[{"data":1,"prerenderedAt":1299},["ShallowReactive",2],{"post-en-http2shell-brotli-lucke-jenseits-von-node-js":3,"related-en-http2shell-brotli-lucke-jenseits-von-node-js":447},{"id":4,"title":5,"author":6,"body":7,"category":418,"date":419,"description":420,"draft":421,"extension":422,"faq":423,"image":432,"imageAlt":433,"lang":434,"legacyUrl":435,"meta":436,"navigation":437,"path":438,"readingTime":439,"seo":440,"sitemap":441,"stem":442,"tags":443,"translation":445,"updated":435,"__hash__":446},"insightsEn\u002Fen\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js.md","HTTP2Shell: the Brotli flaw reaches far beyond Node.js","blacklens.io Team",{"type":8,"value":9,"toc":406},"minimark",[10,25,30,48,52,55,177,192,196,207,222,229,233,275,287,291,303,311,315,318,386,390,403],[11,12,13,14,18,19,24],"p",{},"On 23 October, Node2Shell became HTTP2Shell – a new name, not a new flaw. It still means ",[15,16,17],"code",{},"CVE-2026-111497"," in the Brotli decoder, whose consequences for Node.js are covered in ",[20,21,23],"a",{"href":22},"\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht","yesterday's post",". What is new is how far the same library reaches: into Python packages, Bun, Envoy, curl and Git for Windows. There it becomes dangerous under one condition that many warnings leave out. The software has to decompress Brotli data from an untrusted source.",[26,27,29],"h2",{"id":28},"what-is-http2shell","What is HTTP2Shell?",[11,31,32,33,35,36,39,40,43,44,47],{},"HTTP2Shell is the name the security firm Aikido gave, on 23 October 2026, to the reach of ",[15,34,17],{}," beyond Node.js: an out-of-bounds write in Google's Brotli decoder, affecting releases 1.0.3 to 1.2.0. The name shifts the focus from the runtime to the protocol. Any software that decompresses Brotli-compressed HTTP data can be affected. The bug, the fix and the corrected releases ",[15,37,38],{},"1.0.10",", ",[15,41,42],{},"1.1.1"," and ",[15,45,46],{},"1.2.1"," are the same as on 21 October. Google itself issued the CVE record.",[26,49,51],{"id":50},"who-is-affected-and-under-which-condition","Who is affected – and under which condition",[11,53,54],{},"Software is affected only if it contains a vulnerable Brotli release and uses it to decompress data an attacker can supply. For most of the projects now being named, exactly that is optional:",[56,57,58,74],"table",{},[59,60,61],"thead",{},[62,63,64,68,71],"tr",{},[65,66,67],"th",{},"Component",[65,69,70],{},"Affected if",[65,72,73],{},"Fix",[75,76,77,100,119,141,163],"tbody",{},[62,78,79,89,92],{},[80,81,82,83,39,86],"td",{},"Python ",[15,84,85],{},"brotli",[15,87,88],{},"brotlicffi",[80,90,91],{},"requests, httpx or aiohttp find them installed",[80,93,94,96,97],{},[15,95,46],{}," or ",[15,98,99],{},"1.2.1.0",[62,101,102,105,114],{},[80,103,104],{},"Bun",[80,106,107,96,110,113],{},[15,108,109],{},"fetch",[15,111,112],{},"node:zlib"," decodes Brotli",[80,115,116],{},[15,117,118],{},"1.4.4",[62,120,121,124,127],{},[80,122,123],{},"Envoy",[80,125,126],{},"the Brotli decompressor is configured",[80,128,129,39,132,39,135,39,138],{},[15,130,131],{},"1.37.8",[15,133,134],{},"1.38.6",[15,136,137],{},"1.39.3",[15,139,140],{},"1.40.0",[62,142,143,146,152],{},[80,144,145],{},"Istio",[80,147,148,149],{},"Brotli decompression is enabled, e.g. via ",[15,150,151],{},"EnvoyFilter",[80,153,154,39,157,39,160],{},[15,155,156],{},"1.29.9",[15,158,159],{},"1.30.6",[15,161,162],{},"1.31.2",[62,164,165,168,174],{},[80,166,167],{},"curl, libcurl",[80,169,170,171],{},"built with Brotli and run with ",[15,172,173],{},"--compressed",[80,175,176],{},"update the Brotli library or the build",[11,178,179,180,183,184,187,188,191],{},"For Python, GitHub published a separate advisory on 22 October, ",[15,181,182],{},"GHSA-9v8h-qqgm-4m35",". The packages often enter an environment as an indirect dependency. Istio shipped the fix on 15 October, before disclosure. Copies built into a program need a new build: Git for Windows ",[15,185,186],{},"2.56.0.windows.3",", released on 22 October, still lists ",[15,189,190],{},"brotli 1.2.0-1"," in its package list.",[26,193,195],{"id":194},"server-and-client-direction-decides","Server and client: direction decides",[11,197,198,199,202,203,206],{},"The flaw works in both directions, and the second is easy to miss. On the server side, an application decompresses Brotli-compressed requests – in Node.js, for example, through the Express 5 parsers. On the client side, it decompresses the response of a server it calls itself. Bun and Node's ",[15,200,201],{},"fetch()"," do this automatically; urllib3, and with it requests, does so based on the response's ",[15,204,205],{},"Content-Encoding",".",[11,208,209,210,213,214,217,218,221],{},"On the client side, an attacker does not need to attack a server. They need to run one. Every feature that fetches an external address is such a route: webhooks, link previews, avatar imports, a ",[15,211,212],{},"git clone"," from an unknown server. A test published by the blog lilting.ch on 24 October shows urllib3 decoding a Brotli response even when the client asked for no compression with ",[15,215,216],{},"Accept-Encoding: identity",". A reverse proxy that rejects requests carrying ",[15,219,220],{},"Content-Encoding: br"," does not protect this direction.",[11,223,224,225,228],{},"Bun's advisory states explicitly that there is no process-wide workaround; individual calls can be protected with ",[15,226,227],{},"decompress: false",". The common web servers, on the other hand, are rarely the route. Apache and nginx compress with Brotli but, according to Aikido, do not decompress by default.",[26,230,232],{"id":231},"version-numbers-do-not-show-the-fix","Version numbers do not show the fix",[11,234,235,236,43,239,242,243,246,247,250,251,254,255,258,259,262,263,266,267,270,271,274],{},"Whether a component contains the fix cannot be read reliably from its Brotli version string. In ",[15,237,238],{},"24.22.1",[15,240,241],{},"26.12.1",", Node.js took over only the fix commit. The version file in its source tree still says ",[15,244,245],{},"1.2.0",", in ",[15,248,249],{},"22.23.4"," it says ",[15,252,253],{},"1.1.0",", and ",[15,256,257],{},"process.versions.brotli"," reports those values. Debian backported the fix: ",[15,260,261],{},"1.0.9-2+deb12u1"," for Bookworm (",[15,264,265],{},"DLA-4855-1",") and ",[15,268,269],{},"1.1.0-2+deb13u1"," for Trixie (",[15,272,273],{},"DSA-6582-1","), both dated 23 October. Anyone comparing only the upstream version will report patched systems as vulnerable.",[11,276,277,278,281,282,286],{},"Then there is the timeline. The fix commit ",[15,279,280],{},"0ed4268"," has been public in the Brotli repository since 27 February 2026, described as \"Detect and report invalid stream earlier.