Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM
Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
www.bleepingcomputer.com
October 28, 2026 at 10:48 AM
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ift.tt
October 30, 2026 at 8:44 PM
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen. #Security
heise+ | php2shell, Broccoli2Shell und „4“ zeigen, woran IT-Sicherheit krankt
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen.
www.heise.de
October 30, 2026 at 8:04 AM
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen. #Security
Brotli / Node.js Vulnerabilities in ArcGIS https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
October 30, 2026 at 1:29 PM
Brotli / Node.js Vulnerabilities in ArcGIS https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
www.wiz.io
October 28, 2026 at 2:55 PM
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish
I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
GitHub - depuschm/brotli-k8s-scan: Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries them...
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers...
github.com
October 28, 2026 at 6:21 PM
I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog
www.wiz.io
October 30, 2026 at 3:59 AM
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
ArcGIS Blog - Brotli Vulnerabilities (Broccoli2Shell) by Randall Williams
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
October 28, 2026 at 12:35 AM
ArcGIS Blog - Brotli Vulnerabilities (Broccoli2Shell) by Randall Williams
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
PolyShell breaches & Broccoli2Shell attacks show RCE risk in Adobe Commerce & Brotli now. #Security #Cybersecurity #PolyShell #Node2Shell #RCE #Ecommerce https://thedailytechfeed.com/adobe-commerce-brotli-flaws-under-active-exploitation-polyshell-node2shell-threats/
October 28, 2026 at 7:56 AM
PolyShell breaches & Broccoli2Shell attacks show RCE risk in Adobe Commerce & Brotli now. #Security #Cybersecurity #PolyShell #Node2Shell #RCE #Ecommerce https://thedailytechfeed.com/adobe-commerce-brotli-flaws-under-active-exploitation-polyshell-node2shell-threats/
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
www.bleepingcomputer.com
October 26, 2026 at 3:38 PM
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
LOL!!! Wie der ebenfalls von Google entwickelte Algorithmus "Zopfli" ist "Brotli" nach der Schweizer Variante des Brötchens benannt! Demfall statt #Broccoli2Shell #BrotliSchimmel2Shell?
opensource.googleblog.com/2015/09/intr...
opensource.googleblog.com/2015/09/intr...
Introducing Brotli: a new compression algorithm for the internet
At Google, we think that internet users’ time is valuable, and that they shouldn’t have to wait long for a web page to load. Because fast is better...
opensource.googleblog.com
October 28, 2026 at 2:34 PM
LOL!!! Wie der ebenfalls von Google entwickelte Algorithmus "Zopfli" ist "Brotli" nach der Schweizer Variante des Brötchens benannt! Demfall statt #Broccoli2Shell #BrotliSchimmel2Shell?
opensource.googleblog.com/2015/09/intr...
opensource.googleblog.com/2015/09/intr...
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 29, 2026 at 8:56 AM
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
Angreifer nehmen Brotli-, Adobe-Commerce- und Magento-Lecks ins Visier
In freier Wildbahn wurden Angriffe auf kritische Sicherheitslücken in Brotli, Adobe Commerce und Magento beobachtet. Updates helfen.
www.heise.de
October 31, 2026 at 6:57 AM
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 29, 2026 at 8:56 AM
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
V kompresní knihovně Brotli byla nalezena kritická zranitelnost CVE-2026–111497, pojmenovaná jako Broccoli2Shell. Má hodnocení CVSS 9,2 a při zpracování speciálně připravených komprimovaných dat může útočníkovi umožnit vzdálené spuštění kódu bez autentizace. Chyba se týká dekodéru Brotli a zranitelná je aplikace tehdy, když dekóduje data, která může ovlivnit útočník.
Brotli se používá pro kompresi obsahu na webu i v řadě aplikací a běhových prostředí. Zranitelné verze knihovny jsou 1.0.3 až 1.2.0. Opravy vyšly ve verzích 1.0.10, 1.1.1 a 1.2.1 v příslušných vývojových větvích.
Správcům systémů se doporučuje prověřit nejen samostatně instalovanou knihovnu, ale také závislosti a komponenty, které mohou obsahovat vlastní kopii dekodéru. Poté je třeba nasadit opravené verze příslušných balíčků či aplikací. Do doby aktualizace je vhodné omezit zpracování nedůvěryhodných dat komprimovaných pomocí Brotli.
www.root.cz
October 27, 2026 at 8:40 AM
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
CISA confirmó que ciberdelincuentes han comenzado a explotar una vulnerabilidad crítica de Brotli conocida como Node2Shell , Broccoli2Shell y HTTP2Shell. (Inglés)
Vía: @bleepingcomputer.com
Vía: @bleepingcomputer.com
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Sh...
www.bleepingcomputer.com
October 28, 2026 at 6:32 PM
CISA confirmó que ciberdelincuentes han comenzado a explotar una vulnerabilidad crítica de Brotli conocida como Node2Shell , Broccoli2Shell y HTTP2Shell. (Inglés)
Vía: @bleepingcomputer.com
Vía: @bleepingcomputer.com
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 28, 2026 at 11:12 AM
CISA warns of hackers now exploiting critical Node2Shell flaw
Node2Shell, HTTP2Shell, Broccoli2Shell : une seule faille Brotli (CVE-2026-111497), et après Node.js, Python, .NET et Linux publient leurs correctifs.
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
October 27, 2026 at 7:01 AM
Node2Shell, HTTP2Shell, Broccoli2Shell : une seule faille Brotli (CVE-2026-111497), et après Node.js, Python, .NET et Linux publient leurs correctifs.
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
Determinate Nix version 3.24.1 is now out 🎉 and it includes important security fixes as well as a lovely new `nix top` command, improvements to GC and parallel eval, and much else besides. Our new changelog post has the full scoop 🔗
determinate.systems/blog/changel...
determinate.systems/blog/changel...
Changelog: an important security fix, nix top, faster garbage collection, parallel instantiation, and more
Determinate Nix 3.24.1 fixes the Broccoli2Shell Brotli vulnerability, adds a live nix top view of active builds, fixes a garbage collection slowdown in large evaluations, instantiates derivation…
determinate.systems
October 28, 2026 at 9:01 PM
Determinate Nix version 3.24.1 is now out 🎉 and it includes important security fixes as well as a lovely new `nix top` command, improvements to GC and parallel eval, and much else besides. Our new changelog post has the full scoop 🔗
determinate.systems/blog/changel...
determinate.systems/blog/changel...
#brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, #python und mehr | Security https://www.heise.de/news/Brotli-Decoder-Luecke-nicht-nur-in-Node-js-sondern-auch-in-Bun-Python-und-mehr-11499975.html #nodejs #patchday #broccoli2shell #google :google:
Brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, Python und mehr
Die zunächst als „node2shell“ genannte Lücke im Brotli-Decoder von Google betrifft weitere Software. Admins sollten zügig updaten.
www.heise.de
October 28, 2026 at 5:19 AM
#brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, #python und mehr | Security https://www.heise.de/news/Brotli-Decoder-Luecke-nicht-nur-in-Node-js-sondern-auch-in-Bun-Python-und-mehr-11499975.html #nodejs #patchday #broccoli2shell #google :google:
#cisa warns of hackers now exploiting critical #node2shell flaw
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
#cybersecurity
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
#cybersecurity
CISA warns of hackers now exploiting critical Node2Shell flaw (BleepingComputer)
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and …
www.bleepingcomputer.com
October 29, 2026 at 1:00 PM
#cisa warns of hackers now exploiting critical #node2shell flaw
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
#cybersecurity
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/
#cybersecurity