46 Apache OFBiz vulnerabilities, including pre-auth RCE CVE-2026-68524 and CVE-2026-83542, are fixed in OFBiz 24.09.08. Upgrade now.
Related Posts:
JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA
ChatGPT Lockdown Mode Bypass Exposes Chat Data
Windows Paint RCE CVE-2026-83844 Affects Hundreds of Millions
The post Apache OFBiz 24.09.08 Fixes 46 Vulnerabilities, Including Unauthenticated RCE Flaws appeared first on Daily CyberSecurity.
Rails security update 8.0.5.2 and 8.1.4.1 fixes 21 flaws, including a critical Active Storage file write bug (CVSS 9.8). Rails 8.0 support ends Nov 7.
Related Posts:
SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)
The post Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Includin
SnappyMail RCE chain disclosed with a public proof-of-concept exploit. The auth bypass hit dev builds only; avoid master builds from Oct 22-Nov 4.
Related Posts:
Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)
The post SnappyMail Remote Code Execution Chain Di
Airbyte vulnerability exploited in the wild lets users run code in Connector Builder containers. Upgrade self-managed Airbyte to 2.2.0 now.
Related Posts:
Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
SnappyMail Remote Code Execution Chain Disclosed With Public PoC Exploit Code
PoC Exploit and Technical Details Published for Puppet Server RCE Flaw CVE-2026-115731 (CVSS 9.4)
The post Airbyte Vulnerability Exploited in the Wild Lets Attackers
Executive SummaryOn October 21, 2026, the Node.js project released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with the runtime. Vendors have labeled the vulnerability Node2Shell, Brotli2Shell, Broccoli2Shell, and HTTP2Shell, because the flaw sits in Google's Brotli library and reaches software well beyond Node.js. Any application that decompresses attacker-controlled data with a vulnerable Brotli library could be at risk. Google, as the CVE Nu
On October 21, 2026, the Node.js project released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with the runtime. Vendors have labeled the vulnerability Node2Shell, Brotli2Shell, Broccoli2Shell, and HTTP2Shell, because the flaw sits in Google's Brotli library and reaches software well beyond Node.js. Any application that decompresses attacker-controlled data with a vulnerable Brotli library could be at risk. Google, as the CVE Numbering Authority, scored it 9.2 under CVSS v4.0, and Node.js rates it high.
CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, with a November 10, 2026 deadline for federal civilian agencies. The public telemetry we reviewed shows exploitation attempts against honeypot sensors, and researchers have demonstrated code execution in lab environments. As of October 29, 2026, we are not aware of a public report of a confirmed compromise of a production system.
This report details Node2Shell's mechanism, affected versions, and observed activity, and outlines how SentinelOne customers and partners can strengthen their defenses.
Key Highlights
One flaw, many patches. Node.js, Google Brotli, Bun, .NET, Python, Envoy, Istio, and PHP for Windows each shipped their own fix. Updating one does not update the others.
Attempts are confirmed. Production compromise is not. ELLIO and Previdian have each recorded an exploitation attempt against their honeypot sensors. Previdian notes that such observations do not show the target was vulnerable or that the attempt succeeded.
A default Node.js server is not exposed by itself. Something must hand attacker-controlled Brotli data to the decoder. Node.js names direct node:zlib use. Express 5 request bodies and built-in fetch() responses reach the same decoder, and Imperva reproduced both in the lab.
A failed exploit still costs you. The Node.js advisory lists a crash as an outcome, and Sysdig reports that crashes have been easy to reproduce. Repeated crashes are a denial of service against any service that decodes attacker-influenced Brotli.
The fix was visible for nearly eight months before release. Google committed it on February 27, 2026, with no release and no advisory. End-of-life Node.js 20, 23, and 25 are not expected to receive a fix.
Organizations should take the following steps immediately:
Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1, then restart processes and rebuild container images.
Inventory every other runtime and library that embeds the Brotli decoder, and patch internet-facing services first.
Where patching must wait, reject inbound requests that carry Content-Encoding: br at the proxy or load balancer.
What is Node2Shell
Node2Shell is a memory corruption flaw in the Brotli decoder, the code that expands Brotli-compressed data. A Brotli stream signals switches between block types. When a stream declares only one block type, a switch is invalid and the decoder should reject it. The vulnerable decoder instead reported the invalid switch as a request for more input. The caller supplied more bytes, and the decoder kept appending them to an eight-byte internal buffer and wrote past its end, according to the Node.js advisory.
