#node2shell

🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild. Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64. Patch now → 22.23.4 / 24.22.1 / 26.12.1 Read ↓

‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓

CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts

Node2Shell PoC is now public. CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE. No execSync. No eval. No fake webhook. The brotli decoder itself can reach system(). PoC: #Node2Shell #NodeJS #CVE #InfoSec

PHP2Shell事件以来、1週間 攻撃が33倍になった(^_^;) さすがにヤベェ #MamorAI　#Apache2shell　#node2shell #PHP2Shell

一夜明けて今日 案の定、攻撃数が10倍になってて草 #PHP2Shell

Node2Shell (CVE-2026-111497) reproduced: Brotli + Node.js RCE, ASLR ON, blind, no memory leaks. Our RINGPIVOT primitive turns the Brotli ring buffer into a stack pivot and lands a real /bin/sh on stock Node 24.22.0 + Express 5.3.0. #Node2Shell #CVE2026111497 #NodeJS #RCE

At Google CTF in Singapore with TeamH4C, I came across Node2Shell on X. php2shell already feels well-trodden, so I dug into Node2Shell instead and published the analysis on SAGO, our 1-day platform. 📝 Write-up: 💻 PoC & exploit:

Node2Shell (CVE-2026-111497), a Brotli decoder flaw, is in CISA KEV since Oct 27. Update NodeJS, dotNET, Python packages, then restart processes and rebuild container images. #Node2Shell #CyberSecurity 🇬🇧 🇩🇪

"Node2Shell" on brotli: the PoC everyone shared is fake. So are many public PoCs. But CVE-2026-111497 is real — 16 measured steps, every number reproduced: ASan WRITE of size 16, UBSan index 8 out of bounds, pointer hijack, Node 24 crash vs Node 26 -17. #infosec #brotli

CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts

Pillow's wheels still carry an unfixed Brotli decoder (CVE-2026-111497), reached via fonts loaded with ImageFont.truetype(). pip-audit doesn't flag it yet. Until a fix ships, load only fonts you trust. Write-up, with credits: #Python #Node2Shell #SBOM

I built a free #opensource scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell). It checks the #Brotli code in binaries, not versions: finds copies in #Nodejs, #Python, #dotnet, #Bun and sees #Linux backports. #infosec #K8s #Docker #CVE

We have released tools to help mitigate, detect, and audit systems for #PHP2Shell, #Node2Shell, #HTTP2Shell, and 30+ other CVEs from the past month. Free to copy, remix, share👇

Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.

#Node2Shell (CVE-2026-111497) We identified a potentially distinct Brotli payload variant (23,068,764 bytes vs. the reported 23,069,983) across multiple suspected exploitation attempts. Observed activity: * Decoder probing via 1-byte Brotli bodies, invalid Content-Encoding: x, and br/gzip/deflate cycling. * Body-size progression: 1MB → 4MB → 10MB → 23MB. * AWS CRS SizeRestrictions_BODY blocked observed attempts in block mode, but not detect-only mode. Hunt for unusual Brotli POST requests and repeated body-size probing.

#Node2Shell/#HTTP2Shell (CVE-2026-111497): Detection and Mitigation for Node.js via @PenTestIT

One Tiny Bug Just Put Half the Internet at Risk — Node2Shell (CVE-2026-111497) Explained #Node2Shell #NodeJS #CyberSecurity #CVE #Brotli

To all "awesome and cool developers", looking down at #PHP and calling it a shit platform in various forms, I'll be available this afternoon for a sit down where we talk about #Node2Shell 🧐 #php2shell #cybersec #cybersecurity #exploit #rce #CVEALERT #nodejs #Node

CISA just added #Node2Shell (CVE-2026-111497) to its catalog of actively exploited vulnerabilities. The flaw affects Brotli decompression and can potentially allow attackers to execute arbitrary code. Researchers have already observed exploitation attempts, including one that failed to produce a working shell. That last detail is important. A failed exploit doesn't mean a harmless vulnerability. It means attackers are actively experimenting, and we shouldn't assume they'll keep failing. Here's where things get interesting for engineering teams. Updating your npm dependencies doesn't necessarily fix the vulnerable Brotli decoder bundled into Node.js. Your application dependencies could be completely up to date while the runtime inside your Docker image remains vulnerable. The same underlying library also appears in other software, each with its own patching requirements. For Node.js, the fixed versions include 22.23.4, 24.22.1, and 26.12.1. Check the actual runtime versions inside your containers and CI/CD runners, not just your development machines. Rebuild affected images, redeploy them, and verify the updated versions are actually running. This is also why we spend so much time thinking about runtime security at Endura. Patching fixes the underlying vulnerability, while least-privilege enforcement can help limit what compromised code is allowed to do inside a protected build environment. They're complementary controls, and neither replaces the other. One question for the engineering community: Who owns patching the runtimes buried inside your CI/CD infrastructure?

Node2Shell ya se explota en ataques, advierte CISA. La falla afecta ciertas implementaciones de Brotli y puede comprometer equipos. Urge aplicar parches o mitigar riesgos hasta poder actualizar. #actualidadensimple #ciberseguridad #Node2Shell

PHP2Shell and Node2Shell show why regular patching matters. Update your runtimes and review your overall security posture. CyberRoot supports businesses across the East Midlands. #PHP2Shell #Node2Shell #CyberSecurity