Beacon: Critical Brotli Flaw Broccoli2Shell Triggers Emergency Patches

This story appeared in our weekly cybersecurity newsletter Beacon. Sign up to get weekly updates on the latest news, findings and insights, straight to your inbox every Thursday at 10AM.

Top Story This Week:

Critical Brotli Flaw Broccoli2Shell Triggers Emergency Patches

CISA has confirmed active exploitation of CVE-2026-111497 (CVSS 9.2), the critical Brotli decoder flaw also known as Broccoli2Shell, Node2Shell and HTTP2Shell.

The out-of-bounds write lets a crafted compressed stream crash a process, leak memory or, in some cases, achieve remote code execution. CISA added it to its Known Exploited Vulnerabilities catalog on Tuesday and ordered federal agencies to patch by November 10, while urging all defenders to prioritize it.

The bug sits in Google’s C decoder, so it reaches well beyond Node.js to Python packges, Bun, Envoy, Istio and .NET, which Microsoft patched with an emergency update on Sunday. Palo Alto Networks has confirmed PAN-OS firewalls with TLS decryption and Brotli inspection enabled are affected. A public proof of concept has been available since disclosure, and Wiz data suggests 91% of cloud environments contain vulnerable resources.

Why it Matters

Last week’s PHP2Shell flaws and now Broccoli2Shell show a pattern of critical bugs in components buried across thousands of environments, with exploitation attempts beginning around, or even before, disclosure. Broccoli2Shell had a public proof of concept almost immediately, and CISA confirmed attacks within about a week of the emergency patches.

Brotli is embedded in runtimes, container images, dependencies and firewalls, so static inventories and version scans may not show where it runs, and a patch only counts once processes restart and images are rebuilt.

With the gap between disclosure and exploitation shrinking, defenders need a continuous, outside-in view of what is exposed, so they can fix the services attackers can actually target first, before exploitation begins.

What this Means for Practitioners

Our researchers have released a high fidelity detection logic for node2shell as open-source to help you assess your exposure

Identify exposure to vulnerable Brotli components and prioritize internet-facing services processing untrusted compressed data. Review applications that decompress Brotli-compressed HTTP requests, external HTTP responses, uploaded files or other attacker-controlled content, including indirect and transitive dependencies.

Upgrade affected Brotli libraries, Node.js runtimes, Python packages, Bun, Envoy Proxy and Istio deployments to patched versions or later supported releases. Update container base images and dependency lockfiles, rebuild and redeploy affected images, restart processes and verify patched components are loaded.

If you can’t patch immediately, disable Brotli decompression or reject Brotli-encoded requests before they reach vulnerable components where feasible.

What this Means for Security Leaders

PHP2Shell and Broccoli2Shell are both flaws in widely embedded components, both exploited within days of their respective disclosure and patching windows. AI-assisted research is getting better at finding critical bugs in exactly this kind of software.

Build the capability to be ready for this trend to continue - can your teams say within hours whether you are exposed? That means continuous view of exposure across your entire external attack surface and the processes to rapidly act on that exposure.

Measure the whole loop, from disclosure to assessed exposure to full remediation. Set targets in hours, not weeks, because attackers increasingly move at that speed.

Look towards preemptive security capabilities for continuous outside-in visibility and attacker-view prioritization, with remediation resources and automation that match the pace, so you act on exposure well before a flaw reaches the KEV list.

Discover More

Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/

What happens when a browser's cache removes the very security headers designed to protect a website? Our researchers achieved XSS through Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a Chromium Cache-Control trick that strips Content Security Policy. The same underlying technique could be applied to Netlify Image CDN and S3-backed infrastructure, highlighting a broader security risk in how browsers, caching and content delivery systems interact. See more.

Why Attack Surface Growth Is Outpacing Your Security Team

Ask any CISO how their attack surface has changed in the last three years. The honest answer is always some version of the same thing: it has exploded. The perimeter that once only included a firewall, a datacenter, and a known set of devices no longer exists. In this blog we explore the exponential gap between the expansion of an organization’s attack surface and the limited capacity of its security team to keep pace. See more.

Weekly News Digest

One Compromised Login Exposed Millions of California Students’ Records

According to the California Department of Education, the attackers accessed and copied records between May and September 2026, potentially exposing sensitive information including students’ names, dates of birth, addresses, school details, and disability information. Although no Social Security numbers or financial details were involved, the breach has raised serious concerns about student privacy and data security. ETS has shut down the affected system and is implementing stronger security measures, while affected students are being notified and offered two years of free identity protection services.

Japan's Onamae Desktop Cloud Hacked, up to 27,000 Servers Affected

The incident, confirmed by operator GMO Internet on the 20th of October 2026, prompted the company to shut down its cloud servers to prevent further damage, leaving customers without a confirmed date for service restoration. Although sensitive data stored on affected servers may have been exposed, the company has not confirmed any data leak or misuse, and payment information remains unaffected. Customers have been urged to change potentially compromised passwords and remain alert to phishing attempts as investigations continue.

LiteLLM Supply Chain Attack Hoovers Up Passwords and Secrets

The malicious LiteLLM version (1.107.0) was distributed containing credential-stealing malware and a remote access trojan capable of executing arbitrary code via PyPI and Docker registries. While only available for two hours before being quarantined, the package was downloaded approximately 49,000 times. LiteLLM’s analysis of the attack chain traced the initial compromise back to May, when a master key was committed to a public repository in a configuration file and failed to be revoked. This allowed the attacker to extract a GitHub CLI OAuth token, giving them owner-level access to all repositories.