Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
(broccoli2shell.com)
Yes indeed, the cheap models still produce slop. Slightly annoying because I'd love to use them for personal projects, but as you say I can't really justify the cost.
For work though it's a no brainer, given my salary and the productivity boost. At my previous company I sometimes spent an entire day debugging a complex test failure that Claude can figure out in 5 minutes. No exaggeration.