Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Snyk removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
Added#1
Before: …Snyk's Privacy Policy and DPA? Updates View all nothing here Published ‹date› Overview On October 21, Google released…
After: …Snyk's Privacy Policy and DPA? Updates View all Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497) Published ‹date› Overview On October 21, Google released…
Added#2
Before: …Vulnerability (CVE-2026-111497) Published ‹date› Overview On October 21, nothing here remote code execution. If you run an affected…
After: …Vulnerability (CVE-2026-111497) Published ‹date› Overview On October 21, Google released Brotli 1.0.10, 1.1.1, and 1.2.1 to fix a critical out-of-bounds write in its Brotli C decoder ( CVE-2026-111497 Opens in new tab , CVSS 9.2) that can lead to remote code execution. If you run an affected…
Added#3
Before: …lead to remote code execution. If you run nothing here If you only use Snyk Open Source scanning,…
After: …lead to remote code execution. If you run an affected component, you should immediately update to the vendor’s fixed release, for example Node.js 26.12.1, 24.22.1 or 22.23.4, or .NET 8.0.33, 9.0.22 or 10.0.14, then restart or redeploy. Node.js 25 and older lines are end-of-life and receive no fix. Many runtimes, language packages, Linux distributions and products bundle their own copy of the decoder, and each needs its own update. If you only use Snyk Open Source scanning,…
Added#4
Before: …Snyk Open Source scanning, you will not see nothing here in your results. That doesn’t mean you are…
After: …Snyk Open Source scanning, you will not see runtimes such as Node.js in your results. That doesn’t mean you are…
Added#5
Before: …you Snyk Open Source (CLI and SCM integration) nothing here through Unmanaged scanning (snyk test --unmanaged) and, for…
After: …you Snyk Open Source (CLI and SCM integration) reports dedicated advisories for packages that bundle the decoder, such as Brotli and brotlicffi on PyPI, the Ruby brotli gem, kjdev/brotli on Composer, and .NET runtime packs on NuGet. It does not report runtimes because they are not declared dependencies. Snyk reports runtimes and vendored copies of the Brotli C source through Unmanaged scanning (snyk test --unmanaged) and, for…
Added#6
Before: …as each distribution publishes its advisory. Snyk advisories: nothing here Opens in new tab . What you should…
After: …as each distribution publishes its advisory. Snyk advisories: all advisories for CVE-2026-111497 Opens in new tab . What you should…
Added#7
Before: …for CVE-2026-111497 Opens in new tab . What nothing here What we are doing Advisories published and updated:…
After: …for CVE-2026-111497 Opens in new tab . What you should do Use Snyk Open Source, Unmanaged scanning and Snyk Container together to find every copy of the decoder, update each one, then restart processes and rebuild container images. What we are doing Advisories published and updated:…
Added#8
Before: …Advisories published and updated: we published advisories for nothing here If you have questions, please contact your Snyk…
After: …Advisories published and updated: we published advisories for the Node.js runtime and the Brotli C library on October 22, the day the CVE was published, and we publish dedicated advisories as we confirm other packages that bundle the decoder. More coverage on the way: we add Linux distribution advisories to Snyk Container as each distribution reports them. If you have questions, please contact your Snyk…
Added#9
Before: …team or Support. Read more Read more about nothing here General Zero-Day Incident - PHP Remote Code Execution…
After: …team or Support. Read more Read more about Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497) General Zero-Day Incident - PHP Remote Code Execution…
Removed#10
Before: …Incident - Keyv / Cacheable - Update #1 General Closing Update - Third-Party Vendor Security Incident — Klue Published ‹date› Status: Investigation Complete — ‹date› Snyk's forensic investigation into the June 2026 Klue/Salesforce incident is now complete. The investigation confirmed no impact beyond what was disclosed in our June 22 communications: business CRM data only (contact information, account details, sales and contract records, and support case titles and descriptions). Case comments, attachments, and the Snyk platform were not affected. All impacted customers were notified directly and the data involved is consistent with what was disclosed in our June 22 blog post Opens in new tab . Documentation available…
After: …Incident - Keyv / Cacheable - Update #1 removed post Opens in new tab . Documentation available…
Removed#11
Before: …22 blog post Opens in new tab . Documentation available upon request: Mandiant Security Memo Customer-specific data export Questions: support@snyk.io Read more Read more about Closing Update - Third-Party Vendor Security Incident — Klue Opens in new tab Subscribe to updates The…
After: …22 blog post Opens in new tab . removed Opens in new tab Subscribe to updates The…
Compared with the previous archived version (#5414 to #10516). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Snyk’s Trust page now says it is assessing potential impact to its environments and will prioritize remediation of any findings if necessary. The statement does not confirm whether Snyk is affected, so customer exposure remains unconfirmed in this update.
Thursday, October 29
1 page change
Content changed
Page change
Trust pagechangedthis change
Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed.
Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution.