While everyone was looking at PHP, another RCE is wrecking what's left of the internet

A severe memory-corruption flaw in Google's widely used Brotli compression library, tracked as CVE-2026-111497, is quietly causing more disruption than last week's PHP remote-code-execution bugs. The bug lets attackers send specially crafted Brotli-compressed data to trigger an out-of-bounds write and achieve unauthenticated remote code execution on any server, app, or proxy that decompresses Brotli content. Because Brotli is embedded in countless libraries across languages, the impact is enormous: Node.js shipped the first fix, followed by patches for several Python Brotli bindings, the Bun runtime, the Envoy proxy, and the Istio service mesh, with more projects expected to follow. The flaw has picked up several competing nicknames (Node2Shell, HTTPS2Shell, Brotlipocalypse), but security teams recommend using tools like Trail of Bits' brotli-checker to find vulnerable code and apply available patches as soon as possible.