Python Imaging Library

It's Saturday, October 24th.

Shared library and edge device flaws, Brotli, Pillow, Pillow, PHP, Aruba AOs are the day's real exposure, inventory where they're embedded in patch or mitigate now, while attackers increasingly use AA agents to run intrusions.

Cybersecurity threats.

Brotli decoder flaw behind Node.js RCE also hits Bun, Python, and other software.

Apply it on internet-facing PHP hosts now.

This follows last week's emergency PHP patches and ongoing PHP 2 shell exploitation.

Critical Pillow flaw allows code execution via a crafted image.

Pillow, the most widely used Python imaging library, can be made to run OS commands on a server that processes a crafted image.

Go for it.

Pillow's basically acting like a nightclub bouncer, right?

Okay.

I like where this is going.

That is actually a shockingly accurate way to describe it.

But wait, let me push back on this.

Why does Pillow even need GhostScript to do this? Why is it outsourcing image processing just to open a file?

Well, it comes down to what an EPS file actually is.