\" A release followed only on 21 October. For almost eight months the correction sat in the source code, but in no release that distributions and package managers ship. It was a silent fix, like Fortinet's recent ",[20,283,285],{"href":284},"\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory","hardening release",", only longer.",[26,288,290],{"id":289},"how-critical-the-flaw-really-is","How critical the flaw really is",[11,292,293,294,298,299,302],{},"The situation has not escalated since 21 October; it has become clearer. It is now known where the decoder sits, and there are still no known attacks. Google rates the flaw ",[20,295,297],{"href":296},"\u002Fen\u002Fwissen\u002Fcvss","CVSS"," 9.2 under version 4.0, but the vector contains ",[15,300,301],{},"AT:P",": a successful attack depends on specific deployment conditions of the system. Others rate it lower. Node.js and Bun call it \"high\", Amazon Linux scores it 8.1 under CVSS 3.1, and Ubuntu gives it priority \"medium\".",[11,304,305,306,310],{},"CISA's assessment in the CVE record reads \"none\" for exploitation and \"no\" for automatable. As of 24 October, the flaw is not in the ",[20,307,309],{"href":308},"\u002Fen\u002Fwissen\u002Fcisa-kev","KEV catalogue",". The only documented code execution remains Imperva's exploit against Node.js, which did not succeed on every attempt. Since 21 October, more than 30 repositories with proofs of concept, test labs and check scripts for the CVE have appeared on GitHub. Whether any of them is a reliable exploit is unknown.",[26,312,314],{"id":313},"what-to-do-now","What to do now",[11,316,317],{},"The work shifts from asking about the version to asking who decompresses untrusted data:",[319,320,321,339,352,358,364,370],"ul",{},[322,323,324,328,329,43,331,333,334,43,336,338],"li",{},[325,326,327],"strong",{},"Check Python environments",", not just the project files. Bring ",[15,330,85],{},[15,332,88],{}," to ",[15,335,46],{},[15,337,99],{},", in container images too.",[322,340,341,344,345,348,349,351],{},[325,342,343],{},"Rebuild embedded copies."," According to Bun, programs built with ",[15,346,347],{},"bun build --compile"," stay vulnerable until rebuilt with ",[15,350,118],{},". The same applies to statically linked curl.",[322,353,354,357],{},[325,355,356],{},"Search proxy configurations."," Envoy and Istio reach the decoder only with an active Brotli decompressor; where one is configured, the update comes first.",[322,359,360,363],{},[325,361,362],{},"Include outbound requests."," Services that fetch user-supplied addresses decompress responses from servers they do not control.",[322,365,366,369],{},[325,367,368],{},"Update distribution packages"," and restart processes. As of 24 October, Ubuntu lists the flaw as \"needs evaluation\" and Amazon Linux 2023 its Brotli package as \"pending fix\". Dynamically linked programs such as curl benefit from the library update without a release of their own.",[322,371,372,375,376,378,379,381,382,385],{},[325,373,374],{},"Check version findings against the fix level."," Brotli ",[15,377,245],{}," in Node ",[15,380,238],{},", or ",[15,383,384],{},"1.0.9"," in Debian Bookworm, is not a finding.",[26,387,389],{"id":388},"what-helps-and-why-visibility-decides","What helps – and why visibility decides",[11,391,392,393,397,398,402],{},"With HTTP2Shell, what matters is less which Brotli version is installed than which systems decompress untrusted data: public APIs, proxies, services that fetch user-supplied addresses. Through ",[20,394,396],{"href":395},"\u002Fen\u002Fplatform\u002Fattack-surface-management","Attack Surface Management",", blacklens.io continuously discovers from the outside which services and web applications are reachable and which technologies, in which versions, run on them. The ",[20,399,401],{"href":400},"\u002Fen\u002Fplatform\u002Femerging-threats","Threat Center"," matches new CVEs against that inventory in real time and shows for each hit whether it rests on the exact version or only on the product.",[11,404,405],{},"The limit is narrower here than with Node2Shell. The CVE record names only Brotli as the affected product, a library that no service displays to the outside. What can be recognised are its carriers, such as Node.js applications and proxies. A Brotli package in a Python environment or a compiled program is found only by a check on the system. From the outside, you can narrow down where that check is needed first.",{"title":407,"searchDepth":408,"depth":408,"links":409},"",3,[410,412,413,414,415,416,417],{"id":28,"depth":411,"text":29},2,{"id":50,"depth":411,"text":51},{"id":194,"depth":411,"text":195},{"id":231,"depth":411,"text":232},{"id":289,"depth":411,"text":290},{"id":313,"depth":411,"text":314},{"id":388,"depth":411,"text":389},"threat","2026-10-24","HTTP2Shell is not a new flaw but CVE-2026-111497 in any software with a Brotli decoder. Who is affected, and why the version number misleads.",false,"md",[424,426,429],{"q":29,"a":425},"HTTP2Shell is a name for CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder