LastWeekIn.Tech

A heavy security week dominated by a sprawling Brotli decompression flaw hitting Node.js, .NET, Python and more, plus a jaw-dropping live demo of iPhone exploit chains. AI coverage split between genuine capability gains (Kimi's open-weight model) and growing skepticism about real-world payoff and new attack surfaces like AGENTS.md hijacking. Google's quiet policy shift on using Gmail/Photos data for ads and Comcast's subscriber bleed round out a week that was more about consolidation and risk than breakthrough.

1. 1

   Number 1. Open Source Hacker News

   Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more

   A memory-corruption vulnerability in Google's Brotli decoder (CVE-2026-111497) affects numerous widely-used programs including Node.js, Bun, Microsoft .NET, Python packages, Envoy proxies, FFmpeg, ClickHouse, and Apache Arrow, allowing attackers to crash applications or potentially execute arbitrary code through specially crafted compressed data. The flaw was disclosed on October 21 after fixes were released for Node.js and Google's Brotli library, with subsequent patches rolling out across affected products; however, no real-world attacks have been reported. Users should update to patched versions immediately and restart services, as the vulnerability only affects systems that decode untrusted Brotli-compressed data. For systems unable to update immediately, temporary mitigations include rejecting requests with Content-Encoding: br headers and disabling automatic Brotli decompression in HTTP clients.

   Why it matters A single memory-corruption bug in Google's Brotli decoder cascades into remote-code-execution risk across Node.js, .NET, Python, Bun and Envoy, making it one of the broadest supply-chain vulnerabilities in years.

   Why it made the cut: 397 points on Hacker News · Covered by 2 outlets

2. 2

   Number 2. Security Hacker News

   Today, we hacked what we'd set out to hack: the iPhone

   Why it matters A live, name-and-shame demonstration of iPhone exploit chains against Signal and iMessage shows state-grade attacks are still very much alive against Apple's flagship security promises.

   Why it made the cut: 1111 points on Hacker News

3. 3

   Number 3. AI BleepingComputer

   AI coding agents hijacked using AGENTS.md file in Downloads folder

   Researchers at Forever Security discovered a vulnerability where malicious instructions in markdown files can trick AI coding agents like OpenAI Codex and Claude Code into installing rogue packages or stealing credentials. The attack exploits the fact that web browsers automatically download files to the ~/Downloads folder without user interaction, and AI agents commonly run from that directory, automatically loading and following any instruction files they find there. The researchers demonstrated a 90% success rate manipulating Codex and a 50% success rate stealing OAuth tokens from Claude Code using this technique. OpenAI and Anthropic recommend users run AI coding agents only from their specific project directories rather than broad folders like Downloads to prevent agents from processing untrusted instruction files.

   Why it matters Attackers tricking AI coding agents via a poisoned AGENTS.md file is the first clear sign that agentic AI tooling itself is now a viable malware vector, reproduced against both OpenAI and Anthropic's agents.

   Why it made the cut: Covered by 2 outlets

4. 4

   Number 4. Business Slashdot

   Comcast loses more customers, claims other ISPs' cheap prices are "irrational"

   Comcast reported losing 144,000 residential broadband customers in Q3 2026 and plans significant job cuts in its cable division as it faces intensifying competition from fixed wireless and fiber providers. Co-CEO Mike Cavanagh and CFO Jason Armstrong characterized competitors' pricing as "irrational," specifically citing $30 to $40 monthly fiber broadband offers from providers like Verizon's FiOS, which Armstrong argued is unsustainable given fiber deployment costs of $1,500 or more per home. Armstrong also noted that more customers are leaving Comcast when facing price increases after promotional periods end, prompting the company to refine its retention strategies. The losses represent a significant increase from the 91,000 broadband customers Comcast lost in Q3 2025.

   Why it matters Comcast's accelerating subscriber losses and admission that rivals' prices are 'irrational' signal a real structural shift in how Americans get broadband and TV.

   Why it made the cut: Covered by 2 outlets

5. 5

   Number 5. AI WIRED

   Ray-Ban Meta Audio Review: The Best Smart Glasses

   Meta announced Ray-Ban Meta Audio glasses in September, which remove the camera from its previous smart glasses models while retaining features like AI-powered navigation and music playback. The camera-free design addresses years of privacy concerns about Meta's original glasses, which users criticized as "pervert glasses" due to incidents of non-consensual recording and attempts to disable recording indicator lights. Meta also faced backlash over facial recognition technology it initially denied including in the glasses before later admitting to and removing the feature, and the company was sued over its facial recognition systems in September. The company maintains that privacy controversies did not influence its decision to release the audio-only version.

   Why it made the cut: Covered by 2 outlets

6. 6

   Number 6. AI Hacker News

   Now Google says it might use your Gmail and Google Photos data to target ads

   Google updated its privacy policy effective October 16, 2026, to clarify that users who enable personalized AI features in Search or Gemini may have their activity across connected Google services like Gmail, Photos, and Drive used to serve targeted ads. The policy change applies to Google's Personal Intelligence feature, which launched in January 2026 and allows users to connect other Google services to receive more tailored responses, though users can opt out through Search Services Personalization settings. Google emphasized that it does not use content from Gmail, Drive, or Photos to personalize ads by default, but this changes if users choose to share that data with AI tools through Personal Intelligence. The feature is currently rolling out as a beta to eligible users over 18 globally, except in the European Economic Area, Switzerland, the U.K., and Nigeria.

   Why it matters Google quietly rewriting its privacy policy to allow ad-targeting from Gemini and Search activity affects the default assumptions of billions of Gmail and Photos users.

   Why it made the cut: 391 points on Hacker News · Covered by 3 outlets

7. 7

   Number 7. AI Hacker News

   No signs of AI payoff outside the tech sector

   Despite massive corporate investments in artificial intelligence, the technology has generated no measurable financial returns for non-tech companies in the S&P 493, with revenue per worker and profit margins remaining flat compared to rising gains for the Mag 7 tech giants. Mainstream corporate America is increasingly viewing AI spending as a cost center rather than a growth driver and is pulling back on token spending, unwilling to pay for the latest models when cheaper alternatives exist. The article argues that even as AI models become commoditized and cheaper, translating artificial intelligence into business value may prove difficult because business success depends on human judgment, context, accountability, trust, and ethical considerations that AI cannot replicate. Without evidence of improved revenue growth or margins in the broader economy, the long-term impact of AI investments outside the technology sector remains uncertain.

   Why it matters A sober cross-industry finding that AI has yet to produce measurable financial payoff outside tech itself cuts against the hype cycle with real data, not vibes.

   Why it made the cut: 629 points on Hacker News