Home / Oct 27, 2026 / Story
0
#4 BleepingComputer general October 26, 2026 at 16:27 UTC

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

By Bill Toulas

AI Summary

A critical vulnerability dubbed 'HTTP2Shell' in the Brotli C decoder library — built into Node.js and PHP Windows packages — allows memory corruption and potential remote code execution, triggering emergency patches from Microsoft (.NET), PHP (versions 8.2–8.5, tracked as CVE-2026-111497), and CISA adding related flaws to its KEV catalog. The flaw is reachable via the cURL extension when automatic HTTP response decompression is enabled, though exploitation has not yet been confirmed in the wild according to experts.

Relevance score: 78.0/100

# More from October 27

  1. 10
    Bias in Qwen3-Coder Model Schneier on Security