#Node2Shell

Node2Shell (CVE-2026-111497) reproduced: Brotli + Node.js RCE, ASLR ON, blind, no memory leaks. Our RINGPIVOT primitive turns the Brotli ring buffer into a stack pivot and lands a real /bin/sh on stock Node 24.22.0 + Express 5.3.0. #Node2Shell #CVE2026111497 #NodeJS #RCE

‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓

CISA just added #Node2Shell (CVE-2026-111497) to its catalog of actively exploited vulnerabilities. The flaw affects Brotli decompression and can potentially allow attackers to execute arbitrary code. Researchers have already observed exploitation attempts, including one that failed to produce a working shell. That last detail is important. A failed exploit doesn't mean a harmless vulnerability. It means attackers are actively experimenting, and we shouldn't assume they'll keep failing. Here's where things get interesting for engineering teams. Updating your npm dependencies doesn't necessarily fix the vulnerable Brotli decoder bundled into Node.js. Your application dependencies could be completely up to date while the runtime inside your Docker image remains vulnerable. The same underlying library also appears in other software, each with its own patching requirements. For Node.js, the fixed versions include 22.23.4, 24.22.1, and 26.12.1. Check the actual runtime versions inside your containers and CI/CD runners, not just your development machines. Rebuild affected images, redeploy them, and verify the updated versions are actually running. This is also why we spend so much time thinking about runtime security at Endura. Patching fixes the underlying vulnerability, while least-privilege enforcement can help limit what compromised code is allowed to do inside a protected build environment. They're complementary controls, and neither replaces the other. One question for the engineering community: Who owns patching the runtimes buried inside your CI/CD infrastructure?

CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts

Businesses are dealing with both PHP2Shell and Node2Shell right now. Patch PHP and Node.js to the latest fixed versions. CyberRoot helps East Midlands companies stay on top of this. #PHP2Shell #Node2Shell #CyberSecurity #Leicester

Node2Shell PoC is now public. CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE. No execSync. No eval. No fake webhook. The brotli decoder itself can reach system(). PoC: #Node2Shell #NodeJS #CVE #InfoSec

CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts

Node2Shell: a crafted Brotli stream turns Node.js body-parser and fetch() into a path to RCE. #ThreatIntel #CVE_2026_111497 #Node2Shell #ZLib

Node2Shell (CVE-2026-111497), a Brotli decoder flaw, is in CISA KEV since Oct 27. Update NodeJS, dotNET, Python packages, then restart processes and rebuild container images. #Node2Shell #CyberSecurity 🇬🇧 🇩🇪

@grok confirm

PHP2SHELL Exploit 🔥🔥🔥 🚨 XHack AI CoHunters successfully reproduced Remote Code Execution (RCE) in PHP 8.4, TWICE! Two autonomous AI CoHunters collaborated to develop and validate a working exploit chain in a controlled Docker lab. #php2shell #bughunting #xhack

Not overhyped. CVE-2026-109618/109619 are confirmed critical unauth RCEs in PHP. CISA added both to KEV on Oct 26 after verified exploitation. Working chains hit mod_php defaults in labs and some honeypots. Complexity (ASLR, offsets, configs) blocks easy mass worms, but risk is real—patch to 8.4.27+ immediately.

@grok Patch your systems! #php2shell #node2shell

Pillow's wheels still carry an unfixed Brotli decoder (CVE-2026-111497), reached via fonts loaded with ImageFont.truetype(). pip-audit doesn't flag it yet. Until a fix ships, load only fonts you trust. Write-up, with credits: #Python #Node2Shell #SBOM

Critical Brotli compression flaw "Node2Shell" (CVE-2026-111497) hits Node.js, Python packages and Microsoft .NET, Visual Studio and PowerShell. Patches are out, no attacks reported yet. Update now. #CyberSecurity #Node2Shell

I built a free #opensource scanner for CVE-2026-111497 (#Node2Shell #HTTP2Shell #Broccoli2Shell). It checks the #Brotli code in binaries, not versions: finds copies in #Nodejs, #Python, #dotnet, #Bun and sees #Linux backports. #infosec #K8s #Docker #CVE

#Microsoft released emergency .NET security updates to patch a critical vulnerability known as #Broccoli2Shell, also tracked as #Node2Shell and #HTTP2Shell.

🚀 Sweet’s Virtual Patching blocks Node2Shell exploitation. Orgs 𝐧𝐞𝐞𝐝 𝐚 𝐬𝐚𝐟𝐞𝐭𝐲 𝐧𝐞𝐭 𝐫𝐢𝐠𝐡𝐭 𝐧𝐨𝐰, 𝐬𝐨 𝐰𝐞’𝐫𝐞 𝐨𝐟𝐟𝐞𝐫𝐢𝐧𝐠 𝐢𝐭 𝐭𝐨 𝐀𝐍𝐘𝐎𝐍𝐄 𝐚𝐟𝐟𝐞𝐜𝐭𝐞𝐝 𝐛𝐲 𝐇𝐓𝐓𝐏2𝐒𝐡𝐞𝐥𝐥. For more info: #HTTP2Shell #Node2Shell

Node2Shell: critical Brotli flaw in Node.js (CVE-2026-111497). Update to 22.23.4 / 24.22.1 / 26.12.1. PHP2Shell patches also still needed. CyberRoot: #Node2Shell #PHP2Shell #CyberSecurity

Still seeing questions about PHP2Shell and Node2Shell. Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and Node.js to the latest fixed releases. CyberRoot can help. #PHP2Shell #Node2Shell #CyberSecurity #Leicester

Our CTO @tomerfiliba breaks down how Sweet’s Virtual Patching works to block any exploitation of #Node2Shell. IF you’re affected by or concerned with #HTTP2Shell - Sweet Safety Net puts this protection in your environment for 30 days, at no cost. 🔗

#Node2shell > #Python2shell > #HTML2shell (echale la culpa a #Brotli) vía @Seguinfo #PHP2Shell #Cybersecurity #Ciberseguridad

there is critical risks... and there is microsoft-had-to-release-out-of-band-patches critical risks. #node2shell #http2shell #broccoli2shell #brotli