Eine 25-jährige Bergsteigerin ist am 31. Oktober 2026 am Tierberg bei Engelberg auf vereistem Gelände gestürzt und rund 150 Meter abgerutscht. Sie erlitt lebensbedrohliche Verletzungen. Die Rega brachte sie mit einem Rettungshubschrauber ins Spital.

Recently, the world’s highest Rolex boutique has opened in the new Titlis Tower above Engelberg. At 3,020 meters, it offers far more than luxury watches and is part of a larger development through which Rolex is increasingly taking control of global distribution. 

Seit kurzem ist die weltweit höchstgelegene Rolex-Boutique im neuen Titlis-Tower oberhalb von Engelberg offen. Auf 3'020 Metern bietet sie viel mehr als Luxusuhren und ist Teil einer grösseren Entwicklung, mit der Rolex zunehmend die Kontrolle über den weltweiten Vertrieb übernimmt. finews war dort.

Michelle Gisin hat am Dienstag ihren Abschied vom alpinen Rennsport mit sofortiger Wirkung verkündet. „Es war eine unglaubliche Reise, die heute endet. Ich habe alles erlebt, danke für die wundervollen Momente mit euch“, teilte die Schweizerin in ihrer Heimat Engelberg mit. Von ihren schweren Verletzung im Dezember 2025 hatte sie sich nicht mehr erholt.

Kierowcy jadący autostradą A81 w okolicach Stuttgartu muszą się pod koniec jesiennych ferii liczyć z utrudnieniami. Jak podaje regionalny nadawca publiczny SWR, tunel Engelberg koło Leonbergu w powiecie Böblingen w Badenii-Wirtembergii będzie w tym tygodniu zamykany trzy razy, po raz pierwszy w środę 28 października wieczorem. Automobilklub ADAC spodziewa się poważnych korków zwłaszcza w niedzielę 1 listopada przed południem, gdy w Badenii-Wirtembergii kończą się ferie jesienne.

Kierowcy jadący autostradą A81 w okolicach Stuttgartu muszą się pod koniec jesiennych ferii liczyć z utrudnieniami. Jak podaje regionalny nadawca publiczny SWR, tunel Engelberg koło Leonbergu w powiecie Böblingen w Badenii-Wirtembergii będzie w tym tygodniu zamykany trzy razy, po raz pierwszy w środę 28 października wieczorem. Automobilklub ADAC spodziewa się poważnych korków zwłaszcza w niedzielę 1 listopada przed południem, gdy w Badenii-Wirtembergii kończą się ferie jesienne.

Clojure/conj is so packed with must-see content that, unless you clone yourself, you can’t possibly attend all the great talks. To solve this problem and sav...

The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 through several software stacks. Their findings describe crashes, memory corruption, and an endless decoding loop, depending on how each application uses the affected library. First disclosed in Node.js security updates on October 21, the vulnerability sits in Google’s Brotli decoder rather than HTTP itself. An invalid block switch can be mistaken for a request for more input. Processing then continues with broken decoder state, allowing a write beyond the intended memory buffer. Affected upstream releases include Brotli 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Projects may apply the fix without changing to these upstream versions, so teams must check vendor patch records rather than relying on version numbers alone. HTTP2Shell Vulnerability In FFmpeg, researchers reached the decoder through libjxl, which processes JPEG XL images. A crafted image carried malformed Brotli data inside a compressed metadata box. When libjxl decoded that data, memory corruption caused a crash during cleanup. The test showed attacker control over a corrupted pointer value. However, it did not establish a complete remote code execution exploit for FFmpeg. This file-based route adds to concerns covered in earlier reporting on FFmpeg media-file vulnerabilities and other FFmpeg memory-corruption flaws . Those reports concern separate vulnerabilities. JFrog also triggered a native crash through .NET’s Brotli decompression APIs. A two-stage stream left the decoder in an invalid state before a memory operation moved outside valid heap data. Unlike a normal managed exception, the resulting segmentation fault terminated the process. The demonstration used a local console application. However, related decoder paths can serve HttpClient response decompression and ASP.NET Core request-decompression middleware. Microsoft announced on October 25 that it was rolling out updates for supported runtimes and SDKs. ClickHouse failed after receiving one crafted HTTP request with a 23 MB Brotli-compressed body. Decoder corruption caused a crash during cleanup, stopping the tested server and interrupting active queries. JFrog reported that a fix had been merged, but no patched release had shipped when its research appeared. Apache Arrow showed a different failure. A 534-byte input sent through pyarrow’s Brotli decoding path caused an endless loop that consumed CPU and blocked completion. Brotli 1.2.1 rejected the same input in under a second. Arrow’s tracking issue remained open at publication. According to the Sysdig Threat Research Team , Node.js fixes were released in versions 22.23.4, 24.22.1, and 26.12.1, with the 24.22.1 release notes confirming the Brotli patch. Other applications require their own updated builds or library packages. Teams should trace untrusted files, buffers, requests, and responses into decompression code. JFrog’s scanner helps identify potential paths, but a match alone does not prove remote exploitability. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow appeared first on Cyber Security News .