⚠️ ALERT: “HTTP2Shell” raises fresh concerns after the PHP warnings leaving Google’s Brotli compression library potentially vulnerable. Discovered by OpenAI’s security team, CVE-2026-111497 affects software that decompresses malicious Brotli data, with risks extending beyond Node.js and Python. The flaw can cause crashes, expose sensitive memory or potentially enable remote code execution BEFORE authentication in affected setups. Researchers have demonstrated code execution in a vulnerable Node.js application. Fixes are available, but not for every affected package. Users are urged to check bundled dependencies and upgrade to Brotli 1.2.1 or your vendor’s patched release.