Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org
November 2, 2026 at 5:35 PM
Another day, another critical server exploit:
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
www.cve.org/CVERecord?id...
Out-of-Bounds Write in Google Brotli Decoder
AKA Node2Shell, Broccoli2Shell, or HTTP2Shell
9.2 CVE rating
Barely noon on Monday.
Six of last week's seven stories hit CISA's KEV catalog between Oct 26 and 29. The seventh, ConnectWise, has no CVE to patch.
Inside: the week, patch to exploited, fix versions.
What's still on your list?
heygalatea.com/news/php2shell-and-node2shell-go-from-patch-to-exploited/
#infosec #nodejs
Inside: the week, patch to exploited, fix versions.
What's still on your list?
heygalatea.com/news/php2shell-and-node2shell-go-from-patch-to-exploited/
#infosec #nodejs
November 2, 2026 at 1:41 PM
Six of last week's seven stories hit CISA's KEV catalog between Oct 26 and 29. The seventh, ConnectWise, has no CVE to patch.
Inside: the week, patch to exploited, fix versions.
What's still on your list?
heygalatea.com/news/php2shell-and-node2shell-go-from-patch-to-exploited/
#infosec #nodejs
Inside: the week, patch to exploited, fix versions.
What's still on your list?
heygalatea.com/news/php2shell-and-node2shell-go-from-patch-to-exploited/
#infosec #nodejs
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
www.aikido.dev/blog/python-...
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
www.aikido.dev
November 2, 2026 at 1:03 PM
Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected
www.aikido.dev/blog/python-...
www.aikido.dev/blog/python-...
Thieves resell the stolen AI keys: one was used for 1.7 million AI requests in 13 hours, on someone else's bill.
18. 🆕 Node2Shell: hackers are now exploiting a hole in a compression tool built into software that runs a huge share of websites and apps (Node.js, .NET, Python and more), CISA says
18. 🆕 Node2Shell: hackers are now exploiting a hole in a compression tool built into software that runs a huge share of websites and apps (Node.js, .NET, Python and more), CISA says
November 2, 2026 at 8:01 AM
Thieves resell the stolen AI keys: one was used for 1.7 million AI requests in 13 hours, on someone else's bill.
18. 🆕 Node2Shell: hackers are now exploiting a hole in a compression tool built into software that runs a huge share of websites and apps (Node.js, .NET, Python and more), CISA says
18. 🆕 Node2Shell: hackers are now exploiting a hole in a compression tool built into software that runs a huge share of websites and apps (Node.js, .NET, Python and more), CISA says
Node2Shell's fix sat in a public branch for eight months with no release. KEV added it a day after exploit traffic showed up.
My Sunday roundup: PHP2Shell, Node2Shell and the versions to patch to.
heygalatea.com/news/php2she...
#infosec #nodejs
My Sunday roundup: PHP2Shell, Node2Shell and the versions to patch to.
heygalatea.com/news/php2she...
#infosec #nodejs
PHP2Shell and Node2Shell go from patch to exploited
My roundup for Oct 26 to 31, 2026: PHP2Shell and Node2Shell hit KEV, plus Anthropic, OpenAI, Mistral, GitLab, Cisco ASA, PolyShell and ConnectWise.
heygalatea.com
November 1, 2026 at 8:21 PM
Node2Shell's fix sat in a public branch for eight months with no release. KEV added it a day after exploit traffic showed up.
My Sunday roundup: PHP2Shell, Node2Shell and the versions to patch to.
heygalatea.com/news/php2she...
#infosec #nodejs
My Sunday roundup: PHP2Shell, Node2Shell and the versions to patch to.
heygalatea.com/news/php2she...
#infosec #nodejs
🔖 The latest issue of my #newsletter is live, issue 017.
Covers the @openjsf.org #CNA coordinated break 🏝️ , @nodeconf.eu in Bologna, the week everyone patched everything ( #eMudhra, #php2shell, #node2shell ), 78 CVEs, 17 releases & more 🧯
blog.ulisesgascon.com/newsletter-i...
Covers the @openjsf.org #CNA coordinated break 🏝️ , @nodeconf.eu in Bologna, the week everyone patched everything ( #eMudhra, #php2shell, #node2shell ), 78 CVEs, 17 releases & more 🧯
blog.ulisesgascon.com/newsletter-i...
