CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
www.bleepingcomputer.com
October 28, 2026 at 10:48 AM
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
www.wiz.io
October 28, 2026 at 2:55 PM
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog #devopsish
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen. #Security
heise+ | php2shell, Broccoli2Shell und „4“ zeigen, woran IT-Sicherheit krankt
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen.
www.heise.de
October 30, 2026 at 8:04 AM
Hinweise auf die schwerwiegenden Lücken gab in allen drei Fällen schon lange vor ihrer Behebung – ganz ohne KI. Sie hätten längst behoben sein sollen. #Security
Brotli / Node.js Vulnerabilities in ArcGIS https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
October 30, 2026 at 1:29 PM
Brotli / Node.js Vulnerabilities in ArcGIS https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ift.tt
October 30, 2026 at 8:44 PM
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
GitHub - depuschm/brotli-k8s-scan: Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries them...
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers...
github.com
October 28, 2026 at 6:21 PM
I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.
github.com/depuschm/bro...
#infosec #cybersecurity
Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM
Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
www.bleepingcomputer.com
October 26, 2026 at 3:38 PM
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ArcGIS Blog - Brotli Vulnerabilities (Broccoli2Shell) by Randall Williams
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
October 28, 2026 at 12:35 AM
ArcGIS Blog - Brotli Vulnerabilities (Broccoli2Shell) by Randall Williams
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/brotli-vulnerabilities-broccoli2shell
PolyShell breaches & Broccoli2Shell attacks show RCE risk in Adobe Commerce & Brotli now. #Security #Cybersecurity #PolyShell #Node2Shell #RCE #Ecommerce https://thedailytechfeed.com/adobe-commerce-brotli-flaws-under-active-exploitation-polyshell-node2shell-threats/
October 28, 2026 at 7:56 AM
PolyShell breaches & Broccoli2Shell attacks show RCE risk in Adobe Commerce & Brotli now. #Security #Cybersecurity #PolyShell #Node2Shell #RCE #Ecommerce https://thedailytechfeed.com/adobe-commerce-brotli-flaws-under-active-exploitation-polyshell-node2shell-threats/
LOL!!! Wie der ebenfalls von Google entwickelte Algorithmus "Zopfli" ist "Brotli" nach der Schweizer Variante des Brötchens benannt! Demfall statt #Broccoli2Shell #BrotliSchimmel2Shell?
opensource.googleblog.com/2015/09/intr...
opensource.googleblog.com/2015/09/intr...
Introducing Brotli: a new compression algorithm for the internet
At Google, we think that internet users’ time is valuable, and that they shouldn’t have to wait long for a web page to load. Because fast is better...
opensource.googleblog.com
October 28, 2026 at 2:34 PM
LOL!!! Wie der ebenfalls von Google entwickelte Algorithmus "Zopfli" ist "Brotli" nach der Schweizer Variante des Brötchens benannt! Demfall statt #Broccoli2Shell #BrotliSchimmel2Shell?
opensource.googleblog.com/2015/09/intr...
opensource.googleblog.com/2015/09/intr...
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
V kompresní knihovně Brotli byla nalezena kritická zranitelnost CVE-2026–111497, pojmenovaná jako Broccoli2Shell. Má hodnocení CVSS 9,2 a při zpracování speciálně připravených komprimovaných dat může útočníkovi umožnit vzdálené spuštění kódu bez autentizace. Chyba se týká dekodéru Brotli a zranitelná je aplikace tehdy, když dekóduje data, která může ovlivnit útočník.
Brotli se používá pro kompresi obsahu na webu i v řadě aplikací a běhových prostředí. Zranitelné verze knihovny jsou 1.0.3 až 1.2.0. Opravy vyšly ve verzích 1.0.10, 1.1.1 a 1.2.1 v příslušných vývojových větvích.
Správcům systémů se doporučuje prověřit nejen samostatně instalovanou knihovnu, ale také závislosti a komponenty, které mohou obsahovat vlastní kopii dekodéru. Poté je třeba nasadit opravené verze příslušných balíčků či aplikací. Do doby aktualizace je vhodné omezit zpracování nedůvěryhodných dat komprimovaných pomocí Brotli.
www.root.cz
October 27, 2026 at 8:40 AM
Kritická zranitelnost Broccoli2Shell umožňuje vzdálené spuštění kódu
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability | Wiz Blog
www.wiz.io
October 30, 2026 at 3:59 AM
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Node2Shell, HTTP2Shell, Broccoli2Shell : une seule faille Brotli (CVE-2026-111497), et après Node.js, Python, .NET et Linux publient leurs correctifs.
