Node2Shell evolves into HTTP2Shell, exposing many HTTP libs and apps
theanonymousone · hn · 2026-10-24
Aikido researchers report that the Node2Shell vulnerability has evolved into HTTP2Shell, widening the blast radius from Node.js to HTTP libraries and apps across ecosystems, including vulnerable Python packages (brotli-related, CVE-2026-111497).
The flaw enables shell injection via HTTP requests, meaning any application using affected HTTP-handling libraries is potentially exploitable. Discussion ongoing on Hacker News.
More from Safety
- Claude Code audit finds 214,856 "permanently deleted" photos lurking in Android hidden cache — Loo_Atreides · 2026-10-26
- Microsoft patches Authenticator flaw (CVE-2026-80097, CVSS 8.6) letting zero-permission apps steal tokens — basedjensen · 2026-10-26
- CNN: AI is exposing how fragile the web really is — and what users can do about it — cnn · 2026-10-26
- IIT Madras hosts AI Governance conclave with 400+ attendees on responsible AI — ravi_iitm · 2026-10-26
- “CIA watching everyone patch ‘security vulnerabilities’” goes viral — tekbog · 2026-10-26
- Weight-tampering worm scenario for near-frontier models called 'somewhat scary' — teortaxesTex · 2026-10-26