Newsletter #017: Rest, Bologna, and the Week Everyone Patched Everything 🧯
The OpenJS CNA took a coordinated break and still had a record month, I spent three days in Bologna for NodeConf EU and the Collaborator Summit, and then the web had a rough week with eMudhra, php2she...
blog.ulisesgascon.com
November 1, 2026 at 2:18 PM
🔖 The latest issue of my #newsletter is live, issue 017.
Covers the @openjsf.org #CNA coordinated break 🏝️ , @nodeconf.eu in Bologna, the week everyone patched everything ( #eMudhra, #php2shell, #node2shell ), 78 CVEs, 17 releases & more 🧯
blog.ulisesgascon.com/newsletter-i...
Covers the @openjsf.org #CNA coordinated break 🏝️ , @nodeconf.eu in Bologna, the week everyone patched everything ( #eMudhra, #php2shell, #node2shell ), 78 CVEs, 17 releases & more 🧯
blog.ulisesgascon.com/newsletter-i...
Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE
This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially when the evidence cited is fragmented across…
via Sysdig Blog
This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially when the evidence cited is fragmented across…
via Sysdig Blog
huntaegis.com
November 1, 2026 at 1:38 PM
Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE
This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially when the evidence cited is fragmented across…
via Sysdig Blog
This article overstates the confidence in the "Node2Shell" finding by balancing documented crashes and denial-of-service reports against a claim of reliable RCE, especially when the evidence cited is fragmented across…
via Sysdig Blog
Brotli CVE-2026-111497 đã bị khai thác ngoài thực tế: Singapore cảnh báo, .NET và Python cũng dính — hạn chót 10/11
Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải mã Brotli đã có mã khai thác công khai và "được báo cáo là…
Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải mã Brotli đã có mã khai thác công khai và "được báo cáo là…
Brotli CVE-2026-111497 đã bị khai thác ngoài thực tế: Singapore cảnh báo, .NET và Python cũng dính — hạn chót 10/11
Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải mã Brotli đã có mã khai thác công khai và "được báo cáo là đang bị khai thác tích cực". Lỗ hổng ảnh hưởng cả Node.js, Microsoft .NET, Python, Bun và Envoy. Vì sao đáng đọc Đây là diễn biến mới của lỗ hổng Node2Shell, công bố ngày 21/10.
linhfish.dev
November 1, 2026 at 5:20 AM
Brotli CVE-2026-111497 đã bị khai thác ngoài thực tế: Singapore cảnh báo, .NET và Python cũng dính — hạn chót 10/11
Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải mã Brotli đã có mã khai thác công khai và "được báo cáo là…
Đoạn trả lời trực tiếp Ngày 30/10/2026, Cơ quan An ninh mạng Singapore (CSA) cảnh báo lỗ hổng CVE-2026-111497 trong bộ giải mã Brotli đã có mã khai thác công khai và "được báo cáo là…
Siemens Industrial Edge y Node2Shell: aviso con nota 9,8
Siemens Industrial Edge quedó dentro del mapa de Node2Shell. El aviso SSA-443410, publicado por Siemens ProductCERT el 30 de octubre, pone nombre industrial a un fallo que ya circulaba por el software web: CVE-2026-111497, nota 9,8 en la…
Siemens Industrial Edge quedó dentro del mapa de Node2Shell. El aviso SSA-443410, publicado por Siemens ProductCERT el 30 de octubre, pone nombre industrial a un fallo que ya circulaba por el software web: CVE-2026-111497, nota 9,8 en la…
Siemens Industrial Edge y Node2Shell: aviso con nota 9,8
Siemens Industrial Edge quedó dentro del mapa de Node2Shell. El aviso SSA-443410, publicado por Siemens ProductCERT el 30 de octubre, pone nombre industrial a un fallo que ya circulaba por el software web: CVE-2026-111497, nota 9,8 en la escala CVSS v3.1, con aplicaciones de gestión de planta en la lista de afectadas y mitigaciones concretas mientras llega el arreglo de Siemens Industrial Edge frente a Node2Shell. El cambio de fondo se ve al comparar fechas. El 25 de octubre, el fallo de Brotli se contaba como un problema de programas que descomprimen datos, …
tecnologiageek.com
October 31, 2026 at 8:03 PM
Siemens Industrial Edge y Node2Shell: aviso con nota 9,8
Siemens Industrial Edge quedó dentro del mapa de Node2Shell. El aviso SSA-443410, publicado por Siemens ProductCERT el 30 de octubre, pone nombre industrial a un fallo que ya circulaba por el software web: CVE-2026-111497, nota 9,8 en la…
Siemens Industrial Edge quedó dentro del mapa de Node2Shell. El aviso SSA-443410, publicado por Siemens ProductCERT el 30 de octubre, pone nombre industrial a un fallo que ya circulaba por el software web: CVE-2026-111497, nota 9,8 en la…
🚨 Various vulnerabilities and security events took over this past week in what’s being called “Black October”, which attackers reportedly chaining flaws to root firewalls and cyber defenders releases emergency patches for Node2SHELL.
