PHP2Shell was last week's fire drill. This week's has three names: Broccoli2Shell, Node2Shell, and HTTP2Shell, all for CVE-2026-111497. I'm going with Broccoli2Shell, because if we have to keep naming bugs "Something2Shell," we might as well have fun with it.
The fun stops there. This one lives in Brotli, Google's compression library, and Brotli is everywhere.
What It Is
Brotli is the compression format your browser and servers use behind the scenes. It's baked into Node.js, Python HTTP libraries, proxies, service meshes, and more.
The bug is an out-of-bounds write in the Brotli C decoder. Per BleepingComputer's writeup, an invalid block switch gets treated as "I need more input" instead of "this data is broken," so the streaming decoder keeps appending bytes past the end of an eight-byte internal buffer. Feed it crafted compressed data and you can crash the process, leak memory, or, according to Node.js, get remote code execution.
Credit: Wiz attributes the discovery to researchers at OpenAI Codex Security, the Node.js fixes to Matteo Collina and Antoine du Hamel, and the exploitation demo to Imperva's Red Team. Patches landed October 21, with public disclosure on October 22.
What's Affected
From Wiz's table and BleepingComputer:
- Google Brotli / libbrotli 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1, 1.2.1.
- Node.js 22, 24, and 26. Fixed in 22.23.4, 24.22.1, 26.12.1.
- Python Brotli and brotlicffi, which affects urllib3, requests, httpx, and aiohttp when they use a vulnerable decoder. Fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0.
- Bun 1.0.21 to 1.4.3. Fixed in 1.4.4.
- Envoy and Istio, with fixed releases on every supported branch.
- Go andybalholm/brotli before v1.2.7.
- Microsoft .NET got an emergency patch.
- PHP shipped Windows builds on October 26 for the cURL extension path, reachable when automatic HTTP response decompression is turned on. It's off by default, but apps can enable it.
Wiz says 91% of the cloud environments it sees have resources vulnerable to this. Their data, their customers, but the direction is clear.
The Good News and the Bad News
Good news: As of the latest reporting, there are no confirmed reports of exploitation in the wild.
Bad news: Proof-of-concept exploits are public. And we just watched PHP2Shell go from disclosure to confirmed attacks in about 48 hours.
Worse news: This bug has two directions. A server that accepts Brotli-compressed requests is exposed. But so is anything that fetches compressed content from somewhere untrusted: your webhook handler, your scraper, your AI agent pulling a URL. Blocking inbound Brotli at the edge doesn't close the second path. And updating the system Brotli package doesn't fix Node.js or anything else that bundles its own copy.
What To Do
- Patch the runtimes first: Node.js, Python Brotli packages, Bun, .NET, PHP on Windows.
- Patch the plumbing: Envoy, Istio, API gateways, anything with a bundled decoder.
- Rebuild and redeploy. Container images, lockfiles, serverless bundles. Then restart, and confirm the patched version is actually what's loaded. A patch on disk that isn't in memory is a patch in theory only.
- Find the hidden decoders. Wiz notes some HTTP clients decompress Brotli automatically, so code that never mentions Brotli can still be exposed. Check transitive dependencies.
- If you can't patch today: disable Brotli decompression or reject Brotli-encoded requests at the proxy, and limit which external sources your services fetch from. That's a stopgap, not a fix.
- Watch for crashes. Unexpected restarts in Node or Python services after weird compressed traffic are worth a look.
The Bigger Picture
One week, two "2Shell" bugs, both in components so deep in the stack that most teams don't know where they all are. That's the real problem. You can't patch what you can't find, and you can't find what's statically linked inside something you bought three years ago.
The answer isn't one product. It's an inventory you trust, fast rebuild pipelines, and fewer services reachable from the internet in the first place. Anything that isn't exposed buys you time. Anything that is exposed is in a race with the people who just downloaded the PoC.
Bottom Line
Broccoli2Shell isn't being exploited yet, which makes this the cheapest week you'll get to fix it. Patch the runtimes, rebuild the images, restart the processes, and go find every copy of Brotli you didn't know you had. Eat your vegetables.
Sources: Wiz on CVE-2026-111497, BleepingComputer, The Register on the .NET emergency fix, and The Hacker News on the PHP Windows builds