#node2shell
LightNews LightNews
heygalatea.com
Node2Shell's fix sat in a public branch for eight months with no release. KEV added it a day after exploit traffic showed up.

My Sunday roundup: PHP2Shell, Node2Shell and the versions to patch to.

heygalatea.com/news/php2she...

#infosec #nodejs
PHP2Shell and Node2Shell go from patch to exploited
My roundup for Oct 26 to 31, 2026: PHP2Shell and Node2Shell hit KEV, plus Anthropic, OpenAI, Mistral, GitLab, Cisco ASA, PolyShell and ConnectWise.
heygalatea.com
November 1, 2026 at 8:21 PM
marsrakete.de
Nach PHP2shell gab es jetzt noch node2shell. Wobei letzter auf eine von Google veröffentliche Library namens brotli zurückzuführen ist und in vielen Projekt auch ausserhalb "node.js" verwendet wird.

Wegen php2shell hatte ich das node2shell nicht auf dem Schirm. Patch einspielen und Neustart reicht.
October 29, 2026 at 7:22 AM
bleepingcomputer.com
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
www.bleepingcomputer.com
October 28, 2026 at 10:48 AM
infosec.skyfleet.blue
Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns
Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns
CISA has added the Node2Shell flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. Attackers are already sending live exploit traffic at Node.js servers, so teams should patch right away.
cybersecuritynews.com
October 28, 2026 at 12:27 PM
ahmandonk.bsky.social
📰 CISA Peringatkan Celah Kritis Node2Shell CVE-2026-111497 Sudah Dieksploitasi Hacker, Server Diminta Segera Update

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/30/cisa-node2shell-cve-2026-111497-dieksploitasi-hacker/

#cisa #cve #cybersecurity #keamananSiber #malware #node.j
October 30, 2026 at 8:49 AM
duonggiakhanh.com
🚨 Node2Shell (CVE-2026-111497) is now on CISA's KEV list: the Brotli decoder bug is being actively exploited. If your Node.js app decodes Brotli from untrusted input, update to 22.23.4 / 24.22.1 / 26.12.1 now. Bun and Python brotli need updates too. #cybersecurity #appsec
https://www.sophos.com/en-us/blog/node2shell-cve-2026-111497-in-active-exploitation
www.sophos.com
October 29, 2026 at 1:00 PM
heygalatea.com
Six of last week's seven stories hit CISA's KEV catalog between Oct 26 and 29. The seventh, ConnectWise, has no CVE to patch.

Inside: the week, patch to exploited, fix versions.

What's still on your list?

heygalatea.com/news/php2shell-and-node2shell-go-from-patch-to-exploited/

#infosec #nodejs
Cover graphic for the week 44 security roundup on heygalatea.com: PHP2Shell and Node2Shell go from patch to exploited. Chart summarizing last week's seven security stories at a glance. Timeline chart showing how quickly the week's bugs went from patch release to active exploitation and CISA's KEV catalog. Weekend checklist of the fix versions and steps to take for the week's bugs.
November 2, 2026 at 1:41 PM
infosec.skyfleet.blue
CISA warns of hackers now exploiting critical Node2Shell flaw
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
www.bleepingcomputer.com
October 28, 2026 at 11:12 AM
lordman1982.bsky.social
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
www.aikido.dev
November 2, 2026 at 1:03 PM
diesec.bsky.social
Node2Shell (CVE-2026-111497), a Brotli decoder flaw, is in CISA KEV since Oct 27. Update NodeJS, dotNET, Python packages, then restart processes and rebuild container images. #Node2Shell #CyberSecurity

🇬🇧 diesec.com/2026/10/brot...
🇩🇪 diesec.com/de/2026/10/b...
October 29, 2026 at 8:45 AM
cyberveille-ch.bsky.social
📢 CVE-2026-111497 (Node2Shell/Broccoli) : guide de détection pour l'OOB write du décodeur Brotli

Ce document est un guide d'ingénierie de détection pour CVE-2026-111497 (alias Node2Shell / Broccoli), une vulnérabilité d'écriture…

🟡 vérification factuelle moyenne
#Brotli #Node2Shell #Cyberveille
CVE-2026-111497 (Node2Shell/Broccoli) : guide de détection pour l'OOB write du décodeur Brotli
Ce document est un guide d'ingénierie de détection pour CVE-2026-111497 (alias Node2Shell / Broccoli), une vulnérabilité d'écriture hors limites (OOB write) dans le décodeur Brotli (CWE-787 + CWE-252, CVSS v4.0 : 9.2). L'article couvre la reproduction et la détection, non la découverte de la vulnérabilité.
cyberveille.ch
October 28, 2026 at 9:00 PM
thedailytechfeed.com
PolyShell breaches & Broccoli2Shell attacks show RCE risk in Adobe Commerce & Brotli now. #Security #Cybersecurity #PolyShell #Node2Shell #RCE #Ecommerce https://thedailytechfeed.com/adobe-commerce-brotli-flaws-under-active-exploitation-polyshell-node2shell-threats/
October 28, 2026 at 7:56 AM
arc-codex.com
Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE

This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially when the evidence cited is fragmented across…

via Sysdig Blog
huntaegis.com
November 1, 2026 at 1:38 PM
dataprolet.bsky.social
Falls ihr schnell die node.js-Version aller eurer Container prüfen wollt. #node2shell
git.dataprolet.de/dataprolet/S...

