#HTTP2SHELL
LightNews LightNews
pentest-tools.com
The full PHP2Shell and Node2Shell (aka HTTP2Shell) session with Matei 👉 youtu.be/NewX2xofWgE
November 5, 2026 at 2:52 PM
jupyterhub-hu.bsky.social
News : Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. - Aikido Security
November 6, 2026 at 6:25 AM
shiojiri.com
【脆弱性ラッシュ】PHP2Shell・Brotli(HTTP2Shell)・Node・Chrome・Goが同時に来た週に、サーバーの「放置」が露呈した話 #Node.js - Qiita https://qiita.com/ysmreg1/items/d9f14d2da0ad57303036
November 6, 2026 at 4:20 AM
hacker.at.thenote.app
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found…
#hackernews #news #openai
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that gap matters, and how Sweet Virtual Patching protects running applications until the fixes land. A bad stream, a broken decoder …
www.helpnetsecurity.com
November 4, 2026 at 11:47 AM
helpnetsecurity.com
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

📖 Read more: www.helpnetsecurity.com/2026/11/03/p...

#cybersecurity #cybersecuritynews #patching #virtualpatching #vulnerabilitymanagement
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up - Help Net Security
HTTP2Shell reveals the gap between AI bug discovery and fixes. Sweet Security Virtual Patching blocks attacks while patches arrive.
www.helpnetsecurity.com
November 3, 2026 at 12:09 PM
programmier.bar
Eine Lücke im Brotli-Decoder und schon hängen Node.js, Bun, Python und curl mit drin.
HTTP2Shell, Claudes Spiele-Guardrail und Copilot Fusion in den programmier.bar News. Jetzt reinhören: www.programmier.bar/podcast/news...
November 5, 2026 at 10:12 AM
lasemanaphp.com
HTTP2Shell: el descompresor Brotli que llevan Node.js, Python y .NET permite ejecutar código con datos manipulados. Si descomprimes Brotli en el servidor, revisa tus dependencias.

vía @elhacker.net
Parches de emergencia ante la vulnerabilidad crítica 'HTTP2Shell' en Brotli
Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas
blog.elhacker.net
November 3, 2026 at 3:00 PM
getpagespeed.bsky.social
Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli

CVE-2026-111497 (HTTP2Shell) is a Brotli decoder bug. ngx_brotli only compresses and is not affected; on CentOS 7 and Amazon Linux 2 the fix is libbrotli 1.2.1 from GetPageSpeed, since EPEL 7 is archived at 1.0.9.
Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli
CVE-2026-111497 (HTTP2Shell) is a Brotli decoder bug. ngx_brotli only compresses and is not affected; on CentOS 7 and Amazon Linux 2 the fix is libbrotli 1.2.1 from GetPageSpeed, since EPEL 7 is archived at 1.0.9.
www.getpagespeed.com
November 4, 2026 at 7:33 PM
wpguy.uk
CVE-2024-56337: Critical Brotli Flaw Threatens WordPress Sites
A 9.2 severity score on the CVSS scale is as high as vulnerabilities get before reaching the theoretical maximum. The HTTP2Shell flaw, tracked as CVE-2024-56337 and affecting the Brotli compression
wpguy.uk
November 4, 2026 at 8:06 AM
wordfenceofficial.bsky.social
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

www.wordfence.com/blog/2026/11...
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unof...
www.wordfence.com
November 2, 2026 at 6:19 PM
tishisaka.bsky.social
結局仕組み作りが大事。

【脆弱性ラッシュ】PHP2Shell・Brotli(HTTP2Shell)・Node・Chrome・Goが同時に来た週に、サーバーの「放置」が露呈した話 #Node.js - Qiita qiita.com/ysmreg1/item...
【脆弱性ラッシュ】PHP2Shell・Brotli(HTTP2Shell)・Node・Chrome・Goが同時に来た週に、サーバーの「放置」が露呈した話 - Qiita
はじめに 2026年10月下旬、PHP、Node.js、Chrome、Goの重大な更新が立て続けに公開されました。私はこれを「脆弱性ラッシュ」と呼んでいます。 一斉に更新を進めるなかで、すでにサポートが切れている php7.4-fpm や Node 18 が見つかり、作業...
qiita.com
November 4, 2026 at 11:06 AM
gaprogman.com
The fallout from both Php2Shell and Http2Shell (to use another example) was largely fuelled by not updating stuff, and I shudder to think of all the critical stuff that hasn't been updated.
If you have any influence at your workplace, NOW is the time to start pushing for updating and upgrading.
November 4, 2026 at 7:30 AM
lordman1982.bsky.social
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
www.aikido.dev
November 2, 2026 at 1:03 PM
allcaps.bsky.social
Another day, another critical server exploit:
www.cve.org/CVERecord?id...

Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating

Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM
eulinuxevolutionde.eurosky.social
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...
winfuture.de
October 29, 2026 at 12:28 PM
ipnotica.bsky.social
HTTP2Shell? I wish there was a specific reason listed beyond proactivity :[
October 30, 2026 at 4:34 PM
seanchiggins.com
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ift.tt
October 30, 2026 at 8:44 PM
eulinuxevolutionde.eurosky.social
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...
winfuture.de
October 29, 2026 at 12:28 PM
haproxy.bsky.social
HAProxy Community and HAProxy Enterprise are NOT vulnerable to the new HTTP2Shell vulnerability (CVE-2026-111497). But your backend applications might still be at risk.

You can use HAProxy to block the attack vector at the edge while you patch your fleet: www.haproxy.com/blog/haproxy...
HAProxy is not vulnerable to HTTP2Shell (CVE-2026-111497)
HAProxy is not vulnerable to Brotli CVEs (HTTP2Shell) because it doesn't provide Brotli decoding. However, it can help protect vulnerable backends by blocking potentially dangerous requests.
www.haproxy.com
October 29, 2026 at 1:20 PM
ralf-ladner.bsky.social
HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus

#Brotli #BrotliCode @CheckPointSW #Cybersecurity #Cybersicherheit #HTTP2Shell #Node_js #Node2Shell #Schwachstelle #Sicherheitslücke

netzpalaver.de/2026/...
October 29, 2026 at 1:58 PM
infosec.skyfleet.blue
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497).
cybersecuritynews.com
October 28, 2026 at 6:04 AM
bleepingcomputer.com
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
www.bleepingcomputer.com
October 28, 2026 at 10:48 AM
winfuture.de
Eine kritische Sicherheitslücke in Googles Kompressionsbibliothek #Brotli wird aktiv attackiert. Betroffen sind unter anderem #Nodejs und Virtualisierungslösungen von VMware.
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de
October 29, 2026 at 12:14 PM
packetstorm.bsky.social
HTTP2Shell: The Brotli Vulnerability That Extends beyond Node.js https://packetstorm.news/news/view/46754 #news
October 29, 2026 at 5:04 PM
etguenni.bsky.social
Die #Brotli #Schwachstelle CVE-2026-111497 reicht über node.js hinaus. Daher prüfen, was betroffen ist und reagieren

borncity.com/blog/2026/10...
HTTP2Shell: Brotli-Sicherheitslücke CVE-2026-111497 über Node.js hinaus prüfen
Seit einigen Tagen ist ja eine Schwachstelle (CVE-2026-111497) im Brotli-Decoder von Node.js bekannt geworden. Es gibt zwar Updates, aber inzwischen ist klar, dass die Brotli-Bibliotheken in mehr…
borncity.com
October 31, 2026 at 6:41 PM