Logo
VULNERABILITY UPDATES

Vulnerability updates

Short, sourced updates on critical vulnerabilities: who is affected, how to check, and which versions fix them. Kept up to date as things change.

2026
Node2Shell: Brotli Decoder RCE in Node.js (CVE-2026-111497)

Node2Shell: Brotli Decoder RCE in Node.js (CVE-2026-111497)

Node2Shell, also called HTTP2Shell, is an out-of-bounds write in the Brotli decoder affecting Node.js, Python, Bun, Envoy and .NET. Who is affected and the fixed versions.

HHacktron Team
・October 26, 2026
vulnerability-updatesnews
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)

PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)

Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.

HHacktron Team
・October 22, 2026
vulnerability-updatesnews