A bug named after broccoli just hit Node.js and Python...

Broccoli2Shell is a critical out-of-bounds write in Google's Brotli C decoder affecting Node.js, optional Python Brotli packages and other software using vulnerable copies of that decoder. The fix sat in the source for months before release. Plus a rooted Samsung TV that classifies what it hears, Kimi K3.1 Pro's cyber diet, Apollo's no-AI-payoff note, Google's Android developer lockdown and the Goose systems language. This episode covers the tech news from Friday, October 23 to Monday, October 26, 2026. Chapters 0:00 Intro 0:50 Broccoli2Shell: Brotli decoder RCE 5:02 Kimi K3.1 Pro and its cyber diet 6:34 Root shell on a Samsung TV 7:49 Apollo: no AI payoff outside tech 9:11 Keep Android Open: developer verification lockdown 11:07 Goose: a systems language with no heap 12:30 Lightning round 14:18 Outro Sources broccoli2shell.com: Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more https://broccoli2shell.com/ X: Root shell on Samsung TV https://twitter.com/log4j/status/2113... apollo.com: No signs of AI payoff outside the tech sector https://www.apollo.com/wealth/insight... keepandroidopen.org: Your Phone Is About to Stop Being Yours: 70 Days Until Lockdown https://keepandroidopen.org/? kimi.ai: Kimi K3.1 Pro and K3.1 Pro Highspeed https://www.kimi.ai/blog/kimi-k3-1-pro aardappel.github.io: The Goose Programming Language https://aardappel.github.io/goose/ blog.calif.io: Today, we hacked what we'd set out to hack: the iPhone https://blog.calif.io/p/iphone The Verge: Now Google says it might use your Gmail and Google Photos data to target ads https://www.theverge.com/tech/1017600... Apple: Apple Music 404 Not Found   / this-url-doesnt-exist   nypost.com: Google illegally cut down 250K trees in Finland for data center https://nypost.com/2026/10/24/busines... edjefferson.com: Local Wikipedia: Wikipedia, but only for things a half hour walk from you https://edjefferson.com/localwiki/ Image credits (cropped and captioned for this video) CC BY-SA 4.0: Pauloleong2002, Dancingpolishcow, পাপৰি বৰা, Ion D-worth, Alvesgaspar, GunnarBonk, Acabashi, www.immaterieelerfgoed.nl, Dietmar Rabich, Trougnouf (Benoit Brummer), Kristof Zerbe, Aaaatu CC BY 2.0: Alex E. Proimos, Ben Watts, Steve Jurvetson, Yolanda, Philips Communications, Doug Bowman, Bob Haarmans, Andrew Magill, goosmurf, Blogtrepreneur, SparkFun Electronics, Blake Patterson CC BY-SA 3.0: Thaddeusw, ProjectManhattan, Audrius Meskauskas ( Audriusa ) CC BY 3.0: Brady Holt, Wikimedia Commons CC BY-SA 2.0: Trevor Littlewood, Can Pac Swire Public domain or CC0: Humphrey Muleba, Grant Wood, Barney Elliot, Caspar David Friedrich, Derrick Coetzee, Cassius Marcellus Coolidge, jaydeep_, Pmwiki1, Evan-Amos, Wilfred Iven, Alan C King, Océanos y dados, Rawpixel, Edvard Munch, Katsushika Hokusai, Rc1959, Forest Service - Northern Region, Wikimedia Commons, M Tullottes Titles and links for every image are in the pinned comment. About Hot Diff is a tech news roundup, every Monday, Wednesday and Friday. It's mostly automated: the narration, music, some illustrations, a few short clips and the thumbnail background are AI-generated (Google Gemini and Lyria); photos and artworks are real, freely licensed and credited. Facts come from the linked sources and are checked against them before publishing. Memes and satire are labeled as such. Subscribe to Hot Diff:    / @hotdiff   #Broccoli2shell #Brotli #HotDiff