In partnership with
The Second Hole AI Found This Week
Thursday, I told you AI found a hole in PHP, the language under 70% of websites.
Over the weekend it found the second one.
Here’s what happened.
Node2Shell is a 9.2-rated flaw in Brotli, Google’s compression library that shrinks web traffic.
Brotli ships inside Node.js, Bun, Envoy and a stack of Python packages.
Translation: if your app, store or SaaS runs on Node, this one is yours.
A crafted compressed file lets an attacker run code on your server.
No login required.
OpenAI’s security agents found it.
Two researchers on OpenAI’s Codex Security team, Khai Tran and Sylvie Mayer, reported it.
It was a by-product of the red-teaming OpenAI ran after pausing frontier training in September.
Here’s the part that should make you angry.
Google fixed the bug in its own code on February 27.
The commit had no security label, no advisory and no release.
So, for eight months every build of Node.js kept shipping the broken version. 🙄
Think about that.
The fix existed the whole time.
It took an AI red team to notice anyone needed it.
By Thursday a researcher at Imperva had demonstrated full code execution against a stock Node.js 24 image.
Nobody has reported attacks in the wild yet.
Last week nobody had reported PHP2Shell attacks either.
Then they did.
Call it Black October.
Two severe flaws in two foundational pieces of the web, both found by AI, in one week. 🤯
What to do, in five minutes:
Ask your developer or host which Node.js version you’re on.
The fixed versions are 22.23.4, 24.22.1 and 26.12.1, or Bun 1.4.4.
Node.js 20 and older get no patch, only an upgrade.
Python, Envoy and Istio carry the same library, so ask the same question there.
If you got your PHP patched on Thursday, congratulations.
You’re now ahead of most of the internet twice. 😅
Now the obvious move.
Every local business you know is running a WordPress site or a Node app.
None of them read this newsletter.
Offer to check it for them.
I put together a free kit with 8 beginner-friendly AI automation services you can sell to local businesses.
It comes with a worksheet to package one at a fixed $1,000 and a script to pitch it.
The rest of the vault lives at thetip.ai/products.
All of it free.
Did You Know?
Brotli is named after “Brötli,” a small Swiss bread roll.
Google’s other compression library, Zopfli, is named after Zopf, a Swiss braided loaf.
So, a decent chunk of the world’s web traffic is held together by Swiss baked goods. 😂
Why Overseas Producers Can't Undercut Atlas Salt, Even for Free
Cities are already running short on road salt, and winter hasn't even started. Some supply bids are going unanswered, prices have nearly doubled in parts of the market, and the backup plan is two weeks away by boat. Here's why Atlas Salt (TSXV: SALT | OTCQX: SALQF) can get salt to the people who need it most, faster and cheaper than anyone shipping from overseas:
• Three days by ship to Boston, not fourteen
• Shallow deposit that's cheaper and faster to mine
• Projected C$188M a year in free cash flow
• Export Development Canada interested in lending C$150M
• Early supply deal with top U.S. salt distributor
🗞️ The Tip AI News 🗞️
In July Elon Musk promised Grok would make a full-length AI “Odyssey” by the end of 2026.
TechCrunch reports the first seven minutes dropped on Saturday.
Nobody else has reviewed them yet.
Let me explain how we got here.
Christopher Nolan’s “The Odyssey” opened in July to a record $264 million weekend.
Musk spent the weeks before launch attacking the casting.
Then an X user posted a three-minute Grok Imagine clip of Odysseus on a beach.
Musk replied that Grok would make the whole film, “historically accurate and true to the art of Homer,” before the year ended.
The poem has a cyclops and a witch who turns sailors into pigs.
Historical accuracy was always going to be a stretch. 😏
Now seven minutes exist.
TechCrunch’s one-line verdict: fine, as long as you weren’t hoping for artistry.
Here’s why these matters beyond the Musk-Nolan feud.
Grok Imagine had no video capability in July 2025.
By January it was generating 1.2 billion videos a month.
A feature-length film is a different problem for a clip.
The hard part is keeping the same face, ship and sea consistent for 90 minutes.
Seven minutes is the first public test of whether that problem is solved.
Speaking of promises with deadlines...
The year ends in 66 days.
😂Meme of the Day
Over to You...
Send your developer one message today: “What Node version are we on, and is it patched for Node2Shell?”
If the reply is a question mark, you’ve found your Monday. 🔥
Founder, AI Persona Method | TheTip.ai
Get paid to solve problems like this → AI Certified Consultant
PS. Thursday is October 30, the day Meta’s new business terms switch on. Three days to decide whether your website stays linked to your Facebook page. After that, Meta decides.
» Join the AI Money Group «
💰 AI Money Blueprint: Your First $1K with AI - Learn the 7 proven ways to make money with AI right now
🚀 Zero to Product Masterclass - Watch us build a sellable AI product LIVE, then do it yourself
📞 Monthly Group Calls - Live training, Q&A, and strategy sessions with Jeff
Sent to: {{ email }}
Jeff J Hunter, 3220 W Monte Vista Ave #105, Turlock,
CA 95380, United States
Don't want future emails?
