AQSh kiberxavfsizlik agentligi CISA Brotli zaifligi — Node2Shell nomi bilan tanilgan — ni Ma'lum ekspluatatsiya qilingan zaifliklar (KEV) katalogiga qo'shdi. Alohida, ikkita xavfsizlik firmasi o'z honeypotlariga qarshi ekspluatatsiya urinishlarini qayd etganini aytmoqda.
CVE-2026-111497 sifatida kuzatiladigan va shuningdek HTTP2Shell va Broccoli2Shell nomlari bilan ham tanilgan bu xato, Google tomonidan ishlab chiqilgan ma'lumotlarni siqish kutubxonasi Brotli dekoderidagi chegaradan tashqari yozish (out-of-bounds write) xatosidir.
U Brotli 1.0.3 dan 1.2.0 gacha bo'lgan versiyalariga ta'sir qiladi. Maxsus tayyorlangan siqilgan ma'lumotlar yordamida hujumchi ilovani ishdan chiqarishi, uning xotirasi mazmunini ochib berishi va potentsial ravishda ixtiyoriy kodni bajarishi mumkin.
Xato OpenAI tadqiqotchilari tomonidan xabar qilingan va Node.js hamda Google 21-oktabrda tuzatishlar chiqargan. Ikkita Python paketining saqlovchilari bo'lgan Microsoft, shuningdek Bun, Envoy va Istio ham tuzatishlar chiqargan, Palo Alto Networks esa PAN-OS uchun tezkor tuzatishlarni tarqatmoqda.
Imperva rasmiy Node.js tasvirida zaiflik kod bajarish (code execution) uchun ekspluatatsiya qilinishi mumkinligini ko'rsatgan.
CISA CVE-2026-111497 ni 27-oktabrda KEV katalogiga qo'shdi, ammo hujumlar haqida ma'lumot bermadi. Federal fuqarolik agentliklariga 10-noyabrgacha xatoni bartaraf etish buyurilgan.
O'z sensorlar tarmog'i orqali ekspluatatsiya faoliyatini kuzatuvchi Previdian 27-oktabrda AQShga asoslangan IP manzildan kelgan CVE-2026-111497 ga qaratilgan bitta ekspluatatsiya urinishini qayd etganini aytadi. Kompaniya ekspluatatsiya ishonchini "tasdiqlangan" deb baholaydi.
"Ishonch — bu dalillar ushbu zaiflikning ekspluatatsiyasi sifatida ko'rib chiqilishini qanchalik kuchli qo'llab-quvvatlashini bildiradi. Bu urinish muvaffaqiyatli bo'lganini anglatmaydi", — deb tushuntiradi Previdian.
Razvedka va ommaviy ekspluatatsiya faoliyatini kuzatuvchi kiberxavfsizlik laboratoriyasi ELLIO o'z sensorlari 26-oktabrda x86-64 tizimlarida ishlaydigan Node.js 24.22.0 ni nishonga olgan zararli so'rovni ushlaganini aytadi. Oldingi kuni ommaviy mavjud vosita Brotli bilan siqilgan ma'lumotlarni sensorlarga yuborib, qaysi xostlar bunday ma'lumotlarni qayta ishlashini aniqlagan.
Ekspluatatsiya urinish ELLIO avval PHP2Shell zaifliklarini nishonga olgan va Palo Alto Networks hamda Fortinet VPN qurilmalarini tekshirgan IP manzildan kelgan. "Bu ommaviy ekspluatatsiyaga yo'naltirilgan operator tomonidan masofadan kod bajarish (RCE) qabul qilinayotganini ko'rsatadi", — dedi ELLIO.
Biroq, ELLIO tahliliga ko'ra, hujumda ishlatilgan ekspluatatsiya buzilgan edi. Uning yetkazish komponentlari ommaviy proof-of-concept kodiga mos kelgan, ammo hujumchi o'zi yozgan oxirgi bosqich zaif Node.js nusxasiga qarshi ELLIO o'tkazgan 50 ta sinovning hech birida shell natijasini bermagan.
"Bu, ehtimol, operator to'liq sinovdan o'tkazmasdan yovvoyi muhitda otilgan birinchi avlod urinish edi — oxirgi 12 ko'rsatma nuqsonli bo'lgan ishlaydigan ramka", — deb ta'kidladi ELLIO.
Kompaniya o'zi rasmiy Node.js qurilmasi bilan ishlaydigan x86-64 tizimlaridagi to'rtta turli sozlamaga qarshi kod bajarishga erishgan. Shuningdek, muvaffaqiyatsiz ekspluatatsiya urinishlari nishonga olingan jarayonni ishdan chiqarishi mumkinligi, ya'ni ular xizmatdan rad etish (DoS) hujumlari sifatida ishlatilishi mumkinligi haqida ogohlantiradi.
