Critical Brotli decoder flaw spreads from Node.js to curl, Envoy and Istio
A critical memory-safety bug in the Brotli decompression library (CVE-2026-111497, CVSS v4.0 9.2), first seen as "Node2Shell" in Node.js, now reaches far beyond it. Aikido's write-up, dubbed "HTTP2Shell", lists Google Brotli 1.0.3 through 1.2.0 and everything that bundles it: Node.js, the Python packages Brotli and brotlicffi, curl, Bun, Envoy and Istio. Any service that decodes Brotli-compressed HTTP responses is exposed. The fix is Brotli 1.2.1 (brotlicffi 1.2.1.0) or a patched vendor release; disabling Brotli decoding is the stopgap. For AI teams, the practical exposure is inference gateways, agent HTTP clients and proxies that sit on these libraries.
Sources & depth
Ollama 0.40.11 adds speech generation and the d3 decision-model family
Ollama can now generate speech on macOS: ollama run plays text or a chat model's reply aloud as the audio is produced, and apps can stream audio through an OpenAI-compatible /v1/audio/speech endpoint. The release also introduces d3, a family of decision models (2B, 4B, 9B and 27B) derived from vLLM Semantic Router's work, that take text, structured state or images and classify, answer yes/no questions or score options with probabilities. It moves Ollama from text-only local serving toward audio output and small routing models. Speech is macOS-only for now.
Sources & depth
Terence Tao's blog hosts a community effort to correct OpenAI's published math write-ups
A guest post on Terence Tao's blog introduces "oai-math-revised", a community repository for revising the math write-ups OpenAI published on GitHub, which the organizers say can be hard to follow and have incomplete citations. Students, postdocs, professors and enthusiasts are invited to review and administer it. It continues the thread of mathematicians scrutinizing AI-produced proofs rather than simply accepting them.
Sources & depth
Dream Labs launches Dream-1, a world-action model for robots it has never seen
Dream Labs' first release is pitched as a world-action model that zero-shot controls unfamiliar bimanual, parallel-gripper robots, claiming about 27 simulated and 4 real platforms without robot-specific training, at roughly $3 per hour through a public API. Per-robot fine-tuning is offered where out-of-the-box results fall short. The company calls it a research beta not validated for safety-critical use, and the claims are self-reported with no independent evaluation yet.
Sources & depth
Simon Willison adds a four-player map to Battledrones, built with Claude Opus 5.5
Willison's Battledrones game gained a four-player online map ("Compass Rose") with four-way rotational symmetry, AI fill-ins for empty slots and WebSocket multiplayer, with Claude Opus 5.5 doing the implementation from a single prompt. It is a small but concrete data point on single-prompt feature work with the current Claude coding model.
Sources & depth