#http2shell
LightNews LightNews
eulinuxevolutionde.eurosky.social
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...
winfuture.de
October 29, 2026 at 12:28 PM
helpnetsecurity.com
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

📖 Read more: www.helpnetsecurity.com/2026/11/03/p...

#cybersecurity #cybersecuritynews #patching #virtualpatching #vulnerabilitymanagement
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up - Help Net Security
HTTP2Shell reveals the gap between AI bug discovery and fixes. Sweet Security Virtual Patching blocks attacks while patches arrive.
www.helpnetsecurity.com
November 3, 2026 at 12:09 PM
hacker.at.thenote.app
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found…
#hackernews #news #openai
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that gap matters, and how Sweet Virtual Patching protects running applications until the fixes land. A bad stream, a broken decoder …
www.helpnetsecurity.com
November 4, 2026 at 11:47 AM
lasemanaphp.com
HTTP2Shell: el descompresor Brotli que llevan Node.js, Python y .NET permite ejecutar código con datos manipulados. Si descomprimes Brotli en el servidor, revisa tus dependencias.

vía @elhacker.net
Parches de emergencia ante la vulnerabilidad crítica 'HTTP2Shell' en Brotli
Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas
blog.elhacker.net
November 3, 2026 at 3:00 PM
wordfenceofficial.bsky.social
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

www.wordfence.com/blog/2026/11...
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unof...
www.wordfence.com
November 2, 2026 at 6:19 PM
infosec.skyfleet.blue
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497).
cybersecuritynews.com
October 28, 2026 at 6:04 AM
lordman1982.bsky.social
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
www.aikido.dev
November 2, 2026 at 1:03 PM
kotetsuyama.bsky.social
ubuntuもhttp2shellとeMudhraの対応アップデートきた。アップデート終了
October 27, 2026 at 9:15 AM
bleepingcomputer.com
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
www.bleepingcomputer.com
October 28, 2026 at 10:48 AM
allcaps.bsky.social
Another day, another critical server exploit:
www.cve.org/CVERecord?id...

Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating

Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM
eulinuxevolutionde.eurosky.social
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de/news,162288....

#Linux #LinuxNews #LinuxDE #LinuxNewsDE #EULE #EULEde #HTTP2Shell #HTTP
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
Die US-Cybersicherheitsbehörde CISA warnt vor der aktiv ausgenutzten Sicherheitslücke HTTP2Shell in der Kompressionsbibliothek Brotli. Auch Sicherheitsforscher haben erste Angriffsversuche registriert...
winfuture.de
October 29, 2026 at 12:28 PM
ipnotica.bsky.social
HTTP2Shell? I wish there was a specific reason listed beyond proactivity :[
October 30, 2026 at 4:34 PM
wpguy.uk
CVE-2024-56337: Critical Brotli Flaw Threatens WordPress Sites
A 9.2 severity score on the CVSS scale is as high as vulnerabilities get before reaching the theoretical maximum. The HTTP2Shell flaw, tracked as CVE-2024-56337 and affecting the Brotli compression
wpguy.uk
November 4, 2026 at 8:06 AM
haproxy.bsky.social
HAProxy Community and HAProxy Enterprise are NOT vulnerable to the new HTTP2Shell vulnerability (CVE-2026-111497). But your backend applications might still be at risk.

You can use HAProxy to block the attack vector at the edge while you patch your fleet: www.haproxy.com/blog/haproxy...
HAProxy is not vulnerable to HTTP2Shell (CVE-2026-111497)
HAProxy is not vulnerable to Brotli CVEs (HTTP2Shell) because it doesn't provide Brotli decoding. However, it can help protect vulnerable backends by blocking potentially dangerous requests.
www.haproxy.com
October 29, 2026 at 1:20 PM
ralf-ladner.bsky.social
HTTP2Shell - Brotli-Sicherheitslücke geht über Node.js hinaus

#Brotli #BrotliCode @CheckPointSW #Cybersecurity #Cybersicherheit #HTTP2Shell #Node_js #Node2Shell #Schwachstelle #Sicherheitslücke

netzpalaver.de/2026/...
October 29, 2026 at 1:58 PM
ninjaowl.ai
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches #cybersecurity #hacking #news #infosec #security #technology #privacy
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
www.bleepingcomputer.com
October 27, 2026 at 1:36 PM
ahmandonk.bsky.social
📰 Kerentanan Kritis 'HTTP2Shell' pada Brotli Picu Rilis Pembaruan Darurat

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/27/kerentanan-kritis-http2shell-brotli-picu-pembaruan-darurat/

#brotli #bufferOverflow #cloud #cve-2026-111497 #cyberSecurity #google #http2shell #keamananS
October 27, 2026 at 7:29 AM
rhisac.org
Patch now available for the "HTTP2Shell" vulnerability in the Brotli compression library, with proof-of-concept exploits already public.

Read the full details and security advisory: https://rhisac.org/general-blog/patch-available-for-http2shell-flaw-in-brotli-pocs-public/
October 28, 2026 at 3:34 PM
seanchiggins.com
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ift.tt
October 30, 2026 at 8:44 PM
bleepingcomputer.com
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
www.bleepingcomputer.com
October 26, 2026 at 4:28 PM
gaprogman.com
The fallout from both Php2Shell and Http2Shell (to use another example) was largely fuelled by not updating stuff, and I shudder to think of all the critical stuff that hasn't been updated.
If you have any influence at your workplace, NOW is the time to start pushing for updating and upgrading.
November 4, 2026 at 7:30 AM
winfuture.de
Eine kritische Sicherheitslücke in Googles Kompressionsbibliothek #Brotli wird aktiv attackiert. Betroffen sind unter anderem #Nodejs und Virtualisierungslösungen von VMware.
HTTP2Shell: Schwachstelle in Googles Brotli wird aktiv angegriffen
winfuture.de
October 29, 2026 at 12:14 PM
tishisaka.bsky.social
結局仕組み作りが大事。

【脆弱性ラッシュ】PHP2Shell・Brotli(HTTP2Shell)・Node・Chrome・Goが同時に来た週に、サーバーの「放置」が露呈した話 #Node.js - Qiita qiita.com/ysmreg1/item...
【脆弱性ラッシュ】PHP2Shell・Brotli(HTTP2Shell)・Node・Chrome・Goが同時に来た週に、サーバーの「放置」が露呈した話 - Qiita
はじめに 2026年10月下旬、PHP、Node.js、Chrome、Goの重大な更新が立て続けに公開されました。私はこれを「脆弱性ラッシュ」と呼んでいます。 一斉に更新を進めるなかで、すでにサポートが切れている php7.4-fpm や Node 18 が見つかり、作業...
qiita.com
November 4, 2026 at 11:06 AM
depuschm.bsky.social
I built a free open source scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell).

It checks the Brotli code in binaries, not version numbers: finds copies in Node.js, Python, .NET, Bun and sees distro backports.

github.com/depuschm/bro...

#infosec #cybersecurity
GitHub - depuschm/brotli-k8s-scan: Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries them...
Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers...
github.com
October 28, 2026 at 6:21 PM
packetstorm.bsky.social
HTTP2Shell: The Brotli Vulnerability That Extends beyond Node.js https://packetstorm.news/news/view/46754 #news
October 29, 2026 at 5:04 PM