🔍 Critical Brotli flaw forces emergency patch cycle CVE-2026-111497, tracked as HTTP2Shell/Node2Shell/Broccoli2Shell, affects Brotli decoder versions 1.0.3-1.0.9, 1.1.0, and 1.2.0. The memory corruption bug can be triggered by malicious Brotli-compressed input and may lead to crashes, memory exposure, privilege escalation, or RCE. Patches are now available across Node.js, Brotli, Python packages, and .NET. The exposure is broader than HTTP/2 and includes both server-side request handling and client-side decompression of attacker-controlled responses. Updating system Brotli alone may not fix bundled copies inside applications, so process restarts, container rebuilds, and redeployments are part of remediation. 🛰️ Open sources - closed narratives @sitreports
В мессенджере Signal обнаружили критическую уязвимость, позволявшую подслушивать пользователей после завершения звонка
- 234
- 111
- 28
- 28
- 8
- 4
- 560
- 88
- 62
- 39
- 1
- 364
- 51
- 20
- 15
- 178
- 56
- 22
- 16
- 257
- 92
- 26
- 11
- 10
- 9
- 22
- 10
- 9
- 5
- 2
- 15
- 10
- 5
- 3
- 3
- 3