VMware tuzatishlari kutilmoqda
Broadcom 27-oktabrda VMware Cloud Foundation va vSphere Foundation'dagi SDDC Manager Node.js dan foydalangani uchun CVE-2026-111497 dan ta'sirlanganini ogohlantirdi.
Kompaniya SDDC Manager 9.1.1 uchun muammoni tanqidiy deb baholaydi, CVSS balli 9.8. 9.0.x, 9.1.0 va 5.2.x versiyalari uchun esa xatoni muhim deb baholaydi, CVSS balli 7.5.
"Tarmoq kirishiga ega zararli aktor bu muammoni ekspluatatsiya qilib, ixtiyoriy kodni bajarishi mumkin", — dedi Broadcom.
Barcha ta'sirlangan versiyalar uchun tuzatishlar kutilmoqda va Broadcom ikkita bilim bazasi maqolasida vaqtinchalik yechimlarni e'lon qilgan. Uning maslahati yovvoyi muhitda ekspluatatsiya haqida eslatmaydi.
Bog'liq: Tailscale "Tailworm" zaifliklarining muvofiqlashtirilmagan oshkor etilishidan so'ng tezkor tuzatishlarni tarqatmoqda
Bog'liq: HPE Tarmoq mahsulotlaridagi o'nlab tanqidiy xatolarni tuzatdi
Bog'liq: Bu normal: NetScaler nol-kun zaifliklari bizga yangi normal haqida nima aytadi
Bog'liq: Sanoat sotuvchilari mahsulotlarini PHP2Shell zaifliklari uchun tekshirmoqda
The US cybersecurity agency CISA has added the Brotli vulnerability known asNode2Shellto its Known Exploited Vulnerabilities (KEV) catalog. Separately, two security firms say they have recorded exploitation attempts against their honeypots.
Tracked as CVE-2026-111497 and also known as HTTP2Shell and Broccoli2Shell, the flaw is an out-of-bounds write in the decoder of Brotli, the data compression library developed by Google.
It impacts Brotli versions 1.0.3 through 1.2.0. With specially crafted compressed data, an attacker could crash the application, expose the contents of its memory, and potentially execute arbitrary code.
The bug was reported by researchers at OpenAI, and Node.js and Google released fixes on October 21. Microsoft, the maintainers of two Python packages, Bun, Envoy and Istio have also released fixes, and Palo Alto Networks is rolling out hotfixes for PAN-OS.
Imperva has demonstrated that the vulnerability can be exploited for code execution on an official Node.js image.
CISA added CVE-2026-111497 to the KEV catalog on October 27, but provided no information on the attacks. Federal civilian agencies have been instructed to address the flaw by November 10.
Previdian, which monitors exploitation activity through its own network of sensors, says it recorded one exploitation attempt targeting CVE-2026-111497 on October 27, coming from a US-based IP address. The company rates its confidence in the exploitation as ‘confirmed’.
“Confidence is how strongly the evidence supports treating this as exploitation of this vulnerability. It does not mean the attempt succeeded,” Previdian explains.
ELLIO, a cybersecurity lab that monitors reconnaissance and mass exploitation activity, says its sensors caught a malicious request targeting Node.js 24.22.0 running on x86-64 systems on October 26. The previous day, a publicly available tool had sent Brotli-compressed data to its sensors to determine which hosts process such data.
The exploitation attempt came from an IP address that ELLIO previously saw targeting the PHP2Shell vulnerabilities and probing Palo Alto Networks and Fortinet VPN devices. “This is indicative of the RCE being adopted by an operator focused on mass exploitation,” ELLIO said.
According to ELLIO’s analysis, however, the exploit used in the attack was broken. Its delivery components matched public proof-of-concept code, but the final stage, which the attacker wrote themselves, did not result in a shell in any of the 50 tests ELLIO ran against a vulnerable Node.js instance.
“This was likely a first-generation attempt fired in the wild before the operator fully tested the final stage against a live target – a working framework with a defective last 12 instructions,” ELLIO noted.
The company has itself achieved code execution against four different setups running an official Node.js build on x86-64. It also warns that failed exploitation attempts can crash the targeted process, which means they can be used in denial-of-service (DoS) attacks.
VMware patches pending
Broadcom warned on October 27 that SDDC Manager in VMware Cloud Foundation and vSphere Foundation is affected by CVE-2026-111497 because it uses Node.js.
The company rates the issue critical, with a CVSS score of 9.8, for SDDC Manager 9.1.1. For versions 9.0.x, 9.1.0 and 5.2.x, it rates the bug important, with a CVSS score of 7.5.
“A malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code,” Broadcom said.
Patches are pending for all affected versions, and Broadcom has published workarounds in two knowledge base articles. Its advisory does not mention exploitation in the wild.
Related: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Related: Industrial Vendors Check Products for PHP2Shell Vulnerabilities