Security Boulevard

CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is ...
YAHOO!

Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites

Multiple tech companies and projects have recently pushed patches for a vulnerability called "HTTP2Shell" which could enable remote code execution (RCE) attacks, similar to the recent "PHP2Shell" ...

Microsoft and others scramble to patch Node.js flaw which could be the next PHP-level issue

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.
ABS-CBN on MSN

PHP, Node.js, eMudhra, and LiteLLM lead busy week for security teams

Security roundup: PHP2Shell, eMudhra certificate failures, Node.js security fixes and the LiteLLM supply-chain attack reshape ...
Cybernews

PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...