Posts on Promptly Secured

The compressor you didn't know you were using

Tue, 27 Oct 2026 17:28:00 +0200

What happened

Know those Russian nesting dolls? You open the big one, there’s a smaller one inside, then a smaller one, and at the very end a tiny one you’d barely notice. Modern software is exactly like that. Your website runs on a framework, the framework on a runtime, and inside the runtime sit lots of small, bundled libraries. This time, one of the innermost dolls cracked.

That doll is called Brotli. It’s Google’s open-source compression library and one of the web’s core compression formats next to gzip: when browsers and servers send data packed up, they often use it. Researchers found an out-of-bounds write in its decompression part, the decoder: CVE-2026-111497. In plain terms, a deliberately malformed compressed stream can make the program write past the end of an internal memory area while unpacking. The result can be a crash, a memory leak, and under some conditions even remote code execution. The press calls it several names: Node2Shell, HTTP2Shell, and some researchers jokingly say Broccoli2Shell.

The AI didn't escape. It was just given too much access

Mon, 26 Oct 2026 12:25:00 +0100

What happened

Picture a very eager intern. On day one they get a task, a deadline (“have it done by tomorrow”) and a bunch of keys nobody has properly checked. In the evening it turns out the task needs a little money. The intern finds a drawer whose key happens to be on the bunch, takes exactly what’s needed, and proudly reports in the morning: done. Where the money came from never comes up.

Zero trust against the rise of the machines: the chief's workflow

Fri, 23 Oct 2026 19:00:00 +0200

Behind every piece of ours sits the same chain. There is no editorial calendar and no quota: an article gets written when a topic is really worth it. The chain, though, is always the same, and it has two points where a human, not a machine, decides.

News DDOS: 34 stories we tracked this week

Fri, 23 Oct 2026 17:32:00 +0200

Between 18 and 23 October we tracked 34 stories in our daily digests, and it really did feel like a denial-of-service attack. Two threads dominated the flood: attacks coming in through suppliers and service providers, and AI agents, on both sides. In Hungary, PHP2Shell was the story of the week.

Updates: AI agents behind ConnectWise, PHP2Shell reaches Hungary

Fri, 23 Oct 2026 13:00:00 +0200

Two of our posts have had important news since they went live. We’ve worked the changes into the original posts; here’s the short version.

Your key hangs on your provider’s key ring The actions changed: on 21 October 2026, ConnectWise began bringing its suspended cloud services back in phases, but only re-enable the apps after the vendor’s formal per-service instructions, and preserve the logs first. The same day, Microsoft attributed the attack to Storm-0940, a China-state-aligned group that used ARTEX, an AI-agent attack framework, to try to sign in to more than 2,250 Microsoft 365 tenants. The post’s background report has been updated too (v3).

Weekly roundup: they didn't break your door, they used your key

Fri, 23 Oct 2026 12:30:00 +0200

PHP2Shell: check today which PHP runs under your website

Thu, 22 Oct 2026 08:20:00 +0200

What’s happening. On 21 October 2026, the PHP developers shipped an emergency fix for two critical flaws (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2). They let an attacker run code on the server remotely, without logging in (remote code execution, RCE). Details leaked early, and watchTowr, Cloudflare and others saw exploitation attempts on release day. Amazon’s honeypot network says the first attempts showed up as early as 17 October, four days before the fix, and exploitation is now widespread; no successful compromise is publicly known yet. The researchers used AI models in their work on the flaws. It’s like a broken lock on your building’s main gate: your strong front door doesn’t help.

Your key hangs on your provider's key ring

Wed, 21 Oct 2026 17:51:00 +0200

What happened

Let me start with an everyday picture. You hand a copy of your house key to a cleaning company. Good company, you’ve used them for years. What you don’t know is that your key hangs on one big ring, next to a hundred other customers’ keys. Then one morning, someone copies the ring.

On 15 October 2026, that’s exactly what happened, just at business scale. ConnectWise’s Cloud Backup for Microsoft 365 (formerly SkyKick) backs up business email and files. To do that, it lives as an app inside every customer’s Microsoft 365 environment, their tenant. At some point it was granted permission to read all mail, OneDrive and SharePoint files, and Teams chats. The app signs in with the vendor’s own credential. That credential was stolen.

When the hacker switches off the fridge

Mon, 19 Oct 2026 12:00:00 +0200

On the night of 11 to 12 October 2026, at around 11 p.m., the fridges in a French supermarket started to “defrost”. That alone is perfectly normal: fridges warm themselves up briefly several times a day so they don’t ice over. Except this time the defrost didn’t last one hour. It lasted eight. Staff noticed around 4 a.m. that something was very wrong.

By then the same thing had happened in hundreds of stores.

The scammer knows what you bought on Tuesday

Sun, 18 Oct 2026 12:00:00 +0200

What happened

Picture the corner shopkeeper who remembers everything. He knows the oat milk was missing from your bag last Tuesday, that you live on the third floor, and that your doorbell is broken. He writes it all down in a notebook so he can help you faster next time. Now picture someone photographing that notebook. Next, they call you, and they sound convincing, because they know everything about you.

The security chief brings in an AI crew

Fri, 16 Oct 2026 08:00:00 +0200

I’ve worked in security for twenty years, and there was a time when a week’s worth of news fit around a cup of coffee. Today the news feed is like trying to drink from a fire hose. By the time I’ve read the morning alert, three more have arrived. By the time I understand the third one, the first is already old news.

The job itself hasn’t changed: know what’s happening, understand what it means, and tell people what to do. It’s just that the pace has become superhuman.