Vulnerabilities
2026-11-03 · 6 d ago
Source: Help Net Security
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
Summary
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that gap matters, and how Sweet…
For more information, read the full story at the original source: Help Net Security ↗