🔗 https://bit.ly/4ittrba
🔗 https://bit.ly/4ittrba
October 31, 2026 at 4:00 PM
🚨 Various vulnerabilities and security events took over this past week in what’s being called “Black October”, which attackers reportedly chaining flaws to root firewalls and cyber defenders releases emergency patches for Node2SHELL.
🔗 https://bit.ly/4ittrba
🔗 https://bit.ly/4ittrba
🚨 Various vulnerabilities and security events took over this past week in what’s being called “Black October”, which attackers reportedly chaining flaws to root firewalls and cyber defenders releases emergency patches for Node2SHELL.
🔗 https://bit.ly/4ittrba
🔗 https://bit.ly/4ittrba
October 31, 2026 at 4:00 PM
🚨 Various vulnerabilities and security events took over this past week in what’s being called “Black October”, which attackers reportedly chaining flaws to root firewalls and cyber defenders releases emergency patches for Node2SHELL.
🔗 https://bit.ly/4ittrba
🔗 https://bit.ly/4ittrba
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
Angreifer nehmen Brotli-, Adobe-Commerce- und Magento-Lecks ins Visier
In freier Wildbahn wurden Angriffe auf kritische Sicherheitslücken in Brotli, Adobe Commerce und Magento beobachtet. Updates helfen.
www.heise.de
October 31, 2026 at 6:57 AM
Angreifer nehmen #brotli-, #adobecommerce und #magento-Lecks ins Visier | Security https://www.heise.de/news/Angreifer-nehmen-Brotli-Adobe-Commerce-und-Magento-Lecks-ins-Visier-11502623.html #adobemagento #patchday #broccoli2shell #node2shell
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
ift.tt
October 30, 2026 at 8:44 PM
Microsoft releases emergency .NET patches for critical Brotli flaw buff.ly/fZbCzyH
Node2Shell CVE exposes unpatched Node.js to RCE via Brotli decompression—affects Express and fetch() by default. Upgrade your runtime…
https://dev.to/bogdan_ionita_3397390458b/node2shell-cve-2026-111497-which-nodejs-versions-fix-it-and-where-node-hides-5bd4
#appsec #DevSecOps
https://dev.to/bogdan_ionita_3397390458b/node2shell-cve-2026-111497-which-nodejs-versions-fix-it-and-where-node-hides-5bd4
#appsec #DevSecOps
October 30, 2026 at 8:00 PM
Node2Shell CVE exposes unpatched Node.js to RCE via Brotli decompression—affects Express and fetch() by default. Upgrade your runtime…
https://dev.to/bogdan_ionita_3397390458b/node2shell-cve-2026-111497-which-nodejs-versions-fix-it-and-where-node-hides-5bd4
#appsec #DevSecOps
https://dev.to/bogdan_ionita_3397390458b/node2shell-cve-2026-111497-which-nodejs-versions-fix-it-and-where-node-hides-5bd4
#appsec #DevSecOps
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli Decoder https://packetstorm.news/news/view/46852 #news
October 30, 2026 at 6:40 PM
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli Decoder https://packetstorm.news/news/view/46852 #news
With Sniper: Auto-Exploiter, confirm which services are actually exploitable, with proof, then validate the patch.
KEV status means “patch today.” Validation tells you which services to fix first. Part of the Exploit plan.
#offensivesecurity #ethicalhacking
KEV status means “patch today.” Validation tells you which services to fix first. Part of the Exploit plan.
