Sophos's Counter Threat Unit confirmed active exploitation of CVE-2026-111497 — a critical buffer overflow (CVSS 9.2) in Google's Brotli decoder library, widely known as Node2Shell (also marketed as Broccoli2Shell/HTTP2Shell) — warning that any product relying on Brotli implementations is at risk of memory disclosure, denial of service or remote code execution. The flaw, patched in Node.js on 21 October, was added to CISA's KEV catalogue on 27 October, and Microsoft and PHP have published updates to address dependent Brotli builds. This is the same CVE first reported last week as the Brotli decoder flaw behind Node.js RCE affecting Bun, Python and Envoy; today's Sophos analysis converts that into an active-exploitation warning with a concrete remediation list. Organisations should inventory Brotli-linked libraries in web servers, CDNs, browsers and embedded stacks rather than assuming their Node.js patch covered the dependency tree.

• Source article