Kontext:
www.heise.de/news/Brotli-...
Brotli-Decoder-Lücke nicht nur in Node.js, sondern auch in Bun, Python und mehr
Die zunächst als „node2shell“ genannte Lücke im Brotli-Decoder von Google betrifft weitere Software. Admins sollten zügig updaten.
www.heise.de
October 28, 2026 at 3:16 PM
themorpheus.bsky.social
Neues Tutorialsvideo:
Wie aus einem FALSE eine 9.8 RCE in Node wird

https://youtu.be/8Hr0ymVjb2A
Wie aus einem FALSE eine 9.8 RCE in Node wird
CVE-2026-111497, in der Szene Node2Shell, ist eine Lücke im Brotli-Decoder, den Node.js gleich mitbringt, und der Fix dafür stand knapp acht Monate im öffent...
youtu.be
October 31, 2026 at 9:27 AM
hendryadrian.bsky.social
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and risks from bundled dependencies.
How Log4Shell, React2Shell, PHP2Shell and Node2Shell Enable Remote Code Execution
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and…
cyber.hendryadrian.com
October 30, 2026 at 10:36 AM
thenewoil.org
#cisa warns of hackers now exploiting critical #node2shell flaw

https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-now-exploiting-critical-node2shell-flaw/

#cybersecurity
CISA warns of hackers now exploiting critical Node2Shell flaw (BleepingComputer)
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and …
www.bleepingcomputer.com
October 29, 2026 at 1:00 PM
cyfar.ca
~Asec~
Malicious Brotli data can corrupt Node.js memory, causing DoS, leaks, or RCE.
-
IOCs: CVE-2026-111497
-
#CVE-2026-111497 #NodeJS #ThreatIntel
Node2Shell: Node.js Brotli RCE
asec.ahnlab.com
October 29, 2026 at 12:31 PM
getpacketai.bsky.social
Node2Shell CVE exposes unpatched Node.js to RCE via Brotli decompression—affects Express and fetch() by default. Upgrade your runtime…

https://dev.to/bogdan_ionita_3397390458b/node2shell-cve-2026-111497-which-nodejs-versions-fix-it-and-where-node-hides-5bd4

#appsec #DevSecOps
October 30, 2026 at 8:00 PM
thedailytechfeed.com
Node2Shell flaw in Brotli now actively exploited—patch Node.js, Bun, Python fast. #Node2Shell #Brotli #Nodejs #Security #Vulnerability #CVE2026 https://thedailytechfeed.com/node2shell-critical-brotli-flaw-under-active-exploitation/
October 28, 2026 at 2:03 PM
packetstorm.bsky.social
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli Decoder https://packetstorm.news/news/view/46852 #news
October 30, 2026 at 6:40 PM
shiojiri.com
Node2Shell Remote Code Execution | Outbreak Alert | FortiGuard Labs https://fortiguard.fortinet.com/outbreak-alert/node2shell
October 28, 2026 at 7:51 AM
cyber-threat.net
Full write-up: https://cyber-threat.net/node2shell-brotli-cve-2026-111497/
Node2Shell (CVE-2026-111497): patch Node.js, .NET and anything else that decodes Brotli - Cyber-Threat.net
CVE-2026-111497 (Node2Shell) is a Brotli decoder flaw in Node.js, .NET, Python and more. Now actively exploited and on CISA's KEV list: patch, then hunt.
cyber-threat.net
October 29, 2026 at 6:33 PM
tekthrill.bsky.social
Patch now: a critical Brotli flaw (Node2Shell) hit .NET, Node.js, PHP and Python ⚠️

Critical Brotli flaw CVE-2026-111497 (Node2Shell), rated 9.2: patches are out for .NET, Node.js, PHP and Python (BleepingComputer). How to check and update.

▶️ https://youtu.be/Mzlp-Brx1sk
#CyberSecurity
Patch Now: Critical Brotli Flaw (Node2Shell) Hits .NET, Node.js, PHP and Python
TEKTHRILL on YouTube
youtu.be
October 29, 2026 at 11:16 PM
allcaps.bsky.social
Another day, another critical server exploit:
www.cve.org/CVERecord?id...

Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating

Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM