Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

By Eduard Kovacs

AI Summary

Google's Brotli decoder contains an out-of-bounds write vulnerability (dubbed Node2Shell/HTTP2Shell) that affects Node.js, Microsoft .NET, PowerShell, and Python packages, enabling remote code execution. Microsoft issued emergency .NET patches and PHP rebuilt Windows packages for versions 8.2–8.5 (CVE-2026-111497) within days, while Siemens, Schneider Electric, and ABB confirmed impact on industrial products.

Read full article → https://www.securityweek.com/node2shell-brotli-fla…

Relevance score: 74.0/100

# More from October 26

1
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking The Hacker News
2
PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer
3
PHP2Shell Exploitation Moves From Probes to Working Shells SecurityWeek
4
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs The Hacker News
6
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Hacker News
7
Industrial Vendors Check Products for PHP2Shell Vulnerabilities SecurityWeek
8
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento The Hacker News
9
Popular AI tool LiteLLM says unrevoked key allowed hackers to target users The Record
10
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts The Hacker News