Node.js lists the outcomes as a crash, disclosure of process memory, or remote code execution, and the CVE record describes the attacker as unauthenticated. Imperva demonstrated code execution on the official Node.js 24.22.0 arm64 image. Microsoft describes the .NET impact as information disclosure, denial of service, or elevation of privilege.
Node2Shell at a Glance
Attribute
Detail
CVE
CVE-2026-111497, also called Brotli2Shell, Broccoli2Shell, and HTTP2Shell
Weakness
Unchecked return value (CWE-252) leading to an out-of-bounds write (CWE-787). No authentication required.
Severity
CVSS v4.0 9.2 (Google, CNA). Node.js: high.
Affected Component
Google Brotli 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, bundled or linked by many products
How Attacker-Controlled Brotli Reaches the Decoder
Path
Condition
Inbound request bodies
Routes that use express.json(), express.urlencoded(), express.text(), or express.raw() in Express 5 or body-parser 2 decompress bodies sent with Content-Encoding: br by default. Any client can send one.
Outbound responses
Built-in fetch() decodes Brotli automatically, so a malicious or compromised server can target the client.
Direct calls
Applications that pass untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().
Disclosure Timeline
Date (2026)
Event
February 27
Google commits the upstream fix with no release and no advisory.
October 21
Node.js discloses CVE-2026-111497. Google releases Brotli 1.0.10, 1.1.1, and 1.2.1.
October 22
Imperva demonstrates code execution on arm64. CVE record is published.
October 25
Microsoft releases out-of-band .NET security updates.
October 27
CISA adds the CVE to the KEV catalog.
Exploitation in the Wild
Exploitation attempts have been recorded, but a successful attack on a production system has not been publicly reported as of October 29, 2026. CISA added CVE-2026-111497 to its KEV catalog on October 27, 2026, with a November 10, 2026 deadline for federal civilian agencies under BOD 26-04.
The public telemetry comes from honeypots. Two threat intelligence providers each recorded an attempt: ELLIO saw a request built for Node.js 24.22.0 on x86-64 on October 26, and Previdian saw one from a U.S.-based address on October 27. Previdian notes that such observations do not show the target was vulnerable or that the attempt succeeded.
Researchers have reproduced code execution only in lab testing. Imperva ran code on the official Node.js 24.22.0 arm64 image through fetch() and Express 5 request bodies, needed multiple attempts, and did not test every Node.js build. Public proof-of-concept code appeared within hours of the October 21 release, according to Sysdig, so organizations should expect further attempts, particularly against internet-facing Express 5 services.
Node.js has fixed every supported release line: 22.x, 24.x, and 26.x. It will not patch end-of-life lines, which the project says are always affected when a security release occurs. Organizations running Node.js 20, 23, or 25 have no patch to apply and must upgrade to a supported line.
Product
Affected Version
Fixed Version
Node.js
22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1
22.23.4, 24.22.1, 26.12.1
Node.js 20, 23, 25
All versions
No fix. Move to a supported line
Google Brotli
1.0.3 through 1.0.9, 1.1.0, 1.2.0
1.0.10, 1.1.1, 1.2.1
Bun
1.0.21 through 1.4.3
1.4.4
Microsoft .NET
8 before 8.0.33, 9 before 9.0.22, 10 before 10.0.14, 11 before RC3. Exposed only where Brotli decompression is in use. .NET Framework is not affected.
8.0.33, 9.0.22, 10.0.14, 11 RC3
PHP for Windows
Builds that bundle Brotli 1.0.3 through 1.2.0
8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1
Python Brotli, brotlicffi
Bundled Brotli 1.0.3 through 1.2.0 (brotlicffi up to 1.2.0.2)
Brotli 1.2.1, brotlicffi 1.2.1.0
Envoy Proxy
1.36.11, 1.37.7, 1.38.5, and 1.39.2
1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0
Istio
1.29.x before 1.29.9, 1.30.x before 1.30.6, 1.31.x before 1.31.2
1.29.9, 1.30.6, 1.31.2
Recommended Mitigations
Patch, Restart, and Rebuild
Upgrade to a fixed Node.js release, update every Dockerfile that pins an older tag, and restart or redeploy every workload.
Confirm patch status from the Node.js release version running in each workload, not a bundled library version string, which may not reflect a backported fix.
Find Every Copy of the Decoder
Inventory Bun, .NET, Python Brotli, Envoy, Istio, PHP for Windows, and statically built executables, including staging, CI, build images, and developer machines.
Where Node.js links the system Brotli library, as it does on Debian, check your distribution’s advisory for the Node.js package as well as brotli. Debian’s tracker lists both.
