Seshanba kuni AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) tasdiqladiki, xakerlar Node2Shell, Broccoli2Shell va HTTP2Shell nomlari bilan tanilgan muhim Brotli zaifligidan foydalanishni boshlagan.
CVE-2026-111497 raqami bilan kuzatilgan ushbu muhim darajadagi zaiflik, Google'ning keng tarqalgan Brotli yo'qotishsiz siqish algoritmi bilan siqilgan ma'lumotlarni kengaytirish uchun ishlatiladigan Brotli dekoderidagi chegaradan tashqari yozish zaifligidan kelib chiqadi.
Imtiyozsiz hujumchilar zararli tarzda tayyorlangan Brotli-siqlangan oqim yordamida ishdan chiqish yoki xotira sizib chiqishini keltirib chiqarishi va ba'zi hollarda zaif Brotli kutubxonalari yoki binar fayllari bo'lgan qurilmalarda masofadan kod bajarilishini qo'lga kiritishi mumkin.
Xavfsizlik muammosi birinchi marta Node.js JavaScript ish vaqti muhitida aniqlangan, ammo u zaif Brotli amalga oshirishlariga tayanadigan HTTP serverlari va mijozlariga ham ta'sir qiladi.
Yakshanba kuni Microsoft ham shoshilinch .NET xavfsizlik yangilanishini chiqardi va hujumchilar zaif .NET versiyasiga ega tizimlarda imtiyozlarni oshirish uchun undan foydalanishi mumkinligi haqida ogohlantirdi.
CISA zaiflikni seshanba kuni o'zining Ma'lum Foydalanilgan Zaifliklar (KEV) Katalogiga qo'shdi va AQSh hukumat agentliklariga tizimlarini ikki hafta ichida, 10-noyabrgacha, Majburiy Operatsion Direktiv (BOD) 26-04 talabiga binoan yamashni buyurdi.
"Google Brotli tekshirilmagan qaytish qiymati zaifligini o'z ichiga oladi, bu masofadan autentifikatsiyalanmagan hujumchiga qo'shni dekoder holati xotirasini buzish, sezgir xotira mazmunini ochish, xizmatdan voz kechish hujumini keltirib chiqarish yoki tayyorlangan Brotli-siqlangan oqim yordamida ixtiyoriy kod bajarish imkonini beradi", — deyiladi unda.
"Bunday turdagi zaifliklar zararli kiber aktyorlar uchun tez-tez hujum vektori bo'lib, federal korxona uchun jiddiy xavflarni tug'diradi."
CISAning BOD 26-04 faqat federal agentliklarga tegishli bo'lsa-da, kiberxavfsizlik agentligi barcha tarmoq himoyachilarini kiruvchi hujumlarni to'sish uchun ushbu xavfsizlik zaifligini yamashni ustuvor qilishga chaqirdi.
Yangilanishlarni darhol qo'llay olmaydigan xavfsizlik jamoalari proksi yoki xavfsizlik devori darajasida kiruvchi Brotli-siqlangan so'rovlarni to'sishi yoki yangilanish mumkin bo'lguncha Brotli dekodlash xususiyatini o'chirib qo'yishi kerak.
Yamoqdan so'ng, administratorlar ta'sirlangan jarayonlarni qayta ishga tushirishlari va ta'sirlangan konteyner tasvirlarini qayta qurish va qayta joylashtirishlari kerak.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'siladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 himoyalarni texnika bo'yicha o'lchaydi, bu mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya asosida.
Hisobotni oling
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known asNode2Shell, Broccoli2Shell, and HTTP2Shell.
Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write weakness in the Brotli decoder used to expand data compressed with Google's widely popular Brotli lossless compression algorithm.
Unprivileged attackers can use a maliciously crafted Brotli-compressed stream to trigger crashes or memory leaks and, in some cases, gain remote code execution on devices with vulnerable Brotli libraries or binaries.
The security issue was first identified in the Node.js JavaScript runtime environment, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations.
On Sunday, Microsoft also pushed an emergency .NET security update, warning that attackers could exploit it to escalate privileges on systems with a vulnerable .NET version.
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday and ordered US government agencies to patch their systems within two weeks, by November 10, as mandated by its Binding Operational Directive (BOD) 26-04.
"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream," it said.
"These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise."
While CISA's BOD 26-04 applies only to federal agencies, the cybersecurity agency urged all network defenders to prioritize patching this security flaw to block incoming attacks.
Security teams that can't apply the updates immediately should block incoming Brotli-compressed requests at the proxy or firewall level, or disable the Brotli decoding feature until they can update.
After patching, administrators must also restart affected processes and rebuild and redeploy affected container images.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report