in releases 1.0.3 to 1.2.0. The security firm Aikido introduced it on 23 October 2026 because the flaw affects not only Node.js, where it became known as Node2Shell, but also Python packages, Bun, Envoy and curl. It is the same vulnerability with the same fixes: Brotli 1.0.10, 1.1.1 and 1.2.1.",{"q":427,"a":428},"Are Python requests and httpx affected by HTTP2Shell?","Python requests and httpx are affected only if the same environment has the brotli package before 1.2.1 or brotlicffi before 1.2.1.0 installed. Neither ships its own Brotli decoder; both use these packages as soon as they are present, in httpx's case for example through the httpx[brotli] extra. They then decode Brotli responses from the servers they call automatically. Whether the packages are installed is shown by the environment itself, not by the project's dependency list.",{"q":430,"a":431},"How does blacklens.io help with HTTP2Shell?","blacklens.io continuously discovers from the outside, through Attack Surface Management, which services, web applications and technologies are reachable, and the Threat Center matches new CVEs against that inventory in real time, stating for each hit whether it rests on the exact version or only on the product. For HTTP2Shell this shows where carriers such as Node.js applications and proxies are reachable. The Brotli library itself is not visible from the outside and is checked on the system.","\u002Fimages\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js.webp","A person at a laptop with their head in their hands, behind a world map of red dots covered in warning symbols","en",null,{},true,"\u002Fen\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js",5,{"title":5,"description":420},{"loc":438},"en\u002Finsights\u002Fhttp2shell-brotli-lucke-jenseits-von-node-js",[444],"Threat landscape","http2shell-brotli-lucke-jenseits-von-node-js","QM7BlnvG1GTFBh9srilBTou1foA7VuZNEjggsveJJ0w",[448,804,1071],{"id":449,"title":450,"author":6,"body":451,"category":418,"date":783,"description":784,"draft":421,"extension":422,"faq":785,"image":795,"imageAlt":796,"lang":434,"legacyUrl":435,"meta":797,"navigation":437,"path":22,"readingTime":439,"seo":798,"sitemap":799,"stem":800,"tags":801,"translation":802,"updated":419,"__hash__":803},"insightsEn\u002Fen\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.md","Node2Shell: why patching Node alone is not enough",{"type":8,"value":452,"toc":775},[453,459,463,472,484,488,499,509,513,522,568,581,585,621,700,702,705,756,758,772],[11,454,455,456,458],{},"Node.js published security updates for ten vulnerabilities on 21 October 2026. The most severe, ",[15,457,17],{},", allows remote code execution through crafted Brotli data. But the faulty code is not in Node.js. It is in the compression library Node.js bundles – and that decides whether an updated Node version closes the hole at all.",[26,460,462],{"id":461},"what-node2shell-is","What Node2Shell is",[11,464,465,466,468,469,471],{},"Node2Shell is the name Imperva gave its 22 October analysis of ",[15,467,17],{},": an out-of-bounds write in the Brotli decoder that Node.js bundles in its 22.x, 24.x and 26.x lines. Node.js rates the flaw \"high\" and fixed it on 21 October. The CVE record is harsher: ",[20,470,297],{"href":296}," 9.2 under version 4.0, severity critical. Khai Tran and Sylvie Mayer of OpenAI Codex Security reported it; two members of the Node.js team wrote the fix.",[11,473,474,475,479,480,206],{},"The flaw landed on the same day as ",[20,476,478],{"href":477},"\u002Fen\u002Finsights\u002Fphp2shell-kritische-rce-lucken-in-php","PHP2Shell",", with the same score. Who reported them is worth noting: OpenAI researchers were among the reporters at PHP, and here it is that company's Codex Security team. The advisories do not say how much of this came from AI tooling – but AI vendors' security teams appearing in the acknowledgements has been routine since ",[20,481,483],{"href":482},"\u002Fen\u002Finsights\u002Fclaude-mythos-wenn-schwachstellen-schneller-kommen-als-patches","April",[26,485,487],{"id":486},"the-bug-is-in-brotli-not-in-nodejs","The bug is in Brotli, not in Node.js",[11,489,490,491,494,495,498],{},"The vulnerable code sits in the reference implementation of Brotli, Google's compression format, in ",[15,492,493],{},"c\u002Fdec\u002Fdecode.c",". While decompressing, the decoder checks whether a stream switches to a different block type. When that check reported an error, the responsible function did not pass it on along the fast decoding path: its callers had no return value for it. The decoder carried on with invalid internal state and wrote past its intended buffer. The CVE record files this as ",[15,496,497],{},"CWE-252",", unchecked return value. The fix makes those functions return a format error and aborts the stream.",[11,500,501,502,39,504,43,506,508],{},"What matters for the reach is the version range in the CVE record: Brotli releases 1.0.3 through 1.2.0 are affected \"on all platforms\", and what needs updating is \"any Brotli libraries or binaries\". The fixed releases are ",[15,503,38],{},[15,505,42],{},[15,507,46],{},", all published on 21 October. Node.js is the best-known consumer of that library, not the only one.",[26,510,512],{"id":511},"the-decoder-is-reachable-without-brotli-in-your-code","The decoder is reachable without Brotli in your code",[11,514,515,516,518,519,521],{},"An application does not have to call Brotli anywhere to reach the decoder. Imperva names three routes in: a direct call through ",[15,517,112],{},", Node's built-in ",[15,520,201],{},", which decompresses a Brotli response by itself, and the request parsers in Express 5.",[11,523,524,525,39,528,39,531,43,534,537,538,540,541,39,544,39,547,43,550,553,554,557,558,561,562,564,565,567],{},"The third route widens the attack surface most. The Express 5 migration guide lists Brotli decompression as an improvement that needs no