LightNews — News, ranked by scholars

@eulinuxevolutionde.eurosky.social

HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP

HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen

Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...

winfuture.de

October 29, 2026 at 12:28 PM

InfoSec

@infosec.skyfleet.blue

Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost

Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497).

cybersecuritynews.com

October 28, 2026 at 6:04 AM

コテツ

@kotetsuyama.bsky.social

ubuntuもhttp2shellとeMudhraの対応アップデートきた。アップデート終了

October 27, 2026 at 9:15 AM

BleepingComputer

@bleepingcomputer.com

CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.

CISA warns of hackers now exploiting critical Node2Shell flaw

CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.

www.bleepingcomputer.com

October 28, 2026 at 10:48 AM

Ninja Owl

@ninjaowl.ai

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches #cybersecurity #hacking #news #infosec #security #technology #privacy

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

www.bleepingcomputer.com

October 27, 2026 at 1:36 PM

Ahmandonk

@ahmandonk.bsky.social

📰 Kerentanan Kritis 'HTTP2Shell' pada Brotli Picu Rilis Pembaruan Darurat

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/kerentanan-kritis-http2shell-brotli-picu-pembaruan-darurat/

#brotli #bufferOverflow #cloud #cve-2026-111497 #cyberSecurity #google #http2shell #keamananS

October 27, 2026 at 7:29 AM

Wordfence

@wordfenceofficial.bsky.social

HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

www.wordfence.com/blog/2026/11...

HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unof...

www.wordfence.com

November 2, 2026 at 6:19 PM

BleepingComputer

@bleepingcomputer.com

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

www.bleepingcomputer.com

October 26, 2026 at 4:28 PM

HAProxy Technologies

@haproxy.bsky.social

HAProxy Community and HAProxy Enterprise are NOT vulnerable to the new HTTP2Shell vulnerability (CVE-2026-111497). But your backend applications might still be at risk.

You can use HAProxy to block the attack vector at the edge while you patch your fleet: www.haproxy.com/blog/haproxy...

HAProxy is not vulnerable to HTTP2Shell (CVE-2026-111497)

HAProxy is not vulnerable to Brotli CVEs (HTTP2Shell) because it doesn't provide Brotli decoding. However, it can help protect vulnerable backends by blocking potentially dangerous requests.

www.haproxy.com

October 29, 2026 at 1:20 PM

greta garblghhhh

@ipnotica.bsky.social

HTTP2Shell? I wish there was a specific reason listed beyond proactivity :[

October 30, 2026 at 4:34 PM

Retail & Hospitality ISAC

@rhisac.org

Patch now available for the "HTTP2Shell" vulnerability in the Brotli compression library, with proof-of-concept exploits already public.

Read the full details and security advisory: https://rhisac.org/general-blog/patch-available-for-http2shell-flaw-in-brotli-pocs-public/

October 28, 2026 at 3:34 PM

Ralf Ladner

@ralf-ladner.bsky.social

HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus

#Brotli #BrotliCode @CheckPointSW #Cybersecurity #Cybersicherheit #HTTP2Shell #Node_js #Node2Shell #Schwachstelle #Sicherheitslücke

netzpalaver.de/2026/...

October 29, 2026 at 1:58 PM

Lorenzo Ordóñez

@lordman1982.bsky.social

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...

Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

www.aikido.dev

November 2, 2026 at 1:03 PM

Dave

@allcaps.bsky.social

Another day, another critical server exploit:
www.cve.org/CVERecord?id...

Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating

Barely noon on Monday.

www.cve.org

November 2, 2026 at 5:35 PM

コテツ

@kotetsuyama.bsky.social

正確にはhttp2shellのアップデートだった

October 27, 2026 at 10:02 AM

WinFuture.de

@winfuture.de

Eine kritische Sicherheitslücke in Googles Kompressionsbibliothek #Brotli wird aktiv attackiert. Betroffen sind unter anderem #Nodejs und Virtualisierungslösungen von VMware.

HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen

winfuture.de

October 29, 2026 at 12:14 PM

Chris Heilmann

@codepo8.bsky.social

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches www.bleepingcomputer.com/news/securit...

That AI image… It is about bread, not Broccoli!

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

www.bleepingcomputer.com

October 27, 2026 at 2:15 PM

Sean C Higgins

@seanchiggins.com

Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH

Microsoft releases emergency .NET patches for critical Brotli flaw

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.

ift.tt

October 30, 2026 at 8:44 PM

Dietmar Puschmann

@depuschm.bsky.social

I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).

It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.

github.com/depuschm/bro...

#infosec #cybersecurity

GitHub - depuschm/brotli-k8s-scan: Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries them...

Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers...

github.com

October 28, 2026 at 6:21 PM

BleepingComputer

@bleepingcomputer.com

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.