69[.]48[.]229[.]143

A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages. Node.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell. Bun, Envoy and Istio have also been updated. Brotli is a popular choice for compressing data sent over the web, and its decoder is embedded in a long list of applications and libraries. Described as an out-of-bounds write, the bug impacts Brotli 1.0.3 through 1.2.0. Google gave it a CVSS v4 score of 9.2, which puts it in the critical category. Brotli versions 1.0.10, 1.1.1 and 1.2.1 contain the fix. The Node.js project said specially crafted input can push data beyond the limits of a buffer used by the decoder. The resulting memory corruption could cause the process to crash or leak memory contents, and could also allow an unauthenticated attacker to run arbitrary code. Node.js credited the discovery to members of OpenAI Codex Security. According to OpenAI, the issue was uncovered during red-teaming work, after which the company notified the Brotli developers and the projects that rely on the library. OpenAI noted that the fix predates the disclosure. “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” the AI company said. Code execution demonstrated on official Node.js image Imperva has shown that it can be exploited for code execution on the official Node.js 24.22.0 image for Linux arm64. Its researchers sent the malicious data both in a server response retrieved by the targeted application and in a request body processed by Express 5 or body-parser 2. “The proof did not succeed on every attempt. Our results establish code execution for the tested Linux arm64 build and application setups, and show how the fixed build handled the same inputs,” Imperva said. The security firm has not made its exploit public. Attacks only work if malicious Brotli data reaches the decoder, for instance through a library that unpacks compressed content on the application’s behalf. “Any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed. This includes compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files,” OpenAI’s Patch the Planet initiative said in its advisory. No exploitation in the wild has been reported so far. A proof-of-concept exploit published on GitHub reportedly achieves code execution only against an intentionally weakened build, and some researchers argued the bug can only be used for denial-of-service (DoS) attacks. Microsoft products and Python packages affected Microsoft’s October 25 updates include .NET runtime versions 8.0.33, 9.0.22 and 10.0.14, along with .NET 11 Release Candidate 3. Visual Studio 2019, 2022 and 2026, as well as PowerShell 7.4, 7.5 and 7.6, have also been updated. Microsoft has categorized CVE-2026-111497 as an elevation of privilege issue with a CVSS v3.1 base score of 8.1. It rates the flaw critical for .NET and Visual Studio and important for PowerShell, and its exploitability assessment is “Exploitation More Likely.” In Python’s case, the vulnerable decoder is built into two PyPI packages, Brotli and brotlicffi. They have been patched with the release of versions 1.2.1 and 1.2.1.0, respectively. As more affected software emerged, researchers began referring to the flaw as HTTP2Shell and Broccoli2Shell. A public tracker of software that bundles its own copy of the Brotli decoder lists several projects that are still unpatched, including DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II. Its maintainers say the list is incomplete, and that not every configuration of these projects necessarily exposes the vulnerable code. Applying the updates also requires restarting affected services and rebuilding container images on top of a patched base, since processes that are already running keep using the vulnerable code. Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months Related: LiteLLM Compromised in Fresh Supply Chain Attack

Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems. LiteLLM is an open-source Python SDK and AI gateway that enables applications to access AI models from different providers through a common API. It is a massively popular project with 61,800 GitHub stars, 92 million monthly downloads on PyPI, and is used by high-profile companies like NVIDIA, Netflix, AT&T, and Okta. The project says that the release pipeline was compromised on October 21 and a threat actor pushed version 1.107.0 to the Docker registry and PyPI. "This version contained compiled malware which steals credentials and loads remote-code execution tools," the maintainer says, adding that customers running the private enterprise were not impacted. In a post-mortem of the incident, the maintainer says that the following LiteLLM artifacts were affected in the attack: PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC Docker Hub: v1.107.0, latest, main-latest, and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC GHCR: v1.107.0, latest, main-latest, and main-stable: pointed to the compromised image indexes below from 11:46:56 UTC until they were made unavailable by 13:51 UTC - ghcr.io/berriai/litellm: sha256:1bbcb1443bc9… - ghcr.io/berriai/litellm-database: sha256:c00f9d92c427… - ghcr.io/berriai/litellm-non_root: sha256:7b00e91cd2fe… Multiple application security companies detected the attack within six minutes of publishing the malicious LiteLLM version and analyzed the payload. According to the researchers, the attacker did not touch the LiteLLM application code and modified only the installation package to place three malicious files (cook.pth, cook.py, and sitecustomize.py) in the environment's Python’s library directory. "During normal startup, Python processes executable .pth lines and then attempts to import sitecustomize," Socket researchers explain. Endor Labs notes that this way the payloads are executed before the application every time Python is launched in the environment. Running Python or pip to investigate an affected installation also triggered the malware. The malware targeted the following data: Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure-management secrets. AI credentials and configuration: Authentication files for AI development tools, plus LiteLLM’s stored provider credentials and model settings. Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; SSH, GPG, and TLS keys. Browser data: Saved login, cookie, autofill/payment, and browsing-history databases. Host and runtime data: Environment variables, shell and application histories, and system and network information. The stolen data is encrypted using an AES-256-CBC key that is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’ One of the malicious files, sitecustomize.py, launches a detached loader that checks a GitHub-hosted pointer every hour and downloads Python from an external server for execution on the host. The malicious packages have been removed, but potentially impacted users should stop affected deployments and inspect environments without launching the Python interpreter. Infected systems should be isolated and rebuilt from clean backups, and all exposed secrets should be rotated immediately. Removing the LiteLLM package directory alone may leave startup files or an active loader behind. Currently, the recommended recovery version is LiteLLM 1.106.2, which is the latest clean release before the attack. Previously, the project also suffered a breach in March, when the TeamPCP hacking group published malicious LiteLLM versions on PyPI after breaching Aqua Security's Trivy vulnerability scanner used in LiteLLM's CI/CD pipeline. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report