Overview
CVE-2026-111497 is a critical buffer overflow vulnerability in Google Brotli’s decoder, affecting versions 1.0.3 through 1.2.0. A remote, unauthenticated attacker can exploit this flaw using a specially crafted Brotli-compressed stream, leading to memory corruption, sensitive data disclosure, denial of service, or potentially arbitrary code execution. This vulnerability is actively being exploited, as indicated by CISA’s confirmation of “PHP2Shell” exploitation.
Technical Analysis
- Vulnerability: Buffer overflow in the Brotli decoder (
c/dec/decode.c). The NVD record also notes an unchecked return value (CWE-252) contributing to the issue, leading to an out-of-bounds write (CWE-787). - Affected Versions: Google Brotli versions 1.0.3 through 1.2.0, across all platforms.
- Attack Vector: Remote, unauthenticated. Exploitation occurs via a crafted Brotli-compressed stream.
- Impact: Successful exploitation can lead to:
- Corrupt adjacent decoder state memory.
- Disclose sensitive memory contents.
- Cause a denial of service (DoS).
- Potentially execute arbitrary code (RCE).
- Exploitation: Publicly confirmed exploitation under the “PHP2Shell” moniker, indicating active abuse. Related community intelligence mentions “HTTP2Shell” and “Node2Shell” as well, suggesting broad applicability across different environments utilizing Brotli.
Detection
Detecting the initial exploitation of this library-level vulnerability can be challenging without deep packet inspection for malformed Brotli streams or specific application-level logging. However, successful exploitation leading to arbitrary code execution would likely manifest through post-exploitation activities.
* Process Creation Anomalies: Monitor for unusual child processes spawned by applications or services that utilize the Brotli library (e.g., web servers like Apache, Nginx, IIS, or applications like Node.js, PHP processes). Look for cmd.exe, powershell.exe, sh, bash, or other command interpreters executing from unexpected parent processes or with suspicious command-line arguments.
* File System Modifications: Look for new or modified files in web root directories, temporary directories, or system paths that could indicate webshells, malware drops (e.g., PolinRider), or persistence mechanisms.
* Network Connections: Monitor for outbound connections from vulnerable applications to unusual external IP addresses or domains, indicative of command-and-control (C2) communication or data exfiltration.
* Application Crashes: Monitor application logs for crashes, segmentation faults, or other memory-related errors that might indicate failed or successful exploitation attempts leading to denial of service.
Sigma Detection Rules
Brotli RCE – Web Server Spawns Shell
title: Brotli RCE - Web Server Spawns Shell
id: 342f0a1d-5b7e-4c8d-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects suspicious shell process creation by common web server or application processes, indicative of successful remote code execution via vulnerabilities like CVE-2026-111497.
logsource:
product: windows
service: sysmon
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\node.exe'
- '\php-cgi.exe'
- '\php.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\bash.exe'
- '\sh.exe'
condition: all of selection_parent and all of selection_child
level: critical
Brotli RCE – Suspicious Command Line from Web Process
title: Brotli RCE - Suspicious Command Line from Web Process
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious command-line arguments executed by web server or application processes, potentially indicating successful remote code execution from vulnerabilities like CVE-2026-111497.
logsource:
product: windows
service: sysmon
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\node.exe'
- '\php-cgi.exe'
- '\php.exe'
selection_keywords:
CommandLine|contains:
- 'whoami'
- 'net user'
- 'ipconfig'
- 'curl '
- 'wget '
- 'certutil '
- 'bitsadmin '
- 'powershell -enc '
- 'mshta '
- 'regsvr32 '
- 'sc.exe create'
- 'schtasks /create'
condition: all of selection_parent and all of selection_keywords
level: high
Mitigations
- Patch Immediately: Update all instances of Google Brotli libraries or binaries to the latest available patched versions: 1.0.10, 1.1.1, or 1.2.1. Prioritize systems running versions 1.0.3 through 1.2.0.
- Input Validation: Implement robust input validation and sanitization for any Brotli-compressed data processed by applications, though this is a workaround and not a full fix for the underlying library vulnerability.
- Network Segmentation: Isolate critical applications that process untrusted Brotli-compressed data to limit potential lateral movement in case of compromise.
- Least Privilege: Ensure applications and services running Brotli decoders operate with the minimum necessary privileges.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- https://github.com/andybalholm/brotli/releases/tag/v1.2.7
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497—high
- http://www.openwall.com/lists/oss-security/2026/10/23/25
- http://www.openwall.com/lists/oss-security/2026/10/24/6
- http://www.openwall.com/lists/oss-security/2026/10/26/12
- http://www.openwall.com/lists/oss-security/2026/10/26/13
- http://www.openwall.com/lists/oss-security/2026/10/26/16
- https://broccoli2shell.com
- https://www.wiz.io/blog/php2shell-exploitation-so-far
- https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles
- https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net
- https://hackread.com/cisa-confirm-php2shell-exploit-federal-agencies-patch/
- https://ltna.com.au/cyber
Indicators of Compromise
No public IOCs available at time of writing.
MITRE ATT&CK
T1190— Exploit Public-Facing ApplicationT1059— Command and Scripting InterpreterT1499— Endpoint Denial of ServiceT1003— OS Credential DumpingT1537— Transfer Data to Cloud AccountT1133— External Remote ServicesT1071— Application Layer ProtocolT1560— Archive Collected DataT1595.002— Vulnerability ScanningT1595— Active ScanningT1212— Exploitation for Credential AccessT1059.004— Unix ShellT1078— Valid AccountsT1068— Exploitation for Privilege EscalationT1027— Obfuscated Files or InformationT1573— Encrypted ChannelT1203— Exploitation for Client ExecutionT1071.001— Web ProtocolsT1074.001— Local Data StagingT1567.002— Exfiltration to Cloud StorageT1528— Steal Application Access TokenT1610— Deploy ContainerT1213— Data from Information RepositoriesT1552.001— Credentials In FilesT1552.007— Container APIT1578.004— Revert Cloud InstanceT1005— Data from Local SystemT1552— Unsecured CredentialsT1078.004— Cloud AccountsT1070.004— File DeletionT1552.004— Private KeysT1609— Container Administration CommandT1525— Implant Internal ImageT1119— Automated Collection
Generated by
gemini-2.5-flash ·2,291 input / 2,181 output tokens ·
Reviewed and approved by a human analyst before publication