Three stories from recent days that affect you if you use AI or build software. A vulnerability in Node.js, found by OpenAI Codex Security, calls for an update. OpenAI competes hard on price with Anthropic. And the Polish NASK is testing models with OpenAI.
Node2Shell: update Node.js
On 21 October, Node.js released a security update for CVE-2026-111497, now known as Node2Shell. It concerns a flaw in the Brotli decoder built into Node.js: with a single malicious compressed message, an attacker can corrupt your server's memory, read data or execute code. No login is required. The 22.x, 24.x and 26.x lines are affected; the safe versions are 22.23.4, 24.22.1 and 26.12.1. Found by Khai Tran and Sylvie Mayer of OpenAI Codex Security.
The flaw lies in the Brotli library itself, so Node.js is not the only vulnerable product. According to The Hacker News and pwn.watch, Bun (before 1.4.4), the Python packages Brotli and brotlicffi, and Envoy with Brotli decompression are also affected.
What does this mean for you? If you run a webshop, customer portal or API on Node.js, ask your developer or hosting provider whether the update is already in place. It is the second serious flaw in a short time found with the help of AI, following PHP2Shell. You can find tools for software development such as SonarQube and GitHub Copilot in our list.
OpenAI gives Replit more than 30% discount
According to The Information, summarised on Techmeme, the programming platform Replit has moved most of its AI spending from Anthropic to OpenAI. OpenAI gave more than 30% off in a deal worth just over $100 million per year, after Anthropic would not extend its earlier discount. According to AI Weekly, OpenAI is now the default model in Replit Agent; you can still choose Claude yourself.
What does this mean for you? If your business uses a lot of tokens, it pays to negotiate: the large providers use discounts to win over customers. Do note that a tool you use may switch its underlying model without you noticing. That changes where your data goes. Compare the two on ChatGPT vs Claude, and check the GDPR check for ChatGPT in software development and the one for Claude.
NASK becomes OpenAI's testing partner
OpenAI and the Polish research institute NASK, which includes CERT Polska, signed an AI safety partnership on 23 October. They will test advanced models, look for weaknesses and work on recognising AI-generated content. In a trial in July, CERT Polska used OpenAI models to find six vulnerabilities in MikroTik router software, reports The Next Web. NASK is therefore OpenAI's third national testing partner, after the American and British institutes.
What does this mean for you? More independent European testing of the major models is coming. If you work in the public sector, such reports are useful alongside your own assessment, as with the GDPR check for ChatGPT in the public sector.
In brief
- Running Node.js, Bun or Python with Brotli? Install the update.
- OpenAI is offering steep discounts to win customers away from Anthropic.
- NASK, as a European institute, will test OpenAI's models.
All models and their privacy scores side by side: /modellen/ and /veiligheid/.
