#4
BleepingComputer
general
October 26, 2026 at 16:27 UTC
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
By Bill Toulas
AI Summary
A critical vulnerability dubbed 'HTTP2Shell' in the Brotli C decoder library — built into Node.js and PHP Windows packages — allows memory corruption and potential remote code execution, triggering emergency patches from Microsoft (.NET), PHP (versions 8.2–8.5, tracked as CVE-2026-111497), and CISA adding related flaws to its KEV catalog. The flaw is reachable via the cURL extension when automatic HTTP response decompression is enabled, though exploitation has not yet been confirmed in the wild according to experts.
Relevance score: 78.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →