Search — “CVE-2026-111497”

Apple released security updates fixing two iMessage flaws (CVE-2026-113961 lets a remote attacker join a group chat and receive messages; CVE-2026-113960 exposes earlier messages to someone added to a group) and nine Bluetooth/AirPlay issues, with iOS/iPadOS 27.2.1 describing all three flaws. The sources state neither iMessage flaw has been confirmed exploited, and the notes do not say which devices are affected or offer workarounds. The updates also include a Google Brotli decoder fix (CVE-2026-111497) that is on CISA's KEV catalog, though the notes mention no attacks using it. No behavioral telemetry or hunting guidance is published, so the main action is patching.

Cisco updated its advisory for CVE-2026-111497, an out-of-bounds write in Google's Brotli library described as exploited, now affecting 19 Cisco products with more under investigation, and also says it has fixed CVE-2026-76506 in UCS Central. WatchGuard published advisories including critical AuthPoint Authentication Gateway authentication flaws, while Dimension remains unpatched. SonicWall says it will not fix CVE-2026-109593 (unauthenticated file read) and CVE-2026-109594 (SQL injection) in end-of-life GMS. The source does not describe any huntable attacker behavior or indicators for these flaws.

CISA added Adobe Commerce/Magento PolyShell file-upload flaw and Google Brotli Node2Shell decoder flaw to KEV on Oct 27, 2026 (due Nov 10). Sansec reports PolyShell used to breach hundreds of stores, injecting a malicious loader via a Magento CMS block that fetches and executes an attacker payload; no next-stage malware recovered. Brotli exploit attempts seen on honeypots, including public Node2Shell exploit traffic from 94.154.43[.]7. Hunt for unexpected file uploads/web shells and modified CMS blocks in Magento, and Node.js processes spawning shells or crashing after Brotli-encoded requests.

PHP reissued its official Windows builds for PHP 8.2 through 8.5 (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) to fix CVE-2026-111497, a memory-corruption flaw in the bundled Brotli library reachable through the cURL extension when automatic decompression is enabled. Guzzle sets CURLOPT_ENCODING to an empty value by default, so applications keeping Guzzle defaults may meet the condition, though The Hacker News has not tested this on Windows. The sources report no exploitation and CISA recorded none; hunters should verify the installed build via the -1 file name or SHA-256 and review HTTP clients that enable cURL decompression.

A Brotli decoder out-of-bounds write (CVE-2026-111497, dubbed Node2Shell) affects Brotli 1.0.3 through 1.2.0 and has been patched by Node.js, Microsoft (.NET, Visual Studio, PowerShell), PyPI Brotli and brotlicffi, Bun, Envoy and Istio. Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, but its exploit is not public and SecurityWeek reports no exploitation in the wild. Hunters should inventory software that bundles Brotli and prioritize patching, since running processes keep the vulnerable code until restarted or rebuilt.

Imperva demonstrated attacker-supplied code execution on an official Node.js 24.22.0 Linux arm64 image by feeding crafted Brotli data to the bundled decoder, tracked as CVE-2026-111497. Exposure paths named are Node's built-in fetch() reading Brotli-compressed responses and Express 5 body parsers (express.json, urlencoded, text, raw) decoding Brotli request bodies. Node.js released fixes on October 21; the fixed 24.22.1 rejected the same data, and no in-the-wild exploitation had been reported as of October 22. Hunters should focus on patch inventory, including container images bundling Node, rather than published behaviors, since the sources print no attack commands or detection queries.

Node.js released security updates on October 21, 2026 for its 22.x, 24.x and 26.x lines, fixing 10 flaws including CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that the project says could allow remote code execution. A public proof-of-concept reached code execution only on a deliberately weakened test build; on a standard build it produced a crash and a limited memory read, and no in-the-wild exploitation had been reported as of October 22. Exposure is where an application decompresses attacker-controlled Brotli data, such as request bodies or fetch() responses, and there is no workaround, so hunters should focus on patch status and on Brotli-decoding services rather than on attack artifacts.