← All stories

Vulnerabilities

Brotli Compression Bug (CVE-2026-111497) Reaches Far Beyond Node.js

By Help Net Security1 min read

A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.

Cover for a vulnerabilities story

A vulnerability in Brotli, Google's widely used open-source compression library, is putting a broad range of software at risk, Help Net Security reported.

Tracked as CVE-2026-111497 — and alternatively dubbed "Node2Shell", "Broccoli2Shell" and "Brotli2Shell" — the flaw is a remotely exploitable out-of-bounds write. It gained widespread attention after Node.js publicly disclosed it on October 21, 2026.

According to the disclosure, an attacker who can supply Brotli-compressed data that an application decompresses using the node:zlib module can corrupt process memory. Depending on conditions, that corruption can lead to a crash or to the disclosure of process memory contents.

Because Brotli is embedded in far more software than just Node.js — the compression algorithm is used widely across applications, libraries and services — the impact of the bug extends well beyond the Node.js ecosystem, the report said. The variety of nicknames the vulnerability has picked up reflects that broad exposure.

The available report excerpt did not include details on affected versions, patches or specific mitigations. Organizations whose software decompresses untrusted Brotli data should monitor advisories from Node.js and the Brotli project for remediation guidance.

Source: Help Net Security

Cover for a vulnerabilities story

Vulnerabilities

Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams

Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Siemens, Schneider Electric, ABB and other industrial vendors have confirmed that some of their products are affected by the PHP2Shell vulnerabilities, SecurityWeek reported. The companies are reviewing their product portfolios to determine their exposure.

1 min read

AI-written summary Source: SecurityWeek · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.