migration step: ",[15,526,527],{},"express.json()",[15,529,530],{},"express.urlencoded()",[15,532,533],{},"express.text()",[15,535,536],{},"express.raw()"," accept ",[15,539,220],{},". body-parser documents that all parsers support \"automatic inflation\" of ",[15,542,543],{},"gzip",[15,545,546],{},"br",[15,548,549],{},"deflate",[15,551,552],{},"zstd","; the only option documented for it is ",[15,555,556],{},"inflate",", default ",[15,559,560],{},"true",". No switch for Brotli alone is documented. An application using ",[15,563,527],{}," that does not turn ",[15,566,556],{}," off therefore accepts Brotli bodies without that being visible in its own code. A bare HTTP server in Node, by contrast, does not decode incoming Brotli bodies merely by receiving them.",[11,569,570,571,574,575,577,578,206],{},"Imperva took this route to code execution: in the official Node image ",[15,572,573],{},"24.22.0"," for Linux\u002Farm64, a Brotli message created a file the test application had no code to create – with no debugger, but not on every attempt. ",[15,576,238],{}," rejected the same inputs. That is the only public demonstration so far. Neither Node.js nor Imperva reports attacks in the wild, and as of 23 October the flaw is not in the ",[20,579,580],{"href":308},"CISA KEV catalogue",[26,582,584],{"id":583},"why-a-patched-node-version-is-not-enough","Why a patched Node version is not enough",[11,586,587,588,591,592,594,595,598,599,601,602,604,605,608,609,262,611,266,613,270,615,617,618,206],{},"Whether ",[15,589,590],{},"node -v"," shows a corrected release settles the question only where Node uses its own Brotli code. Debian's package does not. Its security tracker notes on ",[15,593,17],{}," that ",[15,596,597],{},"nodejs"," uses the system-provided Brotli library, and lists both packages accordingly: ",[15,600,85],{}," as \"vulnerable\" and ",[15,603,597],{}," at urgency \"unimportant\". On those systems only the Brotli package closes the hole. When this post was published on the morning of 23 October, it was not available there. ",[325,606,607],{},"Update of 24 October:"," later that day Debian shipped ",[15,610,261],{},[15,612,265],{},[15,614,269],{},[15,616,273],{},"); the fix for Sid is still pending. How far the same flaw reaches beyond Node.js is covered in the follow-up on ",[20,619,620],{"href":438},"HTTP2Shell",[56,622,623,635],{},[59,624,625],{},[62,626,627,629,632],{},[65,628,67],{},[65,630,631],{},"Fixed release",[65,633,634],{},"Note",[75,636,637,649,661,673,684],{},[62,638,639,642,646],{},[80,640,641],{},"Node.js 26.x",[80,643,644],{},[15,645,241],{},[80,647,648],{},"current line",[62,650,651,654,658],{},[80,652,653],{},"Node.js 24.x",[80,655,656],{},[15,657,238],{},[80,659,660],{},"current LTS",[62,662,663,666,670],{},[80,664,665],{},"Node.js 22.x",[80,667,668],{},[15,669,249],{},[80,671,672],{},"LTS",[62,674,675,678,681],{},[80,676,677],{},"Node.js 20.x and older",[80,679,680],{},"no fix",[80,682,683],{},"end of life, always affected per the advisory",[62,685,686,689,697],{},[80,687,688],{},"Brotli library",[80,690,691,39,693,39,695],{},[15,692,38],{},[15,694,42],{},[15,696,46],{},[80,698,699],{},"decisive where Node uses the system library",[26,701,314],{"id":313},[11,703,704],{},"These steps differ from an ordinary update in one respect: the Node version alone does not decide the exposure.",[319,706,707,713,723,729,744,750],{},[322,708,709,712],{},[325,710,711],{},"Update the runtimes"," and restart the processes afterwards. A running process keeps the old decoder in memory.",[322,714,715,718,719,722],{},[325,716,717],{},"Check the Brotli library as well"," wherever Node comes from a distribution package. There, ",[15,720,721],{},"libbrotli"," is the binding version, not Node's.",[322,724,725,728],{},[325,726,727],{},"Check every image individually",", not just the host. Version numbers go stale fastest in container images and appliances with a built-in runtime; a host package list does not show them.",[322,730,731,734,735,738,739,43,741,743],{},[325,732,733],{},"Limit Brotli traffic from unknown sources"," while the update waits. ",[15,736,737],{},"inflate: false"," rejects ",[15,740,543],{},[15,742,549],{}," too and may break existing clients; a limit on the affected paths, at the web server or in the web application firewall, is the narrower cut.",[322,745,746,749],{},[325,747,748],{},"Do not lose sight of the other nine flaws."," The 21 October release fixes ten CVEs, three more of them rated \"high\": truncated DNS names containing a NUL character, and two bypasses of the TLS hostname check.",[322,751,752,755],{},[325,753,754],{},"Do not read decoder errors as proof."," Crashed processes and decoder errors on their own are not a reliable sign of an attack, as Imperva points out. They carry weight only together with the release actually deployed and the origin of the compressed data.",[26,757,389],{"id":388},[11,759,760,761,763,764,768,769,771],{},"The question on the day of an update like this is not how to update Node.js, but where a runtime is running at all. Through ",[20,762,396],{"href":395},", blacklens.io continuously discovers from the outside which services and web applications are reachable and which technologies, in which versions, run on them; internal systems are covered by the ",[20,765,767],{"href":766},"\u002Fen\u002Fplatform\u002Fsentry","Sentry Agent",". The ",[20,770,401],{"href":400}," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product.",[11,773,774],{},"One limit belongs in the picture: which Brotli library a Node process has loaded is not something any service reveals from the outside. That check stays on the system – which systems it applies to can be answered beforehand.",{"title":407,"searchDepth":408,"depth":408,"links":776},[777,778,779,780,781,782],{"id":461,"depth":411,"text":462},{"id":486,"depth":411,"text":487},{"id":511,"depth":411,"text":512},{"id":583,"depth":411,"text":584},{"id":313,"depth":411,"text":314},{"id":388,"depth":411,"text":389},"2026-10-23","Node2Shell exploits a flaw in the Brotli decoder that Node.js bundles. The fix ships in Node 22.23.4, 24.22.1 and 26.12.1 – and in Brotli itself.",[786,789,792],{"q":787,"a":788},"What is Node2Shell?","Node2Shell is the name the security firm Imperva gave its analysis of CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. An attacker who can send crafted Brotli data to an application that decompresses it can overwrite memory and, in the end, run their own code. Node.js fixed the flaw on 21 October 2026; the CVE record rates it CVSS 9.2 under version 4.0.",{"q":790,"a":791},"Which versions close CVE-2026-111497?","Node.js ships the fix in 22.23.4, 24.22.1 and 26.12.1; the 20.x line and older are end of life and will not receive it. The faulty code comes from the Brotli library, however, which is fixed in 1.0.10, 1.1.1 and 1.2.1. Where Node uses the system Brotli library, as the Debian package does, that library's version decides the matter, not the output of node -v.",{"q":793,"a":794},"Is my application affected if it does not use Brotli?","Possibly, yes. The decoder is also reached without Brotli appearing anywhere in your own source. Node's built-in fetch() decompresses Brotli responses by itself, and the request parsers in Express 5 and body-parser 2 accept Brotli bodies as long as the inflate option sits at its default of true. A bare Node HTTP server, according to Imperva, does not decode incoming Brotli bodies merely by receiving them.","\u002Fimages\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht.webp","Brightly coloured lines of source code on a dark screen, photographed at an angle",{},{"title":450,"description":784},{"loc":22},"en\u002Finsights\u002Fnode2shell-warum-node-patchen-nicht-reicht",[444],"node2shell-warum-node-patchen-nicht-reicht","4v3d9D542yTKcAPksT30uUYA4p9-Nducsghmqi7awZs",{"id":805,"title":806,"author":6,"body":807,"category":418,"date":1050,"description":1051,"draft":421,"extension":422,"faq":1052,"image":1062,"imageAlt":1063,"lang":434,"legacyUrl":435,"meta":1064,"navigation":437,"path":284,"readingTime":439,"seo":1065,"sitemap":1066,"stem":1067,"tags":1068,"translation":1069,"updated":435,"__hash__":1070},"insightsEn\u002Fen\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.md","Fortinet hardening release: patching without an advisory",{"type":8,"value":808,"toc":1041},[809,812,816,826,901,920,924,927,940,944,950,953,957,960,968,970,973,999,1002,1006,1021,1023,1035],[11,810,811],{},"Fortinet is shipping security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, a day after FortiMail and FortiAuthenticator. Rated critical and high severity — but with no CVE id, no CVSS score and no description of the attack. The advisories only follow on 10 November. Anyone patching this week is closing holes they cannot name.",[26,813,815],{"id":814},"what-fortinet-shipped-on-22-october","What Fortinet shipped on 22 October",[11,817,818,819,825],{},"The security hardening release is a bundled set of security updates for five product lines, announced on 21 October 2026 by Fortinet CISO Carl Windsor on ",[20,820,824],{"href":821,"rel":822},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Ffortinet-releases-security-hardening-release-for-multiple-products",[823],"nofollow","Fortinet's CISO blog",". On the contents, one sentence: \"These releases include critical and high-severity fixes.\"",[56,827,828,841],{},[59,829,830],{},[62,831,832,835,838],{},[65,833,834],{},"Branch",[65,836,837],{},"FortiOS",[65,839,840],{},"FortiManager and FortiAnalyzer",[75,842,843,857,871,886],{},[62,844,845,848,853],{},[80,846,847],{},"8.0",[80,849,850],{},[15,851,852],{},"8.0.2",[80,854,855],{},[15,856,852],{},[62,858,859,862,867],{},[80,860,861],{},"7.6",[80,863,864],{},[15,865,866],{},"7.6.8",[80,868,869],{},[15,870,866],{},[62,872,873,876,881],{},[80,874,875],{},"7.4",[80,877,878],{},[15,879,880],{},"7.4.13",[80,882,883],{},[15,884,885],{},"7.4.12",[62,887,888,891,896],{},[80,889,890],{},"7.2",[80,892,893],{},[15,894,895],{},"7.2.14",[80,897,898],{},[15,899,900],{},"7.2.13",[11,902,903,904,39,906,43,909,912,913,43,916,919],{},"Everything below each fixed version is affected. FortiMail is fixed in ",[15,905,852],{},[15,907,908],{},"7.6.7",[15,910,911],{},"7.4.9",", FortiAuthenticator in ",[15,914,915],{},"8.0.4",[15,917,918],{},"6.6.11","; FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself, while FortiManager Cloud may need a manual step.",[26,921,923],{"id":922},"why-there-are-no-cve-ids","Why there are no CVE ids",[11,925,926],{},"The advisories only appear at the next Patch Tuesday, 10 November, on the advisory page of Fortinet's Product Security Incident Response Team — part of an \"ongoing commitment to responsible transparency while balancing customer security\".",[11,928,929,930,935,936,939],{},"The origin of the flaws explains the bundling: not outside researchers, but Fortinet's own AI-assisted testing programme, with thanks to Anthropic, OpenAI, Google and SpaceX for the collaboration. Windsor ",[20,931,934],{"href":932,"rel":933},"https:\u002F\u002Fwww.fortinet.com\u002Fblog\u002Fciso-collective\u002Fupdate-on-fortinet-use-of-frontier-ai",[823],"described the process in June 2026",": frontier models review the source code against a threat model of the firmware built beforehand; what survives is validated in penetration testing. Of the source-code findings from more than 100 tests across 30 product families, 40 per cent were true positives and 30 per cent false positives. What ",[20,937,938],{"href":482},"Claude Mythos"," sketched out in April now arrives as a firmware update.",[26,941,943],{"id":942},"a-patch-without-a-cve-id-is-invisible-to-scanners-and-policies","A patch without a CVE id is invisible to scanners and policies",[11,945,946,947,949],{},"Vulnerability scanners, patch policies and ticket systems all work from CVE ids. Without the id, everything attached to it is missing too: no NVD entry, no EPSS score, no entry in the ",[20,948,580],{"href":308},", no CVSS score for a patch policy to trigger on. A change request that normally draws its justification from a CVE id and a severity rating has nothing but the vendor announcement for 19 days.",[11,951,952],{},"The question shifts: no longer which CVE affects us, but which version runs on which reachable device, and whether it is older than the fixed one. The risk assessment loses its basis too: nothing can be said about attack prerequisites or exploitability before 10 November. What remains is reachability from outside: a FortiManager sitting on the internet is the problem, with or without a CVE id.",[26,954,956],{"id":955},"patch-diffing-the-clock-starts-at-release","Patch diffing: the clock starts at release",[11,958,959],{},"The head start withholding the advisories is meant to create applies only to readers, not to attackers who compare. Fortinet names the risk itself: once the update is public, the fix shows where the code changed. Per the June post, this is exactly what the models excel at — \"analyzing firmware, assessing changes between versions, and developing proof-of-concept exploits\". Fortinet expects exploits in hours or days rather than weeks; the FortiGuard 2026 report puts time to exploit for critical outbreaks at 24 to 48 hours, down from 4.76 days on average in 2024.",[11,961,962,963,967],{},"That Fortinet devices are a preferred target is on record: the CISA KEV catalogue held 32 entries for Fortinet products as of 21 October 2026, two of them added this month. ",[20,964,966],{"href":965},"\u002Fen\u002Finsights\u002Ffortibleed-wenn-zehntausende-firewalls-zur-offenen-tur-werden","FortiBleed"," showed how methodically attackers work through exposed management interfaces. No exploitation is known for the flaws in this release; Fortinet calls the fixes pre-emptive.",[26,969,314],{"id":313},[11,971,972],{},"Fortinet recommends treating the release as a priority change rather than routine maintenance, and names four steps:",[319,974,975,981,987,993],{},[322,976,977,980],{},[325,978,979],{},"Inventory:"," identify every FortiManager installation and FortiOS instance, internet-facing ones first.",[322,982,983,986],{},[325,984,985],{},"Maintenance windows:"," schedule 22 and 23 October for exposed systems.",[322,988,989,992],{},[325,990,991],{},"Back up configurations:"," before the upgrade, not after.",[322,994,995,998],{},[325,996,997],{},"Check logs:"," for unusual administrative access and unapproved configuration changes, before and after patching.",[11,1000,1001],{},"Where an immediate upgrade is not possible: restrict management access over HTTPS and SSH to trusted addresses, keep FortiManager off the internet entirely, and enforce MFA on every administrator account. Fortinet on that: \"These steps reduce risk but do not replace the need for a timely upgrade.\"",[26,1003,1005],{"id":1004},"not-to-be-confused-php2shell-runs-in-parallel","Not to be confused: PHP2Shell runs in parallel",[11,1007,1008,1009,1012,1013,1016,1017,1020],{},"The two PHP flaws from 21 October are not part of this release. Fortinet tracks them separately in advisory ",[15,1010,1011],{},"FG-IR-26-186"," and rates ",[15,1014,1015],{},"CVE-2026-109618"," critical at CVSS 9.8 there. According to an overview by Help Net Security on 22 October, Fortinet lists twelve products as not affected, among them FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiWeb, and twelve more as under review. Palo Alto Networks reports PAN-OS and Panorama as affected in all versions, still without a fix. Mechanism and immediate measures are in our ",[20,1018,1019],{"href":477},"PHP2Shell post",". Fortinet operators are running two separate patch tracks.",[26,1022,389],{"id":388},[11,1024,1025,1026,1028,1029,1031,1032,1034],{},"As long as the CVE ids are missing, the version inventory is the only solid basis. Through ",[20,1027,396],{"href":395},", blacklens.io records from the outside which services are reachable and which technologies run on them in which version; the inventory filters by vendor and product, and the ",[20,1030,767],{"href":766}," covers internal installations. That answers the question that matters this week: where is a version older than ",[15,1033,866],{}," running, and is it reachable from the internet?",[11,1036,1037,1038,1040],{},"The ",[20,1039,401],{"href":400}," matches new CVEs against that inventory in real time and shows whether a hit rests on the exact version or only on the product — for this release that starts on 10 November, because before then there are no ids to match. This week the release is an inventory question. The vulnerability question arrives in November.",{"title":407,"searchDepth":408,"depth":408,"links":1042},[1043,1044,1045,1046,1047,1048,1049],{"id":814,"depth":411,"text":815},{"id":922,"depth":411,"text":923},{"id":942,"depth":411,"text":943},{"id":955,"depth":411,"text":956},{"id":313,"depth":411,"text":314},{"id":1004,"depth":411,"text":1005},{"id":388,"depth":411,"text":389},"2026-10-22","Fortinet shipped critical fixes for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026. The advisories with CVE ids only follow on 10 November.",[1053,1056,1059],{"q":1054,"a":1055},"What is Fortinet's October 2026 security hardening release?","The security hardening release is a bundled set of security updates that Fortinet shipped on 21 and 22 October 2026 for FortiMail, FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer. Fortinet rates the fixed flaws critical and high severity, but publishes no CVE ids, no CVSS scores and no attack prerequisites for now. The advisories are announced for 10 November 2026. The flaws came out of Fortinet's own AI-assisted testing programme.",{"q":1057,"a":1058},"Which Fortinet versions fix the vulnerabilities?","According