Bollcoin, October 24: OpenAI posted on X that during a recent red-team exercise it discovered a vulnerability in the widely used Brotli compression library that allows remote code execution without authentication, and that software including Node.js, Bun and Envoy all bundle the library. Attackers can take over unpatched servers by sending malicious compressed data, or take over clients that accept compressed data by using a malicious server. OpenAI said the root cause was fixed in the Brotli source code in February this year, but was not identified as a security vulnerability at the time, and all software that bundles the library needs to be updated accordingly. According to The Hacker News, the vulnerability is tracked as CVE-2026-111497, and Node.js released a fixed version on October 21.