{
  "id": 16781250,
  "title": "Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites",
  "url": "https://urgent.news/2026/10/27/microsoft-and-others-scramble-to-patch-http2shell-flaw-which-could-be",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T18:45:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/microsoft-and-others-scramble-to-patch-http2shell-flaw-which-could-be-the-next-php-level-issue-node-js-problem-may-also-affect-millions-of-sites"
  },
  "original_language": "en",
  "account": "A critical vulnerability dubbed HTTP2Shell has been discovered in Brotli, an open-source compression algorithm used by numerous software applications. This flaw could potentially lead to memory corruption and remote code execution, posing a significant threat to systems worldwide. The vulnerability, tracked as CVE-2026-111497, has an extremely high severity rating of 9.2/10.\n\nMajor tech companies and projects have swiftly released patches for the issue. Microsoft released an emergency update for .NET, while Node.js issued a patch for its affected versions. Google also addressed the issue by releasing updated versions of Brotli (1.0.10, 1.1.1, and 1.2.1) on October 21, 2026.\n\nHowever, the risk persists as some software may still be using vulnerable Brotli versions, either as standalone components or bundled within other applications. In such cases, updating the underlying library alone may not suffice. For instance, apps utilizing Node.js or Python packages containing the affected Brotli libraries remain exposed.\n\nSystem administrators are strongly advised to apply the available patches promptly, restart affected processes, and rebuild and redeploy any impacted container images. Mitigation techniques, such as using proxies, load balancers, or web application firewalls to block malicious Brotli-compressed requests, can also help minimize the potential impact. Despite the existence of proof-of-concept exploits, there have been no reports of actual malicious exploitation in the wild, yet the threat remains significant and warrants immediate attention.",
  "summary": "An RCE flaw was found in Brotli, a Google-built open source data compression algorithm.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 4,
    "also_reported_by": [
      {
        "outlet": "SecurityWeek",
        "title": "Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages",
        "url": "https://urgent.news/2026/10/26/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js",
        "published": "2026-10-26T10:21:57.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution (Bill Toulas/BleepingComputer)",
        "url": "https://urgent.news/2026/10/26/microsoft-and-others-push-out-emergency-patches-for-a-critical-flaw",
        "published": "2026-10-26T16:45:00.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "Microsoft patches a severe flaw in its Android Authenticator app that could let untrusted apps impersonate Microsoft apps and obtain delegated account tokens (Abinaya/Cyber Security News)",
        "url": "https://urgent.news/2026/10/27/microsoft-patches-a-severe-flaw-in-its-android-authenticator-app-that",
        "published": "2026-10-27T05:30:01.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}