to Fortinet's announcement the fixes ship in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and in FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. FortiMail is fixed in 8.0.2, 7.6.7 and 7.4.9, FortiAuthenticator in 8.0.4 and 6.6.11. FortiMail 7.2 gets no fix and has to move to the 7.4 branch. Fortinet updates FortiSASE itself; FortiManager Cloud may need a manual step.",{"q":1060,"a":1061},"Why is a patch without a CVE id a problem for vulnerability scanners?","A patch without a CVE id stays invisible to everything that steers vulnerabilities by CVE id: vulnerability scanners, patch policies, ticket systems. Without the id there is no NVD entry, no EPSS score, no CISA KEV status and no CVSS score for a patch policy to trigger on. Until the advisories appear, only the version comparison is left: which Fortinet version runs on which reachable system? A continuously updated technology inventory answers that question.","\u002Fimages\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory.webp","Tablet showing the Fortinet website in front of a blurred monitor displaying source code",{},{"title":806,"description":1051},{"loc":284},"en\u002Finsights\u002Ffortinet-hardening-release-patchen-ohne-advisory",[444],"fortinet-hardening-release-patchen-ohne-advisory","QyzVByPDaT-j8SlgBQrV6xv8fCW8Qn5_n4hTJ6WGhm8",{"id":1072,"title":1073,"author":6,"body":1074,"category":418,"date":1050,"description":1278,"draft":421,"extension":422,"faq":1279,"image":1289,"imageAlt":1290,"lang":434,"legacyUrl":435,"meta":1291,"navigation":437,"path":1292,"readingTime":439,"seo":1293,"sitemap":1294,"stem":1295,"tags":1296,"translation":1297,"updated":435,"__hash__":1298},"insightsEn\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch.md","PHP2Shell: the attacks began four days before the patch",{"type":8,"value":1075,"toc":1271},[1076,1079,1083,1092,1097,1101,1110,1172,1175,1179,1182,1188,1192,1195,1242,1251,1254,1257,1260],[11,1077,1078],{},"Four days before PHP disclosed the two flaws, the first exploitation attempt was running. Amazon Threat Intelligence found it in the telemetry of its MadPot honeypot network, dated 17 October 2026. Close PHP2Shell the moment the version number is right and you have checked four days too few.",[26,1080,1082],{"id":1081},"what-amazon-saw-before-disclosure","What Amazon saw before disclosure",[11,1084,1085,1086,1091],{},"Amazon Threat Intelligence published on 21 October that the earliest PHP2Shell exploitation attempt in its ",[20,1087,1090],{"href":1088,"rel":1089},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Famazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot\u002F",[823],"MadPot telemetry"," dates to 17 October 2026 — four days before disclosure, three days before the leak. The request came from a commercial anonymisation network and hit a honeypot, which Amazon reads as a sign of a threat actor rather than research. How the actor obtained exploit information beforehand is unclear.",[11,1093,1094,1095,206],{},"From 02:00 UTC on 21 October, twelve hours before the 14:00 UTC release, MadPot saw several proof-of-concept exploits from further anonymised infrastructure. Payloads and origins differed, which points to several independent actors; whether any would have worked against real systems is left open. CJ Moses, CISO of Amazon Integrated Security, sums up the state after the release: \"PHP2Shell is now being broadly exploited in the wild.\" Mechanism, fixed versions and interim measures are in ",[20,1096,23],{"href":477},[26,1098,1100],{"id":1099},"how-exploits-arrived-before-the-patch","How exploits arrived before the patch",[11,1102,1103,1104,1109],{},"17 October remains unexplained. The twelve hours before the release do not. The PHP Foundation laid out that chain in its ",[20,1105,1108],{"href":1106,"rel":1107},"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F",[823],"postmortem of 21 October",":",[56,1111,1112,1122],{},[59,1113,1114],{},[62,1115,1116,1119],{},[65,1117,1118],{},"Time (UTC)",[65,1120,1121],{},"Event",[75,1123,1124,1132,1140,1148,1156,1164],{},[62,1125,1126,1129],{},[80,1127,1128],{},"17 Oct",[80,1130,1131],{},"First exploitation attempt in Amazon's honeypot telemetry, source unknown",[62,1133,1134,1137],{},[80,1135,1136],{},"20 Oct, 15:00",[80,1138,1139],{},"CVE numbers circulate in forums, with the wrong release time and a wrong CVSS of 10.0",[62,1141,1142,1145],{},[80,1143,1144],{},"20 Oct, 20:00",[80,1146,1147],{},"Calif accidentally publishes a video of its own exploit",[62,1149,1150,1153],{},[80,1151,1152],{},"20 Oct, 23:00",[80,1154,1155],{},"Mitigation guidance to critical infrastructure operators may have leaked as well",[62,1157,1158,1161],{},[80,1159,1160],{},"21 Oct, 07:41",[80,1162,1163],{},"Chainguard publishes container images carrying the fix, six hours early",[62,1165,1166,1169],{},[80,1167,1168],{},"21 Oct, 14:00",[80,1170,1171],{},"Coordinated release of advisories and fixed versions",[11,1173,1174],{},"The Foundation objects not to the early fix but to its comparability: \"Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.\" Chainguard CEO Dan Lorenc does not dispute the timing, but he does dispute the reading: \"I made the call to get these out early when exploits hit in the wild.