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
October 27, 2026 at 7:01 AM
Node2Shell, HTTP2Shell, Broccoli2Shell : une seule faille Brotli (CVE-2026-111497), et après Node.js, Python, .NET et Linux publient leurs correctifs.
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
Voici l'essentiel à savoir :
👉 www.it-connect.fr/faille-brotl...
#cybersécurité #python #dotnet
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 28, 2026 at 11:12 AM
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA confirmó que ciberdelincuentes han comenzado a explotar una vulnerabilidad crítica de Brotli conocida como Node2Shell , Broccoli2Shell y HTTP2Shell. (Inglés)
Vía: @bleepingcomputer.com
Vía: @bleepingcomputer.com
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Sh...
www.bleepingcomputer.com
October 28, 2026 at 6:32 PM
CISA confirmó que ciberdelincuentes han comenzado a explotar una vulnerabilidad crítica de Brotli conocida como Node2Shell , Broccoli2Shell y HTTP2Shell. (Inglés)
Vía: @bleepingcomputer.com
Vía: @bleepingcomputer.com
Literally got a text from work today (Sunday), asking if we had patched Broccoli2Shell already (yes, on Friday)
October 25, 2026 at 9:57 AM
Literally got a text from work today (Sunday), asking if we had patched Broccoli2Shell already (yes, on Friday)
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 29, 2026 at 8:56 AM
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
#hackernews #news
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
Angreifer nehmen Brotli-, Adobe-Commerce- und Magento-Lecks ins Visier
In freier Wildbahn wurden Angriffe auf kritische Sicherheitslücken in Brotli, Adobe Commerce und Magento beobachtet. Updates helfen.
www.heise.de
October 31, 2026 at 6:57 AM
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
https://broccoli2shell.com/
https://news.ycombinator.com/item?id=50219177
https://broccoli2shell.com/
https://news.ycombinator.com/item?id=50219177
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
An out-of-bounds write in Google's Brotli decoder reaches Node.js, Python and more. Affected versions, checks and fixes.
broccoli2shell.com
October 25, 2026 at 4:15 PM
Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more
https://broccoli2shell.com/
https://news.ycombinator.com/item?id=50219177
https://broccoli2shell.com/
https://news.ycombinator.com/item?id=50219177
📰 Microsoft Rilis Pembaruan Darurat .NET untuk Tambal Celah Kritis Brotli
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/microsoft-rilis-pembaruan-darurat-net-tambal-celah-kritis-brotli/
#asp.net #broccoli2shell #brotli #cloud #cve-2026-111497 #cyberSecurity #developer #htt
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/microsoft-rilis-pembaruan-darurat-net-tambal-celah-kritis-brotli/
#asp.net #broccoli2shell #brotli #cloud #cve-2026-111497 #cyberSecurity #developer #htt
October 27, 2026 at 7:28 AM
📰 Microsoft Rilis Pembaruan Darurat .NET untuk Tambal Celah Kritis Brotli
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/microsoft-rilis-pembaruan-darurat-net-tambal-celah-kritis-brotli/
#asp.net #broccoli2shell #brotli #cloud #cve-2026-111497 #cyberSecurity #developer #htt
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/microsoft-rilis-pembaruan-darurat-net-tambal-celah-kritis-brotli/
#asp.net #broccoli2shell #brotli #cloud #cve-2026-111497 #cyberSecurity #developer #htt
Kritická zranitelnost Broccoli2Shell ohrožuje aplikace využívající HTTP: csirt.cz/cs/kyberbezp...
#AktualneZBezpecnosti
#AktualneZBezpecnosti
October 26, 2026 at 1:10 PM
Kritická zranitelnost Broccoli2Shell ohrožuje aplikace využívající HTTP: csirt.cz/cs/kyberbezp...
#AktualneZBezpecnosti
#AktualneZBezpecnosti
#brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, #python und mehr | Security https://www.heise.de/news/Brotli-Decoder-Luecke-nicht-nur-in-Node-js-sondern-auch-in-Bun-Python-und-mehr-11499975.html #nodejs #patchday #broccoli2shell #google :google:
Brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, Python und mehr
Die zunächst als „node2shell“ genannte Lücke im Brotli-Decoder von Google betrifft weitere Software. Admins sollten zügig updaten.
www.heise.de
October 28, 2026 at 5:19 AM
#brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, #python und mehr | Security https://www.heise.de/news/Brotli-Decoder-Luecke-nicht-nur-in-Node-js-sondern-auch-in-Bun-Python-und-mehr-11499975.html #nodejs #patchday #broccoli2shell #google :google: