openai accidentally found a bug that could compromise millions of servers and they weren’t even looking for it they were trying to stop their AI models from accessing the internet during training, built an entire offline world for them. while red-teaming that setup, they stumbled on a vulnerability in brotli, one of the most widely used compression libraries on the internet the flaw lets an attacker run their own code on any affected system by sending malicious compressed data. no login needed, no user account required. just send it and you’re in brotli is built into node.js, bun, envoy, and basically anything that handles compressed web traffic. the bug was technically fixed in february but nobody knew it was a security issue at the time so for months, the patch existed but almost nobody applied it because it looked like a routine update sometimes the scariest discoveries happen when you’re not even looking