A critical vulnerability in the data compression system is forcing technology companies to release security updates to prevent attacks that could compromise servers and applications. This vulnerability, named HTTP2Shell, affects Brotli—a technology developed by Google and used in various elements of internet infrastructure.
This breach is classified as very serious, with a score of 9.2 on a ten-point scale. It is capable of causing memory corruption, data leakage, service outages, and, under certain circumstances, remote code execution. The latter scenario allows an attacker to execute commands within the vulnerable system.
The issue, identified under the code CVE-2026-111497, is also known as Node2Shell and Broccoli2Shell. Among the software potentially at risk are Node.js, .NET applications, and Python packages using vulnerable versions of the Brotli decoder.
According to TechRadar, many companies and projects have already begun distributing fixes. However, at the time of publication, there was no confirmation that this vulnerability was being exploited in real-world malicious attacks.
The problem has prompted various projects to release security updates. Google updated the Brotli library on October 21st, releasing versions 1.0.10, 1.1.1, and 1.2.1. On the same day, Node.js also released patches. The vulnerability affects the 22.x, 24.x, and 26.x runtime lines used for running JavaScript code outside of browsers.
Over the weekend, Microsoft published an emergency update for .NET. The company warned that successful exploitation could lead to privilege escalation in vulnerable systems. Additionally, Python packages using the decoder received fixes on October 23rd.
TechRadar provided a list of patched versions but emphasized that having these versions does not mean that all systems using these technologies are vulnerable. The risk depends on the installed versions, the libraries used, and how each application processes data. It is also important to remember that some programs contain their own copy of the decoder, so administrators must check dependencies and update the components actually in use.
This race to fix HTTP2Shell draws attention to a broader issue: maintaining the security of digital infrastructure, which relies on numerous components, libraries, and servers that are not always updated regularly.
A recent warning concerning PHP—another widely used technology for building websites—showed how this problem can be exacerbated if maintenance personnel do not apply security patches. Although PHP vulnerabilities differ from HTTP2Shell, both cases illustrate the difficulties of securing systems dependent on software components maintained by different organizations.
According to CNET, the PHP Foundation itself, a non-profit organization supporting the language's security and development, operates with only one full-time employee and about 14 part-time staff, in addition to council volunteers. The organization's CEO, Elizabeth Barron, told Reuters that the demand for security changes in PHP code has increased due to the expansion of threats identified by artificial intelligence (AI), without a corresponding increase in staff.
Awareness among website owners is also a barrier. A study cited by CNET and conducted among 121 small business owners who maintain their own website showed that 45% had never heard of PHP, and 71% did not know whether their site used the technology.
Responsibility for applying fixes varies depending on the infrastructure. Some managed hosting services perform updates for clients, while owners of their own servers must act independently. For regular website visitors, updating a browser or changing passwords will not eliminate a server vulnerability at another organization; protection primarily depends on timely component updates and appropriate security measures taken by application administrators.
The main recommendation is to install available updates for affected components. After patching, processes may need to be restarted and container images rebuilt to ensure that services stop using vulnerable versions.
If an immediate patch cannot be applied, temporary measures exist to reduce risk. For Python applications, a temporary solution is to remove vulnerable Brotli packages and optional dependencies that use them. Administrators can also configure proxies, load balancers, or web application firewalls to block specific requests with Brotli-packed bodies. However, this measure does not provide complete protection for applications receiving malicious responses from other servers and attempting to unpack them. For Node.js, there is no full alternative to updating.
The nickname HTTP2Shell refers to another recent vulnerability known as PHP2Shell, which affected PHP, a language widely used in web development and applications. Both vulnerabilities share a worrying common aspect: under certain conditions, they can pave the way for remote code execution. This makes patching particularly important for organizations running internet-facing systems.
Nevertheless, the vulnerabilities themselves are different and affect different components. Fixing PHP2Shell does not automatically protect the environment from HTTP2Shell, just as updating Brotli does not solve specific PHP issues. In the case of HTTP2Shell, TechRadar mentioned public proof-of-concepts but did not indicate confirmed real-world exploitation. Despite this, the availability of fixes and the potential severity of the problem make checking affected systems a priority. The article 'Falha crítica ameaça sites e pode permitir que hackers executem códigos remotamente' first appeared in Olhar Digital.
