Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that gap matters, and how Sweet Virtual Patching protects running applications until the fixes land. A bad stream, a broken decoder Brotli’s decoder sits inside runtimes, HTTP libraries, proxies and frameworks, and it’s the first code to touch compressed data an attacker sends. As Sweet CTO Tomer Filiba explained, a malformed block-type switch can be read…