PHP for Windows fixed the flaw with rebuilt packages that keep the same PHP version number, so php -v looks the same before and after. Check the -1 build suffix or the SHA-256 on the download page.
Move off Node.js 20, 23, and 25 on a defined date.
Reduce Exposure Until Patching Finishes
Reject requests with Content-Encoding: br at the WAF or proxy, or set the body-parser inflate option to false so compressed bodies return HTTP 415. The second option also rejects gzip and deflate bodies, so test client traffic first.
Restrict server-side fetches to trusted destinations. Link previews, webhooks, and crawlers send attacker-influenced URLs into fetch(), and removing br from Accept-Encoding does not stop a hostile server from replying with Brotli.
Enable a vendor WAF rule as a stopgap where one exists. It does not replace the upgrade.
Limit the Blast Radius
Run Node.js services as a non-root user and limit outbound connections from Node.js hosts. Docker runs containers as root by default, and the official node image provides a node user (uid 1000) that you must select with USER or -u.
Watch for Failed Attempts
Alert on repeated worker crashes after requests with Content-Encoding: br. Where core dumps are enabled, restrict who can read them and shorten retention, because a core file can hold memory contents from other users’ sessions.
How SentinelOne Protects You
Node2Shell exploits the Brotli decoder inside the Node.js process. Patching Node.js and every other copy of the Brotli decoder remains the primary control. SentinelOne provides detection and visibility into post-exploitation behavior while that work is underway.
The Singularity agent builds a storyline of process activity on a host, including the Node.js services targeted by Node2Shell. These processes have a predictable life: they answer requests, call APIs, and read files. They do not normally start /bin/sh, run reconnaissance commands, download executables into /tmp, or open connections to arbitrary hosts. Behavioral detection looks for that deviation from normal behavior.
Detection in Singularity AI SIEM
Platform detection content looks at what happens on the host after exploitation, not at the request body.
Attacker Step
Telemetry
Visible Indicators
Code execution in the service
Process creation
Shell processes whose lineage or prior image is node, nodejs, or bun, including an in-place exec, followed by enumeration utilities (id, whoami, uname, hostname) or sensitive file reads
Tooling download
Process creation, File creation
Downloaders (curl, wget, interpreters) fetching to world-writable paths, and executables written and then run from /tmp
Files written by the service
File creation
A Node.js service account writing new executables or scripts outside its normal application paths
Shell and C2
Process creation, IP Connect
Shell processes with a socket as standard input or output, socket-redirection patterns (/dev/tcp, nc, socat), and unexpected outbound connections from Node.js service accounts
Novel child process
First-seen analytics
A Node.js process that starts or becomes a shell or image it has never run in that environment
Correlation rules tie these together. A request to the service, or an outbound fetch to an untrusted host, followed by a process spawn or file drop from the same Node.js process is the shape of a successful chain.
Visibility at the Edge
Sysdig reports that the crash is easy to reproduce, which makes repeated worker crashes and restarts a useful early signal. Web server, WAF, and CDN logs may show requests with Content-Encoding: br followed by bursts of HTTP 5xx responses and unexplained worker restarts. Singularity AI SIEM can ingest those sources alongside endpoint data if you forward them.
Hunt with Purple AI While You Patch
Patching is the only complete fix. While that work runs, analysts can ask Purple AI questions such as:
Show me shell processes whose parent or prior image was node, nodejs, or bun since October 21.
Show me new executable files written by the Node.js service account since October 21.
Show me outbound connections from the Node.js service account to destinations we have never seen.
Show me hosts with a spike in 500 responses followed by a Node.js process restart.
The last question depends on web server logs being ingested.
Confirm Agent Saturation on Node.js Hosts
Confirm the agent is deployed, healthy, and in protect mode on every server and container host that runs Node.js, Bun, or another service that decompresses Brotli. Start with internet-facing Express 5 services and services that fetch external URLs.
Disclaimer
Information contained herein is current as of October 29, 2026, and is subject to change as patch releases and threat activity evolve. Recipients should not rely solely on this report for security decisions and should consult with their security teams and SentinelOne account representatives for current guidance.
Ubuntu puts fixes for CVE-2026-98432, a Linux kernel TCP flaw rated CVSS 9.8, in the proposed pocket for 22.04 LTS and newer. Older releases wait.
Related Posts:
cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
TeamViewer Client Vulnerability Enables Remote Code Execution
7 Unpatched phpMyAdmin Vulnerabilities Exposed
The post Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket appeared first on Daily CyberSecurity.
A high-severity TeamViewer client vulnerability allows compromised remote machines to trigger memory corruption and execute arbitrary code on admin devices.
