{"active":true,"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","key_points":["NODE2SHELL NOW KEV-LISTED -- CISA added CVE-2026-111497, a critical out-of-bounds write in the Brotli decompression library bundled with Node.js, to its Known Exploited Vulnerabilities catalog on October 27, with a federal patching deadline of November 10.","SAME ATTACKER INFRASTRUCTURE AS PHP2SHELL -- threat-intel firm ELLIO reports its sensors recorded working exploit traffic from IP address 94.154.43.7, the same IP it has tracked running this file's own PHP2Shell exploit attempts and VPN/Kubernetes scanning; ELLIO's claim has not been independently corroborated.","REACH GOES WELL BEYOND NODE.JS -- Google's own Brotli library, not just Node.js, is affected; downstream consumers researchers have confirmed vulnerable include Python packages, .NET, Bun, Envoy, Istio, FFmpeg, Apache Arrow, and ClickHouse.","GOOGLE RATES IT CVSS 9.2 -- Google's own CNA submission to NVD scores the flaw 9.2 (CVSS v4.0); Node.js's own advisory rates it 'high' without publishing a numeric score.","PATCHES SHIPPED OCT 21, SIX DAYS BEFORE KEV -- Node.js 22.23.4/24.22.1/26.12.1 and Brotli 1.0.10/1.1.1/1.2.1 fix the flaw; Node's own end-of-life 20.x/23.x/25.x lines are also vulnerable and will not receive a fix."],"published_at":"2026-10-27T00:00:00Z","source_name":"Help Net Security","summary":"CISA added CVE-2026-111497 -- an out-of-bounds write in Google's Brotli decompression library, bundled inside Node.js and reused across many other runtimes -- to its Known Exploited Vulnerabilities catalog on October 27, giving federal agencies a November 10 deadline. Threat-intelligence firm ELLIO reports its sensors recorded working exploit traffic against the flaw from IP address 94.154.43.7, the same address it has tracked running exploit attempts against this file's own PHP2Shell vulnerabilities and probing Palo Alto GlobalProtect, FortiOS SSL VPN, and Kubernetes APIs; ELLIO's claim has not been independently corroborated by another vendor, and CISA's own KEV entry gives no technical detail beyond confirming exploitation. Google's own CNA submission to NVD rates the flaw CVSS 9.2 (v4.0); Node.js's own security advisory rates it 'high' without publishing a numeric score. The bug is not confined to Node.js: because it lives in the underlying Brotli library itself, researchers have also confirmed it reachable through Python packages, .NET, Bun, Envoy, Istio, FFmpeg, Apache Arrow, and ClickHouse -- any software that decompresses attacker-controlled Brotli data with an unpatched decoder. Node.js shipped fixes (22.23.4, 24.22.1, 26.12.1) on October 21, six days before the KEV listing; the project's own end-of-life 20.x, 23.x, and 25.x lines remain vulnerable with no fix planned. Separately, PHP2Shell's own federal KEV deadline is now two days away (October 29), and Palo Alto Networks continues shipping PAN-OS/Panorama hotfixes for its own confirmed exposure -- both carried in today's daily briefing and threat context.","title":"CISA Adds Node.js/Brotli 'Node2Shell' Flaw to KEV as Exploit Traffic Ties It to PHP2Shell's Own Attacker Infrastructure","url":"https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497/"}