Tweet Teratas untuk #NODE2Shell
Many hours later, in the Black October as I was fixing the AI found #PHP2Shell #Node2Shell #HTTP2Shell, I was to remember that distant afternoon when I discovered Shogun 2: fall of the samurai, when the charging samurais facing the machine guns first time in the history.
#CVEALERT CVE-2026-11497 #Node2Shell
"El aviso de seguridad de Node.js, publicado el 21 de octubre de 2026, confirma que la falla puede permitir la ejecución remota de código y afecta a las líneas de lanzamiento 22.x, 24.x y 26.x."
🚨 Node2Shell Node.js RCE Exploit Lets Attackers Execute Malicious Code
Details: https://t.co/IPY97YNfUf
Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js.
The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution and affects the 22.x, 24.x, and 26.x release lines. Fixes are available across all three branches. The code delivered with the compressed data created a marker file that the test application was not instructed to produce.
#CybersecurityNews
@ClassicGamerTWR I agree in general however brotli #PHP2Shell #node2shell et al are not overblown, neither is eMudhra
#Node2Shell: Critical Node.js Vulnerability Enables Remote Code Execution
Imperva researchers have demonstrated how a vulnerability in Node.js’s bundled Brotli decoder can allow attackers to execute arbitrary code through maliciously crafted compressed data.
Key findings:
• Remote Code Execution: CVE-2026-111497 can enable attackers to execute code within vulnerable Node.js application processes.
• Multiple Attack Paths: Exploitation was demonstrated through both compressed HTTP responses processed by Node.js fetch() and incoming Brotli request bodies handled by configured Express middleware.
• Confirmed Impact: Researchers successfully demonstrated code execution using the official Node.js 24.22.0 Linux ARM64 image. The patched version rejected the same malicious inputs.
• Immediate Mitigation: Upgrade affected Node.js deployments to fixed versions: 22.23.4, 24.22.1, or 26.12.1, or newer releases in the respective supported branches.
• Defense in Depth: Review container images, identify applications processing untrusted Brotli data, and consider WAF protections while deploying permanent fixes.
This vulnerability highlights why runtime security and rapid patching are just as important as securing application code. A flaw deep within a runtime can expose otherwise legitimate applications to remote code execution.
#Cybersecurity #NodeJS #ApplicationSecurity #RemoteCodeExecution #VulnerabilityManagement #DevSecOps #InfoSec
https://t.co/A7vNp0Wlay
🚨Node2Shell (CVE-2026-111497): Malicious Brotli input can trigger memory corruption and potential RCE in Node.js.
Patch to 22.23.4, 24.22.1 or 26.12.1 or newer supported versions. Rebuild containers. Verify production.
#NodeJS #Node2Shell #Cyvigilant
por isso que é melhor usar padrões e tecnologias consolidadas: se ainda usássemos só HTTP 0.9 sem request body não teria bug de upload; se ainda usássemos só deflate e gzip não teria bug no brotli
bugs geralmente acontecem quanto tentamos reinventar a roda #php2shell #node2shell
um velho truque apache 🪶 pra proteger o php 🐘 contra o CVE-2026-109618 e o CVE-2026-109619
Patched Node for Node2Shell (CVE-2026-111497)? Don't check process.versions.brotli.
Node fixed its bundled Brotli without bumping it: patched 24.22.1 still says 1.2.0, patched 22.23.4 says 1.1.0.
Trust node --version. npm audit won't catch it either.
#Node2Shell #NodeJS
🚨 #Python packages are vulnerable to RCE via the same #node2shell flaw, CVE-2026-111497.
You may be affected if you use the Brotli library, a very popular dependency (100M downloads/month).
Other major services are likely affected too. #Aikido detects this. Patches available.
I have some hobby projects in scala, node running in a framework with a php dashboard, I spent several evenings updating stuff. as patches come out
not to mention having to do it at work
And i'm afraid this is only the beginning
#php2shell #node2shell #eMudhra
‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js.
Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability.
Read full details ↓ https://t.co/Znn8SGEdBu
#HTTP2Shell や #Node2shell として話題になってる脆弱性について各方面から情報収集しました。
CVSS9.2で、緊急度も高めです。
既に修正バージョンでてるので、昨今の情勢も他踏まえて早めの対策が重要ですm(*_ _)m
https://t.co/fF3Cn4M4NA
#node2shell CVE-2026-111497 が朝起きたら #http2shell に化けていたでござる。
ざっと調べてたけど、週末に緊急対応するほどでもないかなと言う印象。
PythonやApacheなどに影響があるが、標準構成ではBrotliを扱わない設定になっていると思うので。
有識者の皆さん、どうでしょう？
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
#Node2shell CVE-2026-111497-POC
https://t.co/4rhjxpCoC0
Node2Shell: a crafted Brotli stream turns Node.js body-parser and fetch() into a path to RCE. https://t.co/eSQeF1iAru #ThreatIntel #CVE_2026_111497 #Node2Shell #ZLib
Tagar Terakhir Terlihat di Sotwe
minichatt
Dilihat dari United Kingdom
snapchat
firsttimeanal
Dilihat dari United Kingdom
brosis() +video
คนดังtiktokเด็ดๆ
Dilihat dari Thailand
leak
Dilihat dari Saudi Arabia
knotty
beautifullvideos
Dilihat dari United Kingdom
anxiouspandaa()+anxiouspandaa()**+filter:native_video
Dilihat dari Mexico
anal beach
Tren untuk Anda
Pengguna Paling Populer
Elon Musk 
@elonmusk
241.5M pengikut
Barack Obama
@barackobama
118.8M pengikut
Cristiano Ronaldo
@cristiano
114.5M pengikut
Donald J. Trump
@realdonaldtrump
111.8M pengikut
Narendra Modi
@narendramodi
107.1M pengikut
Rihanna
@rihanna
98.7M pengikut
NASA
@nasa
92.3M pengikut
Justin Bieber
@justinbieber
91.8M pengikut
KATY PERRY
@katyperry
90M pengikut
Taylor Swift
@taylorswift13
84M pengikut
Lady Gaga
@ladygaga
75.5M pengikut
Virat Kohli
@imvkohli
73.5M pengikut
Kim Kardashian
@kimkardashian
70.9M pengikut
YouTube
@youtube
68.8M pengikut
Neymar Jr
@neymarjr
66.5M pengikut
Bill Gates
@billgates
65.3M pengikut
Selena Gomez
@selenagomez
63.1M pengikut
The Ellen Show
@theellenshow
62.2M pengikut
CNN
@cnn
61.7M pengikut
X
@x
60.7M pengikut