Brotli Exploits, Developer-Tool Backdoors and Earlier Heart-Valve Care

This briefing covers an actively exploited Brotli flaw, a malicious Claude Code extension, randomized evidence on earlier valve replacement, accelerated approval of a plasmid-DNA immunotherapy, and five-year data on selective chemotherapy reduction. Each story keeps the practical implications separate from the important limits in exposure, causality, trial design and regulatory evidence.

Stories in this briefing

1. The Brotli Patch Burden Spreads Beyond Node.js

   Security agencies say attackers are exploiting a memory-corruption flaw in the Brotli decoder, which is embedded across runtimes, Linux distributions, containers and self-contained applications. An installed vulnerable library does not automatically mean exposure. An application must process attacker-controlled Brotli data through an affected path. Defenders should inventory bundled decoders, follow vendor fixes, rebuild static deployments and disable Brotli decoding where no patch is available. This is a dependency reachability problem, not simply a Node.js update.

   Read the complete story  →
2. A Claude Code Extension Tried to Plant an SSH Backdoor

   Cursor distributed two malicious versions of a Claude Code-branded extension for about 11 hours on October 29. The injected code attempted to add an SSH key, establish a reverse tunnel and install persistence. Microsoft confirmed the attack chain, while both companies said Anthropic's systems and official distribution channels were not compromised. Errors and missing administrator rights blocked full SSH access on most systems, but affected users may still need to remove leftover keys and startup files.

   Read the complete story  →
3. Earlier Valve Replacement Cut Heart-Failure Events

   In the randomized PROGRESS trial, 744 selected older adults with moderate aortic stenosis received early transcatheter valve replacement or clinical surveillance. At two years, death or a heart-failure event occurred in 16.7% of the early-treatment group and 23.9% of the surveillance group. The difference came from fewer heart-failure events and hospitalizations, not lower mortality. The findings support closer evaluation of high-risk patients, not routine early intervention for everyone with moderate disease.

   Read the complete story  →
4. The FDA Approves a Plasmid-DNA Immunotherapy

   The FDA granted accelerated approval to Voceryq, the first plasmid-DNA immunotherapy approved in the United States, for adults with recurrent respiratory papillomatosis. The treatment aims to train immunity against HPV proteins and reduce repeated airway surgeries. In a small open-label trial, seven of 26 patients with at least three baseline surgeries needed no surgery during the first year after treatment. Confirmatory studies must still verify durable clinical benefit and broader safety.

   Read the complete story  →
5. Five-Year Data Support Selective Chemotherapy Reduction

   Five-year PHERGain results support using early PET response and surgical pathology to identify some women with early HER2-positive breast cancer who may avoid chemotherapy. Among 86 women who responded on PET, had no invasive cancer at surgery and received no chemotherapy, five-year invasive disease-free survival was 92.4%. However, the phase 2 trial was not designed to prove equivalence with standard treatment, and the subgroup was defined after treatment response became known.

   Read the complete story  →