\" The Foundation's own security team had identified no functional public exploit by release time, and calls the delay since the first signs in 2024 \"a structural failure\".",[26,1176,1178],{"id":1177},"status-on-22-october-millions-of-attempts-no-confirmed-breach","Status on 22 October: millions of attempts, no confirmed breach",[11,1180,1181],{},"No successful break-in through PHP2Shell has been confirmed. The number of attempts has. Cloudflare CEO Matthew Prince reports thousands across his network in the ten hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions by now. Cloudflare also sees attackers varying payloads and reading which requests the web application firewall blocks.",[11,1183,1184,1185,1187],{},"Volume is not success. Jake Knott of watchTowr says none of the circulating proof-of-concepts achieves code execution: they fail, measure timing differences, or crash the target process. VulnCheck saw at least one address trying, unsuccessfully, to drop a web shell. Germany's BSI states in version 1.1 of its 21 October warning that no confirmed exploitation is known so far. Neither number appears in the ",[20,1186,580],{"href":308}," as of 22 October. JFrog also found fake exploits and prank malware in public repositories — test that code against your own systems and you may be testing something other than the flaw.",[26,1189,1191],{"id":1190},"what-this-means-for-your-investigation","What this means for your investigation",[11,1193,1194],{},"Amazon recommends starting the investigation window on 17 October, not on patch day. In practice the first step is preserving evidence before rotation deletes it: web server logs and the process and file state of every reachable PHP system from 16 October.",[319,1196,1197,1211,1230,1236],{},[322,1198,1199,1202,1203,1206,1207,1210],{},[325,1200,1201],{},"Requests:"," POST requests carrying the string ",[15,1204,1205],{},"PHP_SESSION_UPLOAD_PROGRESS"," in ",[15,1208,1209],{},"multipart\u002Fform-data"," bodies, plus clusters of HTTP 500 responses and crashed PHP workers.",[322,1212,1213,1216,1217,39,1220,39,1223,96,1226,1229],{},[325,1214,1215],{},"Processes:"," any shell, interpreter or download tool started by ",[15,1218,1219],{},"php-fpm",[15,1221,1222],{},"php-cgi",[15,1224,1225],{},"httpd",[15,1227,1228],{},"apache2",", plus new files in the web root.",[322,1231,1232,1235],{},[325,1233,1234],{},"Detection without signatures:"," Amazon recommends detections that do not depend on CVE-specific signatures — first exploitation regularly precedes the first signature.",[322,1237,1238,1241],{},[325,1239,1240],{},"Indicators:"," Amazon publishes six addresses from its telemetry. They belong to shared anonymisation infrastructure and are not exclusive to this activity: a reason to investigate, not a block list.",[1243,1244,1249],"pre",{"className":1245,"code":1247,"language":1248},[1246],"language-text","103.216.220.92     17.10.2026\n31.223.184.166     21.10.2026\n37.19.200.5        21.10.2026\n134.209.159.64     21.10.2026\n103.114.163.188    21.10.2026\n95.217.98.37       21.10.2026\n","text",[15,1250,1247],{"__ignoreMap":407},[11,1252,1253],{},"On the deadline such cases set, Amazon's driest sentence matters most: \"A 7-day or 30-day SLA assumes a delay that no longer exists.\" The reason is structural and not limited to PHP: AI-assisted analysis makes it cheaper to turn a patch diff or an advisory into a working exploit.",[26,1255,1256],{"id":388},"What helps — and why visibility decides",[11,1258,1259],{},"A deadline measured in hours assumes the inventory exists when the advisory lands. Between 17 and 21 October it was the only usable information there was.",[11,1261,1262,1263,1265,1266,768,1268,1270],{},"blacklens.io uses ",[20,1264,396],{"href":395}," to track which services and web applications are reachable from outside and which technologies run on them; internal systems are covered by the ",[20,1267,767],{"href":766},[20,1269,401],{"href":400}," matches new CVEs against that inventory and shows, per hit, the EPSS score, KEV membership, available exploits and whether the match rests on the exact version or only on the product. Hunting on the host itself is not part of that; logs and monitoring on the system cover it.",{"title":407,"searchDepth":408,"depth":408,"links":1272},[1273,1274,1275,1276,1277],{"id":1081,"depth":411,"text":1082},{"id":1099,"depth":411,"text":1100},{"id":1177,"depth":411,"text":1178},{"id":1190,"depth":411,"text":1191},{"id":388,"depth":411,"text":1256},"Amazon found the first PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure. That changes the window your investigation must cover.",[1280,1283,1286],{"q":1281,"a":1282},"Was PHP2Shell exploited before public disclosure?","Yes, according to Amazon Threat Intelligence. The earliest exploitation attempt in the telemetry of its MadPot honeypot network dates to 17 October 2026, four days before PHP's advisory, and came from a commercial anonymisation network. How the actor obtained exploit information beforehand is unclear. Further proof-of-concept attempts followed from 02:00 UTC on 21 October, twelve hours before the release.",{"q":1284,"a":1285},"How far back should I hunt for compromise?","Amazon recommends taking PHP2Shell investigations back to at least 17 October 2026 rather than only to patch day. In practice that means preserving web server logs and the process and file state of every reachable PHP system from 16 October onwards, before log rotation deletes them. Look for POST requests carrying the string PHP_SESSION_UPLOAD_PROGRESS, for processes started by a PHP worker, and for new files in the web root.",{"q":1287,"a":1288},"How fast does a critical update have to be installed?","Amazon recommends measuring patch and mitigation timelines in hours for critical vulnerabilities on internet-facing systems: a 7-day or 30-day SLA assumes a delay that no longer exists. That assumes the inventory already exists on advisory day. blacklens.io matches new CVEs in the Threat Center against the technologies it has recorded and shows CVSS, EPSS, KEV membership and whether an exploit is public for each hit.","\u002Fimages\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch-en.webp","Timeline showing the first exploitation attempt on 17 October and the PHP patch on 21 October 2026",{},"\u002Fen\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",{"title":1073,"description":1278},{"loc":1292},"en\u002Finsights\u002Fphp2shell-angriffe-vor-dem-patch",[444],"php2shell-angriffe-vor-dem-patch","CmoIJqrLGf2ifl1_EZ7uomptiOZ8ogKLBf8XMEszWeY",1792870638678]