Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

T2Critical 100Covered by 1 source · first reported by Help Net Security at 03 Nov, 06:00 UTC

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding…

ai dev security

Sources

T2Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch upHelp Net Security03 Nov, 06:00

Vulnerabilities

CVE-2026-111497

Why this score

Signals contributing to the severity score
Signal	Points
kev added	50
ssvc active	35
cvss critical — 9.2	20
epss high	20
public poc — 59 repositories	20