehow this is how I spend most of my days 👀

[Omniplex @InfinityBotList]

Security update: Popplio 1.15.2 and Omniplex 1.8.1 fix four issues, including a webhook SSRF and a short-link open redirect.

https://t.co/pNTOn7xW6c is already patched, so there's nothing you need to do. Self-hosting? Please update.

Details 👇
https://t.co/4XlUYkLMeW

[The Hacker News @TheHackersNews]

🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.

Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.

Patch now → 22.23.4 / 24.22.1 / 26.12.1

Read ↓ https://t.co/OTuQFpL7HC

[Pixel 🇨🇦 @CodeMeAPixel]

I may or may not have just applied to help with the GPM community 👀 let’s see how this goes

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd Joining now thanks

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd I’m in the official discord if that’s the one you’re referring to?

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd kinda wondering what the plans are here now that development has ceased in FivePD v2 🤔

[Pixel 🇨🇦 @CodeMeAPixel]

@five_pd Glad to hear it 👏 wishing for the best moving forward.

[Pixel 🇨🇦 @CodeMeAPixel]

@connor200024 Yeah, did you miss the memo?

[Felipe Daragon @FelipeDaragon]

I think we've discovered another critical vulnerability:

CVE-2026-BURNOUT: AppSec Professional Exhaustion

Severity: Critical (CVSS 10.0)

Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.

Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.

Attack vector: Reading security advisories.

Affected versions: All AppSec professionals, regardless of experience.

Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥

[Pixel 🇨🇦 @CodeMeAPixel]

You can’t be serious, you’re the one that started this entire process and now you just sit back and act like staying in Canada was the plan all along…. Mad that you didn’t get what you wanted and the people told you to be a better government instead?

[Danielle Smith @ABDanielleSmith]

Thank you, Alberta!

I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.

Thank you to all Albertans who took time to vote on these critically important referendum questions.

Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.

[Danielle Smith @ABDanielleSmith]

Thank you, Alberta!

I’m very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.

Thank you to all Albertans who took time to vote on these critically important referendum questions.

Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.

[Pixel 🇨🇦 @CodeMeAPixel]

@ImLunaHey Have you ever looked into infisical? They have a CLI that can encrypt and store secrets outside of your env and inject them back into memory when needed

They also have a extremely generous free tier (and are open source if you prefer self hosting)

👉 https://t.co/Yi74HkdhSx

[Pixel 🇨🇦 @CodeMeAPixel]

Make sure you update Node too folks, PHP isn’t the only one having a bad week 🫡

[Dark Web Informer @DarkWebInformer]

🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497

Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:

• Node.js 22.x
• Node.js 24.x
• Node.js 26.x

Fixed:

• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.

Administrators should upgrade and restart affected services.

Source:
https://t.co/KZjGB05A1j

[Pixel 🇨🇦 @CodeMeAPixel]

Vercel putting in that work like always 💪

[Guillermo Rauch @rauchg]

Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.

All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.

[Pixel 🇨🇦 @CodeMeAPixel]

Did this man, really just say the forbidden words….. @connor200024 when I’m up all night tonight patching vulns I’m blaming you.

[Connor200024 @connor200024]

What else could go wrong? ;)

[Pixel 🇨🇦 @CodeMeAPixel]

I have patched the NodeJS version for @TryByteSend following the latest vulnerabilities 🫡

[Pixel 🇨🇦 @CodeMeAPixel]

@rizonftw_ @connor200024 Lmfao, valid reasons 🫡

[Socket @SocketSecurity]

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early:

“This disregarded weeks of work by many parties toward a coordinated disclosure.���

https://t.co/30TTrAH6K7

[Cloudflare Developers @CloudflareDev]

⚠️ Vulnerability alert: php2shell

Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes.

If your site’s web traffic is proxied through Cloudflare, we deployed protections before official public disclosure. Check the blog post to see which mitigations are enabled by default.

Even with these mitigations in place, update PHP as soon as possible to fix the underlying vulnerabilities.

https://t.co/3xLjlkUX8u

[Pixel 🇨🇦 @CodeMeAPixel]

Lmfao, and the findings continue. Now that the wave is started it probably ain’t gonna end anytime soon prepare to keep patching

[Nicolas Krassas @Dinosn]

Leaving this here, PHP 8.5.12 security patch is incomplete. ( needs further validation )