#brotli
LightNews LightNews
doriantaylor.com
new things? or just brotli
November 2, 2026 at 3:19 AM
infosec.skyfleet.blue
Re: Brotli CVE-2026-111497
oss-sec: Re: Brotli CVE-2026-111497
Posted by Alan Coopersmith on Nov 03 Google Project Zero has now published their analysis at: https://project-zero.issues.chromium.org/issues/565308158
seclists.org
November 3, 2026 at 7:07 PM
tech-trending.bsky.social
Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers
https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers
Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers
www.microsoft.com
October 31, 2026 at 3:33 AM
r-netsec-bot.bsky.social
WordPress pingback and Brotli RCE
WordPress pingback and Brotli RCE
A pinned WordPress 7.1.3 image returned the web-process id line to an anonymous XML-RPC pingback. See the live capture, raw evidence and limits.
fortbridge.co.uk
November 2, 2026 at 9:33 AM
r-netsec.bsky.social
WordPress pingback and Brotli RCE
WordPress pingback and Brotli RCE
fortbridge.co.uk
November 2, 2026 at 9:39 AM
fei-echosphere.bsky.social
「脆弱な部品が入っている」と「その製品で悪用できる」は、同じ答えじゃないヨ。

SolaceのBrotliデコーダーの対応表で、私の手が止まった。製品ごとに、影響も対応日も違うネ。
https://solace.com/support/brotli-decoder-security-vulnerabilities/
November 4, 2026 at 1:33 PM
goat.navy
Not brotli
ubuntu.com/security/CVE...
CVE-2026-98432 | Ubuntu
Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.
ubuntu.com
November 2, 2026 at 3:20 AM
threatintel.microsoft.com
Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers msft.it/63328aFLOu
msrc.microsoft.com Microsoft Security Response Center @msrc.microsoft.com · 4d
PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products.
October 30, 2026 at 10:56 PM
furry.law
After the PHP, Node.js, PXE Driver, TCL, and Brotli Decoder vulnerabilities, the eMuhdra CA weakness, the Polymarket and Binance hacks, and having European freezers turned up to 50C...
I guess Cybersecurity Awareness Month was a success? Is everyone aware now?
November 2, 2026 at 5:53 PM
hrbrmstr.mastodon.social.ap.brid.gy
The potential brotli carnage has expanded in scope https://fieldeffect.com/blog/update-brotli-flaw-exposure-expands
Update: Brotli flaw exposure expands
New research shows the Brotli flaw CVE-2026-111497 reaches beyond web traffic. See newly affected products, file-processing risks, and mitigation steps.
fieldeffect.com
October 31, 2026 at 10:14 AM
dotnetfoundation.org
ICYMI - .NET October 2026 Out-of-Band Security Updates 🚨

Out-of-band security updates for .NET address the Brotli decoder vulnerability and tarball ownership vulnerability.
.NET October 2026 Out-of-Band Security Updates - .NET Blog
Out-of-band security updates for .NET address the Brotli decoder vulnerability and tarball ownership vulnerability.
devblogs.microsoft.com
November 3, 2026 at 6:32 PM
getpacketai.bsky.social
Critical Brotli decoder vulnerability hits Node.js, Python, Bun, and .NET—a memory-corruption flaw affecting decompression across the stack. Patch your Brotli implementations…

https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html

#cybersecurity #infosec
October 31, 2026 at 1:30 PM
grapheneos.org
We're using the Ina library from the Accrescent project to generate and use deltas. We're also using Dropbox's brotli-decompressor library to replace gzip compression using Android's DEFLATE implementation. Both are pure Rust libraries fully avoiding unsafe code other than the exported C FFI API.
October 31, 2026 at 9:15 PM
grapheneos.org
The latest version extends the cryptographic hashes to covering the compressed APKs and deltas to verify those prior to decompression. This means a compromised update server can't use the new Rust Brotli decompression library and Rust delta library as additional attack surface to exploit the client.
October 31, 2026 at 9:21 PM
eulinuxevolutionde.eurosky.social
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...
winfuture.de
October 29, 2026 at 12:28 PM
hapsis.bsky.social
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability

www.helpnetsecurity.com/2026/11/01/w...

#Kyberturvallisuus #ThreatIntel #Haavoittuvuus
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability - Help Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down
www.helpnetsecurity.com
November 1, 2026 at 10:55 AM
secquill.com
ESET reviews a chaotic week of PHP, Linux kernel, GitLab and Python supply-chain emergencies

In one October week, defenders faced critical PHP and GitLab flaws, leaked Linux kernel bug reports, a poisoned LiteLLM release, a Brotli decoder bug and a certificate authority failure…

#cybersecurity
ESET reviews a chaotic week of PHP, Linux kernel, GitLab and Python supply-chain emergencies
In one October week, defenders faced critical PHP and GitLab flaws, leaked Linux kernel bug reports, a poisoned LiteLLM release, a Brotli decoder bug and a certificate authority failure, ESET says.
secquill.com
November 4, 2026 at 11:07 AM
wordfenceofficial.bsky.social
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

www.wordfence.com/blog/2026/11...
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unof...
www.wordfence.com
November 2, 2026 at 6:19 PM
coasa.fedibird.com.ap.brid.gy
これか https://github.com/google/ngx_brotli.git
GitHub - google/ngx_brotli: NGINX module for Brotli compression
NGINX module for Brotli compression. Contribute to google/ngx_brotli development by creating an account on GitHub.
github.com
November 4, 2026 at 12:53 PM
distraction.engineer
Brotli does sound pretty tasty 🥦
October 28, 2026 at 4:37 PM
grapheneos.org
The latest arm64 Vanadium browser APK is 325MB. It was previously downloaded as a 131MB gzip file created with zopfli. It's now downloaded as a 17MB update for users who were on one of the most recent 2 Vanadium releases. It's down to 95MB via Brotli for users on older versions without deltas.
October 31, 2026 at 9:23 PM
5. CVE-2026-111497 · 7 people 🔥
🟥 Critical 9.2 · Google Brotli

Out-of-Bounds Write in Google Brotli Decoder
November 1, 2026 at 7:15 PM
lasemanaphp.com
HTTP2Shell: el descompresor Brotli que llevan Node.js, Python y .NET permite ejecutar código con datos manipulados. Si descomprimes Brotli en el servidor, revisa tus dependencias.

vía @elhacker.net
Parches de emergencia ante la vulnerabilidad crítica 'HTTP2Shell' en Brotli
Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas
blog.elhacker.net
November 3, 2026 at 3:00 PM
securityonline.bsky.social
Brotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched.

#Brotli #CVE2026111497 #NodeJS #DotNET #VMware #PatchNow #CISAKEV #Vulnerability
Brotli Vulnerability Affected Products: Vendor Patch Status List
TL;DR CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 through 1.2.0. Because Brotli is bundled into runtimes, proxies, appliances and file tools, this Brotli vulnerability reaches far beyond one library. This page tracks the affected products, which have fixes and which are still waiting. Why It Matters CISA added the Brotli vulnerability to its Known Exploited Vulnerabilities catalog on October 27, 2026.
securityonline.info
November 2, 2026 at 1:35 AM
lordman1982.bsky.social
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
www.aikido.dev
November 2, 2026 at 1:03 PM