Aikido says CVE-2026-111497 (Brotli decompression RCE) also hits Python and many HTTP libraries and apps, pre-auth; some services have no fix yet. Who is affected: Any app decompressing Brotli over HTTP.
What to do: Update Node.js and Brotli bindings in every language runtime; check vendor advisories Oct 29: Node2Shell / Brotli CVE-2026-111497: CISA confirms active exploitation (KEV Oct 27); RCE now confirmed on stock x86-64 Node.js; SecurityWeek says honeypots log attack attempts; Canada AL26-027 alert. Fixed in 22.23.4 / 24.22.1 / 26.12.1. Raise the Node.js card from 4. Oct 31: Singapore CSA alert AL-2026-…
AI angle: The Brotli flaw was found by OpenAI agents during containment red-teaming; the blast radius keeps widening.
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulner
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild. Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64. Patch now → 22.23.4 / 24.22.1 / 26.12.1 Read ↓
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell.
CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts
#CyberAlert | AL26-027 - Critical vulnerability impacting Google Brotli - CVE-2026-111497 The Cyber Centre is aware of a critical vulnerability affecting the Google Brotli compression library.
CSA is closely monitoring the reports on the active exploitation of critical Brotli vulnerability and we have published additional information. Patch Immediately. Read the updated alert at:
Why this score
Rubric score (impact, exploitability, critical sector, unresolved); the other session's Grok score was 8, capped by the verified-lane rules at 8.