Related Posts:
Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
7 Unpatched phpMyAdmin Vulnerabilities Exposed
The post TeamViewer Client Vulnerability Enables Remote Code Execution appeared first on Daily CyberSecurity.
A high-severity TeamViewer client vulnerability allows compromised remote machines to trigger memory corruption and execute arbitrary code on admin devices.
The November 2026 Android security update fixes 216 flaws, including zero-click remote code execution bugs CVE-2026-58868 and CVE-2026-58936.
Related Posts:
Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket
cPGuard Supply Chain Attack Pushes Backdoor Through Update Channel
TeamViewer Client Vulnerability Enables Remote Code Execution
The post Android Security Update for November 2026 Fixes 216 Flaws, Including Zero-Click RCE Bugs appeared first on Daily CyberSecurity.
Exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 now has full details and a public Metasploit module. Apply BT26-05-RS now.
Related Posts:
Critical MediaTek Vulnerabilities Patched in Chipsets
Public PoC Exploit Disclosed for Linux Kernel Bonding Vulnerability
Critical FreePBX Vulnerabilities Patched in User Manager
The post BeyondTrust Remote Support Flaw CVE-2026-102764 Exploited in the Wild as Full Details and Metasploit Exploit Go Public appeared first on Daily CyberSecu
Broadcom warns of a VMware SDDC Manager vulnerability, CVE-2026-111497 (CVSS 9.8), from the Node.js Brotli vulnerability. Patches pending.
Related Posts:
Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
The post VMware SDDC Manager Vulnerability CVE-2026-111497 (CVSS 9.8) Awaits a Patch appeared first on D
Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.
Related Posts:
Electrum Wallet Vulnerability Exploits RBF Fee Bumps
Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code
Microsoft Ships Out-of-Band .NET Updates for Brotli Overflow and Linux Tarball Flaws
The post Ruby Fixes Onigmo Regex Bugs Behind Critical GitLab RCE Flaws appeared first on Daily CyberSecurity.
The HTTP2Shell vulnerability expands Node2Shell risks across HTTP stacks, enabling remote code execution via flawed Brotli decompression engines.
Related Posts:
Electrum Wallet Vulnerability Exploits RBF Fee Bumps
Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code
Microsoft Ships Out-of-Band .NET Updates for Brotli Overflow and Linux Tarball Flaws
The post HTTP2Shell Vulnerability Expands Node2Shell Risk appeared first on Daily CyberSecurity.
PHP warns of CVE-2026-115560, a PHP session vulnerability that follows PHP2Shell. Disable session.upload_progress until the next bugfix release.
Related Posts:
Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates
The post PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation appeared first on Daily Cyber
ZDI publicly posted details of unpatched Linux kernel vulnerabilities, including two CVSS 9.0 KSMBD remote code execution flaws. Fixes are pending.
Related Posts:
Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama
PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
The post ZDI Posts Unpatched Linux Kernel Flaw Details and Attack Chains on Public Mailing List appeared first on
Horizon3 released details and a PoC for CVE-2026-106173, a FortiSIEM vulnerability enabling unauthenticated remote code execution. Patch now.
Related Posts:
PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates
The post FortiSIEM Vulnerability Details and PoC Exploit Released for Critical Unauthenticated RCE Flaw appeared
QNAP PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 affect QTS, QuTS hero and apps. No patch yet, so take NAS devices offline.
Related Posts:
cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer
The post QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Of
PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now.
Related Posts:
cPanel Patches PHP2Shell Flaws and WP Toolkit Bug Affecting Shared Hosting Servers
QNAP Warns PHP2Shell Flaws Hit QTS and QuTS hero, Urges Users to Take NAS Offline
Portainer Fixes Two Critical Flaws Letting Standard Users Take Over Docker Hosts
The post PHP2Shell Exploited in the Wild as PoC Exploits and Full Details Go Public appeared first on
Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.
The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.
A CVSS 10.0 E-Business Suite vulnerability, CVE-2026-101809, lets unauthenticated attackers take over Workflow. Oracle fixed 194 EBS flaws.
Related Posts:
Atlassian Patches 176 Flaws in Jira, Confluence and Other Data Center Products
Apache CouchDB 3.5.3 Fixes Six Flaws as Retired Apache Cocoon Gets Four Unpatched Bugs
Oracle Fusion Middleware Vulnerabilities Include Four CVSS 10 Bugs
The post Oracle E-Business Suite Flaw CVE-2026-101809 Scores CVSS 10.0 appeared first on Daily CyberSecurity.
Entrar
