Tag

CVE-2026-111497

5 stories

Critical Brotli Flaw Hits PAN-OS Firewalls — Palo Alto Issues Workarounds and Hotfix Timeline

Palo Alto Networks has confirmed a serious vulnerability in the Brotli compression decoder that affects certain PAN-OS firewall deployments and the Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497 with a CVSS score of 9.2, the flaw can lead to out-of-bounds memory writes that may allow attackers to corrupt memory, expose sensitive data, crash services, or — in some circumstances — execute code without authentication. Palo Alto’s advisory, published…

Saugata DattaOct 27, 20263 min read204

Cybersecurity

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

The PHP project has released updated Windows builds to mitigate a serious flaw known as HTTP2Shell. Announced on October 26, 2026, the new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1; each Windows build now includes an updated Brotli library (1.2.1) that fixes CVE-2026-111497. Administrators running PHP on Windows should treat these updates as urgent and apply them promptly. Release details The "-1" suffix in the version numbers denotes Windows…

Saugata DattaOct 27, 20263 min read211

Cloudflare

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default. What Cloudflare added The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that…

Saugata DattaOct 26, 20263 min read216

Cybersecurity

Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do

A memory-corruption flaw in Google's Brotli decoder (tracked as CVE-2026-111497) has rippled through numerous runtimes and libraries that embed the decoder, creating potential crash, memory-leak, or remote code execution vectors when untrusted Brotli-compressed data is processed. The issue was disclosed on October 21 after fixes began appearing in Node.js and Google’s Brotli source, and researchers from Imperva demonstrated code execution against an unpatched Node.js build. No confirmed in-the-wild exploitation has…

Saugata DattaOct 24, 20264 min read254

Cybersecurity

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…

Saugata DattaOct 23, 20265 min read283

Critical Brotli Flaw Hits PAN-OS Firewalls — Palo Alto Issues Workarounds and Hotfix Timeline

Urgent PHP Windows Builds Patch Critical HTTP2Shell Vulnerability

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Free Tools: IP, DNS, SSL