Mmastodon TechnologyCybersecurity first seen 18 h ago, last 18 h ago, peak #7

New Brotli decoder flaw CVE-2026-111497 rated 9.2

Original: POV: you just finished patching PHP2Shell then node and python get one too broccoli2shell, CVE-2026-111497, CVSS 9.2, an

A new critical vulnerability, CVE-2026-111497 with a CVSS score of 9.2, is drawing attention after reports of an out-of-bounds write in Google's Brotli decoder affecting Node.js and Python Brotli implementations, dubbed 'broccoli2shell'. It follows the recent 'PHP2Shell' flaw, frustrating security teams who had just finished patching that issue. Fixed versions reportedly include Node 22.23.4, 24.22.1, 26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. The bug was reported via OpenAI's Codex security research.

Why now: Security teams are reacting to a second critical remote-code-execution-class decoder bug arriving right after the PHP2Shell patching effort.

GoogleOpenAINode.jsPython Brotlibrotlicffi

Open on mastodon →

Evidence

• POV: you just finished patching PHP2Shell then node and python get one too broccoli2shell, CVE-2026-111497, CVSS 9.2, an out-of-bounds write in google's brotli decoder. reported by openai's codex security node 22.23.4 / 24.22.1 / 26.12.1 python Brotli 1.2.1, brotlicffi 1.2.1.0… · mohith808 · 2

API: https://socialmediatrends-api.osmike.com/v1/trends/3949814