search
Broccoli2shell
Trends
- 1
A critical vulnerability in the Brotli decompression library, tracked as CVE-2026-111497 and dubbed Broccoli2Shell, is being flagged by security researchers. The flaw affects the Brotli decoder used widely across software and web infrastructure, raising concerns about potential remote code execution. Security firms are publishing analysis and urging organizations to patch affected systems promptly.
- 2
Security researchers have disclosed a critical flaw in the Brotli compression decoder, a library built into countless applications. The bug, dubbed Broccoli2shell by Wiz, enables remote code execution and is not limited to Node.js — it also affects Bun, Python and other widely used software. German outlet Golem.de warns that attacker code execution is possible across numerous applications. Developers are urged to patch dependent runtimes and packages.
- 3Security flaws reported in Brotli decoder libraries●Brotli Decoder Vulnerabilities (Node2Shell, Broccoli2Shell, HTTP2Shell)
Newly disclosed vulnerabilities in Brotli decoder implementations have been given names including Node2Shell, Broccoli2Shell and HTTP2Shell, suggesting the flaws could allow attackers to achieve remote code execution in environments that parse Brotli-compressed data. Brotli is a compression format widely used across web servers, browsers and developer tooling, so affected libraries are broadly deployed. Esri has published an advisory referencing the issues, and security teams are checking whether their products embed vulnerable decoder code.
- 4php2shell and broccoli2shell exploit tools cause widespread IT damage●Wo # php2shell und # broccoli2shell gerade Schneisen der Verwüstung durch die IT-Landschaften ziehen, ist eine gute Gele
The exploit tools php2shell and broccoli2shell are reportedly cutting a swath of devastation through IT landscapes, with security-focused commentators drawing parallels to a classic warning from C.J. Date's 1964 Database Handbook: things initially dismissed as 'only theoretical' have a nasty habit of becoming real problems. The discussion highlights how once-theoretical attack techniques are now being actively weaponised against systems in practice.
- 5New Brotli decoder flaw CVE-2026-111497 rated 9.2●POV: you just finished patching PHP2Shell then node and python get one too broccoli2shell, CVE-2026-111497, CVSS 9.2, an
A new critical vulnerability, CVE-2026-111497 with a CVSS score of 9.2, is drawing attention after reports of an out-of-bounds write in Google's Brotli decoder affecting Node.js and Python Brotli implementations, dubbed 'broccoli2shell'. It follows the recent 'PHP2Shell' flaw, frustrating security teams who had just finished patching that issue. Fixed versions reportedly include Node 22.23.4, 24.22.1, 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The bug was reported via OpenAI's Codex security research.