SecTalks Gold Coast Nov 2026 - Brotlipocalypse: The Bug Hiding in Plain Sight

Title: Brotlipocalypse: The Bug Hiding in Plain Sight - speaker [Paul McCarty](https://www.linkedin.com/in/mccartypaul/) **CVE-2026-111497** is a great example of how a simple vulnerability can become a surprisingly difficult software supply chain problem. In this talk, we'll walk through the vulnerable Brotli source code, break down the bug in plain English, and show why it's remarkably easy to understand once you know where to look. Then comes the hard part: finding it in the wild. Brotli is everywhere, but it isn't always installed as a library or tracked as a package dependency. Developers frequently vendor the source code directly into their projects, making traditional dependency scanners and SBOMs potentially blind to vulnerable copies. We'll explore real-world examples, examine why conventional vulnerability detection falls short, and discuss practical techniques for hunting down vulnerable code across the open-source ecosystem. **The takeaway:** Finding a vulnerability in source code is one thing. Finding every copy of that code is an entirely different challenge. Drinks are provided by our sponsor, [Solis](https://www.solissecurity.com/en-gb/)[,](https://sovtech.com.au/) and pizza is provided by [Cyber Audit Team](https://cyberauditteam.com/). As usual, our venue is sponsored by [COHORT](https://cohortspace.com.au/). GC SecTalks maintains a strict [Code of Conduct](https://www.sectalks.org/coc/#:~:text=Be%20considerate%2C%20respectful%2C%20and%20collaborative.%20Refrain%20from%20demeaning%2C,dangerous%20situation%20or%20someone%20in%20distress.%20Ask%20questions.).