The Whistle: a Brotli patch wave, a 16-year-old UEFI hole, and Anthropic files to go public

Mon, 02 Nov 2026 08:00:00 -0500

One bug in a shared library owned the week. A buffer overflow in Google’s Brotli decoder was fixed in the library’s source in February, never released as an update, and spent the rest of the year bundled inside every runtime that links it. This October the catch-up finally ran: coordinated patches across Node.js, Python, Go and the proxy tier, and Microsoft shipped out-of-band .NET fixes on October 25. A 16-year-old UEFI vulnerability surfaced the other way, through a broken embargo. A campaign running on stolen GitHub tokens planted more than 13,500 secret-dumping workflows. Binance lost $6.3 billion to a compromised laptop in 20 minutes. Both sides of the exploit pipeline ran on models this week: Anthropic published a kernel root exploit written by Claude, Epoch AI pushed a Z.ai open-weight model through published-but-unshipped Firefox fixes at about $1,000 a target, AWS made machine-speed vulnerability remediation generally available, and Google gated its new cybersecurity model to defenders first. Security leads, then the rest.

Github on StackRef Whistle

The Whistle: a Brotli patch wave, a 16-year-old UEFI hole, and Anthropic files to go public