SecurityOnlinecybernewswire
Sweet Security offers free protection against HTTP2Shell
Part of the CVE-2026-111497 story · since 21 Oct
- Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
- Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
- Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
- Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
- Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
- Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
- Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
- Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
- Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
- Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
- Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
- Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV. This article, 15th of 15.
Sweet Security announced a new, no-cost protection for all organisations affected by HTTP2Shell (CVE-2026-111497). The company’s Sweet Safety Net provides runtime Virtual Patching to block exploitation of Node2Shell at the vulnerable code path for 30 days, regardless of whether organisations are Sweet customers.
The fix at the root cause will take weeks because the Brotli decoder is embedded in runtimes and libraries (including Node.js, Bun, Python, Envoy and Istio, and Go frameworks such as Traefik, Fiber and Iris). While engineers ship a permanent patch, virtual patching stops the attack payload before it reaches the vulnerable code path, allowing legitimate traffic to continue. Sweet notes that the vulnerability remains in the code, but cannot be exploited while the protection is active.
The offer is immediate and open to all organisations; no purchase commitment is required. Sweet says it is already observing exploitation attempts in 88% of monitored environments, with its runtime sensors and L7 detection rules active across customer tenants and exploitation attempts being detected and blocked. The company frames Virtual Patching as a surgical, no-code change, enforcing protection via its Vulnerabilities Catalog and sensor policies, with protection following workloads as they scale or restart. To claim the 30-day protection, organisations are directed to the Sweet Safety Net activation page.
How the story developed
15 articles from 7 outlets since 21 Oct. Still developing; the latest report was 2 hours ago. This was the 15th report, 6 days after the first.
- Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
- Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
- Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
- Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
- Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
- Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
- Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
- Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
- Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
- Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
- Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
- Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV. This article, 15th of 15.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
Show all 15 articles as a listHide the list
- Wed 21 OctDay 01
- Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
Quiet for 2 days
Fri 23 OctDay 21- Node.js Brotli flaw enables remote code execution in Linux arm64 builds08:35 · The Hacker News · Known exploited CVE
- Sat 24 OctDay 31
- Brotli Flaw Enables Code Execution in Unpatched Node.js Builds11:00 · The Hacker News · Known exploited CVE
- Sun 25 OctDay 41
- Mon 26 OctDay 58
- Brotli flaw expands Node2Shell risk across HTTP applications01:30 · SecurityOnline · Known exploited CVE
- Brotli flaw triggers security updates across major software11:00 · SecurityWeek · Known exploited CVE
Show 5 more from 26 Oct
- Microsoft patches critical .NET flaw that risks memory corruption13:30 · Infosecurity · Known exploited CVE
- Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
- PHP releases rebuilt Windows packages to fix Brotli flaw18:30 · The Hacker News · Known exploited CVE
- Node.js Brotli flaw could expose memory or enable remote code execution19:00 · Rapid7 · Known exploited CVE
- Tue 27 OctDay 63
- CISA adds exploited Google Brotli flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE
- Sweet Security offers free protection against HTTP2Shell23:00 · SecurityOnline · Known exploited CVE · This article, 15th of 15