#brotli

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

Oct 26, 2026 // 20:57

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages […]

Critical ‘HTTP2Shell’ Brotli vulnerability triggers emergency patches

Oct 26, 2026 // 19:37

A critical flaw dubbed ‘HTTP2Shell’ in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. The […]

Microsoft releases emergency .NET patches for critical Brotli flaw

Oct 26, 2026 // 18:56

Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity […]

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Oct 24, 2026 // 12:17

A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and […]

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Oct 23, 2026 // 12:03

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their “Node2Shell” proof […]