TECHNO CHATTECH BLOG
Tag

Brotli

4 stories
Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability
Cybersecurity

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly. Release details The "-1" suffix in the version numbers denotes Windows…

Saugata Datta3 min read211
Microsoft’s Emergency .NET Fixes: Brotli Buffer Overflow and Linux Tarball Ownership Vulnerabilities
Cybersecurity

Microsoft’s Emergency .NET Fixes: Brotli Buffer Overflow and Linux Tarball Ownership Vulnerabilities

Microsoft has released out-of-band security updates for .NET to address a critical Brotli decompression buffer overflow and unsafe ownership metadata in Linux .NET tarballs. Published October 25, 2026, the fixes cover .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 and complete remediation for issues that were not fully resolved in the October 13 updates. Microsoft urges administrators and development teams to apply these updates as soon…

Saugata Datta3 min read211
Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw
Cloudflare

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default. What Cloudflare added The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that…

Saugata Datta3 min read216
Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know
Cybersecurity

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…

Saugata Datta5 min read283
🧰

Free Tools: IP, DNS, SSL

40+ free network and other tools in one place. No signup. Click explore or visit https://technochat.in/tools

Explore