At A Glance
- A week after PHP’s emergency “php2shell” patches, Microsoft shipped out-of-band .NET updates for a critical flaw in the Brotli decoder, now nicknamed Broccoli2Shell, HTTP2Shell, and Node2Shell.
- CVE-2026-111497 is an out-of-bounds write in the Brotli streaming decoder. It can crash a process, leak memory, and in some cases lead to remote code execution.
- The same decoder ships across ecosystems, so the one bug surfaces in .NET, Node.js, and Python HTTP clients at the same time.
- Patching is necessary and is not the whole job. Vendored copies dodge system updates, and the flaw is reachable from both a malicious request and a malicious response.
- Zero Trust connectivity does not rewrite the vulnerable line of code. It removes the reachable targets an attacker needs and limits where a compromised host can go next.
A week ago, the PHP security team shipped emergency fixes for a pair of critical memory-safety flaws that the internet quickly labeled php2shell. CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2, chain together into unauthenticated remote code execution against effectively every PHP build since 5.4. The ink was barely dry when the next one landed. On October 25, Microsoft released out-of-band .NET security updates for a critical flaw in the Brotli decoder, tracked as CVE-2026-111497 and already carrying three nicknames. If you run a security team, you know the feeling. Here we go again.
What Broke This Time
Brotli is Google’s compression library, and it sits inside HTTP clients and servers almost everywhere data gets compressed on the wire. The bug is an out-of-bounds write in the streaming decoder. A crafted Brotli stream carries an invalid block switch, and the decoder reads that as a temporary need for more input rather than a permanent format error. It keeps appending input bytes to an internal eight-byte buffer, the writes run past the end of that buffer, and nearby memory gets corrupted. Node.js states the outcome directly: the process can crash, memory can be exposed, and in some configurations an attacker can achieve remote code execution.
The reach is the part worth sitting with. The flawed decoder ships in Brotli versions 1.0.3 through 1.2.0, so the same defect shows up in .NET, patched in 8.0.33, 9.0.22, 10.0.14, and the .NET 11 release candidate; in Node.js, patched in 22.23.4, 24.22.1, and 26.12.1; and in Python HTTP clients including urllib3, requests, httpx, and aiohttp. One library, many ecosystems, one CVE. That is also why php2shell and Broccoli2Shell belong in the same conversation. Different language, different root cause, same structural lesson about code you depend on and did not write.
Why This One Resists a Clean Patch
In theory the remediation is a version bump. In practice two things make it harder than that. First, you cannot patch what you cannot find. Updating the system Brotli library does nothing for an application that bundles its own copy, and plenty of them do, which means every deployment needs its own check rather than a single platform-wide update. Second, the flaw is reachable from both directions. A server is exposed when it decompresses a malicious request, and a client is exposed when it fetches a URL and decompresses a malicious response. Blocking inbound Brotli at a proxy closes the first path and leaves the second one open.
Patch First, Then Think Bigger
The immediate action is not complicated. Update to a fixed Brotli, Node.js, or .NET build, restart the affected processes, and rebuild and redeploy any container images that carry the old library. Public proof-of-concept exploits already exist, even though no in-the-wild abuse has been confirmed yet, so treat the clock as running.
Patching closes this hole, and it does not close the category. Broccoli2Shell is one more entry in a long list of dependency flaws, and php2shell was the entry right before it. The pattern underneath them rarely changes. A ubiquitous component carries a latent bug, the bug turns attacker-controlled input into attacker-controlled execution, and the fix reaches your environment only as fast as you can inventory every place the component lives.
The Lesson Is Exposure, Not a Version Number
Zero Trust connectivity would not have rewritten the vulnerable line inside Brotli. What it changes is who can reach the code to trigger it, and how far an attacker gets if they do. On an identity-first fabric, every service carries a strong, certificate-based identity, dials outbound to the overlay rather than listening for inbound connections, and accepts a session only after the other side proves a verified identity that policy permits. A server with no open listening ports is not sitting on the internet waiting for an unauthenticated stranger to deliver a hostile Brotli request. The server-side attack path that CVE-2026-111497 depends on simply has nowhere to land.
The same model contains the damage when something does get through. If remote code execution lands on a host, identity-based microsegmentation means that host can open only the sessions policy already allows, so a single compromise does not become free movement across your internal network. None of this makes patching optional. It shrinks the blast radius while you patch, and it keeps the next dependency CVE from turning one exposed service into an open door.
What to Do This Quarter
Treat the patch as table stakes and the architecture as the real work. Inventory every service that decompresses Brotli, including the vendored copies a system update will miss, and confirm each one runs a fixed build. Then ask the harder question, because another dependency flaw is already on its way. Build your connectivity on a foundation where identity, rather than network location, decides who talks to whom, and where a compromised or exposed service has no open port to receive the attack and nothing extra to reach once it is hit. The teams that weather the next Broccoli2Shell will not be the ones who patched fastest. They will be the ones who gave attackers far less to reach in the first place.
Frequently Asked Questions
What is Broccoli2Shell (CVE-2026-111497)?
Broccoli2Shell is the nickname for a critical out-of-bounds write in the Brotli compression decoder, also tracked as HTTP2Shell and Node2Shell. A maliciously crafted Brotli-compressed stream can corrupt memory in the decoder, which can crash the process, leak memory, or lead to remote code execution. It affects any application that decompresses attacker-controlled Brotli data, including .NET, Node.js, and Python HTTP clients.
How is it related to the php2shell flaws?
They are separate vulnerabilities in different technologies, disclosed within days of each other. php2shell refers to CVE-2026-109618 and CVE-2026-109619 in PHP, and Broccoli2Shell refers to CVE-2026-111497 in the Brotli decoder. The connection is the pattern, not the code. Both are critical flaws in widely deployed components, and both turn untrusted input into code execution that reaches systems you run.
Does patching fully resolve the risk?
Patching resolves this specific flaw, and you should do it immediately. It does not address the broader exposure. Vendored copies of Brotli will not pick up a system-level update, and the next dependency CVE will arrive before long. Reducing what an attacker can reach, and limiting where a compromise can spread, is what carries over from one CVE to the next.
How does Zero Trust connectivity help if the bug is in a library?
It does not fix the library. It removes the conditions the attack needs. When services dial outbound to an identity-based overlay and expose no open listening ports, an unauthenticated attacker cannot reach a vulnerable server to deliver a hostile stream. If code execution does occur, identity-based segmentation limits that host to the connections policy already permits, which keeps a single compromise from spreading across the network.