#offensivesecurity #ethicalhacking
Node2Shell/HTTP2Shell - Brotli Decoder Remote Code Execution (CVE-2026-111497)
An unauthenticated attacker who can send Brotli-compressed request bodies to the application or proxy, or make it fetch Brotli-compressed responses from a server they control, can corrupt process memo...
pentest-tools.com
October 30, 2026 at 2:27 PM
With Sniper: Auto-Exploiter, confirm which services are actually exploitable, with proof, then validate the patch.
KEV status means “patch today.” Validation tells you which services to fix first. Part of the Exploit plan.
#offensivesecurity #ethicalhacking
KEV status means “patch today.” Validation tells you which services to fix first. Part of the Exploit plan.
#offensivesecurity #ethicalhacking
📣 Exclusive exploit for #Node2Shell, now available in Pentest-Tools.com.
CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.
CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.
October 30, 2026 at 2:26 PM
📣 Exclusive exploit for #Node2Shell, now available in Pentest-Tools.com.
CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.
CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.
From Log4Shell to PHP2Shell: A New Generation of Code-Execution Vulnerabilities Exposes the Risks of Modern Software Dependencies + Video
Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly…
Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly…
From Log4Shell to PHP2Shell: A New Generation of Code-Execution Vulnerabilities Exposes the Risks of Modern Software Dependencies + Video
Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly unrelated vulnerabilities can expose millions of systems through a single vulnerable software component. From Log4Shell to React2Shell, PHP2Shell and Node2Shell, attackers repeatedly exploit weaknesses in widely deployed technologies to achieve remote code execution, compromise servers and potentially gain access to sensitive environments.
undercodenews.com
October 30, 2026 at 10:54 AM
From Log4Shell to PHP2Shell: A New Generation of Code-Execution Vulnerabilities Exposes the Risks of Modern Software Dependencies + Video
Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly…
Introduction: The Recurring Danger Behind Critical Software Vulnerabilities The cybersecurity industry continues to face a recurring problem: seemingly…
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data thehackernews.com/2026/10/rese...
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.
thehackernews.com
October 30, 2026 at 10:42 AM
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data thehackernews.com/2026/10/rese...
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and risks from bundled dependencies.
How Log4Shell, React2Shell, PHP2Shell and Node2Shell Enable Remote Code Execution
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and…
cyber.hendryadrian.com
October 30, 2026 at 10:36 AM
An explainer compares Log4Shell, React2Shell, PHP2Shell and Node2Shell, detailing their code-execution flaws, exposure paths, affected components, fixes and risks from bundled dependencies.
📰 CISA Peringatkan Celah Kritis Node2Shell CVE-2026-111497 Sudah Dieksploitasi Hacker, Server Diminta Segera Update
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/30/cisa-node2shell-cve-2026-111497-dieksploitasi-hacker/
#cisa #cve #cybersecurity #keamananSiber #malware #node.j
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/30/cisa-node2shell-cve-2026-111497-dieksploitasi-hacker/
#cisa #cve #cybersecurity #keamananSiber #malware #node.j
October 30, 2026 at 8:49 AM
📰 CISA Peringatkan Celah Kritis Node2Shell CVE-2026-111497 Sudah Dieksploitasi Hacker, Server Diminta Segera Update
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/30/cisa-node2shell-cve-2026-111497-dieksploitasi-hacker/
#cisa #cve #cybersecurity #keamananSiber #malware #node.j
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/30/cisa-node2shell-cve-2026-111497-dieksploitasi-hacker/
#cisa #cve #cybersecurity #keamananSiber #malware #node.j
米CISA、Node2Shellの悪用について警告 ハニーポットで攻撃試行が検知される（CVE-2026-111497） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/48291/
October 30, 2026 at 6:59 AM
米CISA、Node2Shellの悪用について警告 ハニーポットで攻撃試行が検知される（CVE-2026-111497） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/48291/
NHS England’s Oct. 29 Node2Shell alert urges affected organizations to check vendor guidance and install updates. The flaw in widely used compression software can expose data, crash services or let attackers run code.
https://digital.nhs.uk/cyber-alerts/2026/cc-4882
https://digital.nhs.uk/cyber-alerts/2026/cc-4882
October 30, 2026 at 3:09 AM
NHS England’s Oct. 29 Node2Shell alert urges affected organizations to check vendor guidance and install updates. The flaw in widely used compression software can expose data, crash services or let attackers run code.
https://digital.nhs.uk/cyber-alerts/2026/cc-4882
https://digital.nhs.uk/cyber-alerts/2026/cc-4882
