Invis

Developer at researcher

[Invis @InvisDeveloper]

Broccoli2Shell (CVE-2026-111497) is a bug in Brotli, a compression library built into Node.js, Python, .NET, web browsers and Apple's operating systems, iPhone and iPad included.

Patches are available across the board. Here's what the bug is and what to update.

What it is
Brotli is the format behind "Content-Encoding: br", widely used to compress web traffic. Its reference decoder (versions 1.0.3 to 1.2.0) has an out-of-bounds write: a specially crafted compressed stream can make it write past the end of a buffer. Depending on the software, that can mean a crash, leaked memory or, in some cases, code execution. So far, code execution has been publicly demonstrated on Node.js.

The fix was committed to Brotli's public repository on February 27 and reached a release on October 21.

Who is exposed
Only software that decompresses Brotli data from a source it doesn't control. Several products, including .NET and Envoy, have that turned off by default.

Mobile devices
Apple ships its own copy of the decoder and patched it on November 9. There are no reports of attacks on Apple devices. On Android, browsers and apps carry their own copies, so the fix arrives through their updates.

What to update
• iPhone and iPad: iOS/iPadOS 27.2.1 or 26.7.3
• Mac: macOS 27.2.1, 26.7.3 or 15.8.3
• Apple Watch and Vision Pro: watchOS 27.2.1, visionOS 27.2.1
• Chrome and Firefox: latest version
• Node.js: 22.23.4, 24.22.1 or 26.12.1
• Bun: 1.4.4
• .NET: 8.0.33, 9.0.22 or 10.0.14
• Python brotli package: 1.2.1
• Brotli itself: 1.0.10, 1.1.1 or 1.2.1

If you run servers, update the runtime, rebuild your container images and restart the processes. Patching the host doesn't fix a library baked into an image.

For context, CISA added the bug to its Known Exploited Vulnerabilities catalog on October 27. If you have updates pending on your phone, laptop or servers, this is a good reason to install them.

[Invis @InvisDeveloper]

@JohnWittle @NathanpmYoung Yeah thats my bad, they updated the requirements. At some point they had a harder process requiring evidence, security work and etc.

[Invis @InvisDeveloper]

@JohnWittle @NathanpmYoung You need to be a security researcher with verified public CVE's or you need to be named large open source project security maintainer.

[Invis @InvisDeveloper]

wp2shell is a WordPress core flaw that lets anyone run code on your server. No login, no plugin, default installs.

It has been exploited since July. If your site runs 6.9.0–7.0.1, update to 6.9.5 or 7.0.2 today.

#WordPress #wp2shell

[Invis @InvisDeveloper]

This month keeps getting worse.

CVE-2026-58115 is a CVSS 10 in Node-RED, and it's idiotically simple: the admin API has no authentication. That's it.

No exploit chain needed. One POST request deploys a flow that runs shell commands with max privileges.

Already exploited!!

[daksh @daksh0x]

banger tshirt idea

[Anthropic @AnthropicAI]

We’ve received notice that the Department of Commerce has lifted export controls on Claude Fable 5 and Mythos 5.

We'll begin restoring access tomorrow, and will share an update soon.

We’re grateful to our users for their patience, and to everyone who worked with us on redeploying the models.