What happened
In an October 29, 2026 post, Check Point Research argues that CVE-2026-111497 should not be treated as only a Node.js vulnerability. The issue is associated with Brotli decompression, so the relevant exposure may sit in Python Brotli packages, Bun, .NET, Envoy, Istio, or software that bundles or statically links affected Brotli code. The post calls the vulnerability HTTP2Shell, while noting that it was initially known as Node2Shell. Despite the name, Check Point says the HTTP/2 protocol itself is not vulnerable.
The post frames exposure as a combination of two conditions: an affected Brotli implementation is present, and attacker-controlled Brotli-compressed data can reach its decoder. That data could arrive through untrusted compressed requests, external responses, files, or other inputs. Check Point advises teams to search across applications, cloud and container environments, and supporting infrastructure rather than relying on application-level inventories alone. Its suggested sequence is to discover affected components, assess reachability, patch, redeploy, and hunt for suspicious activity. It gives no new product-specific fixed versions or pricing information in the supplied material.
Check Point also reports telemetry from its IPS associated with a Node.js Brotli remote-code-execution signature. In the analyzed events, 90.5% contained Brotli-encoded HTTP payloads; 33.8% carried the Patrowl automation fingerprint; and 24.5% targeted upload and ingestion endpoints. The researchers also observed malformed binary payloads, unusual HTTP framing and HTTP 500 responses. Check Point says these indicators warrant investigation but do not confirm successful exploitation. It explicitly limits the percentages to its analyzed telemetry, not all attacks or global activity.
The post separately notes that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 27, based on evidence of active exploitation. Check Point distinguishes that evidence from its own telemetry: its reported events show automated probing and suspicious payload activity, not confirmed compromise. Its practical emphasis is therefore on breadth of component discovery and reachability, rather than assuming every system containing Brotli is equally exposed.
What the archive adds
This is a new fact in an existing vulnerability story, not a restatement. Our earlier coverage of the disclosure and affected components established the Brotli decoder issue and deployment guidance. Later, Tenable reported public PoCs and an attempted exploitation, and CISA's KEV listing recorded a federal remediation deadline. Check Point adds a broader implementation inventory and telemetry measurements, with an explicit caveat that its observed events do not establish compromise.
Trend signal
The story supports the security pattern that runtime and deployment boundaries determine agent and software risk: agent security moves to runtime boundaries. The immediate lesson is narrower than agent security: a vulnerable decoder matters when untrusted input can reach it. This makes runtime placement, dependency discovery and reachable data paths more informative than a package-name checklist alone.
Why now
The post appeared after CISA added CVE-2026-111497 to its KEV catalog on October 27. Check Point says that listing reflects separate evidence of active exploitation. Its own telemetry adds evidence of automated probing, making component discovery and reachability assessment timely; it does not establish that the events in its telemetry caused compromises.
Connections to other events
Earlier Telegram coverage described the original Brotli decoder disclosure, Bun's fix, and the later KEV listing and honeypot-reported attempts. Check Point's update connects those developments to a broader operational question: where else is vulnerable Brotli embedded, and can external data reach it? The post also says the issue followed PHP2Shell, while stressing that the vulnerabilities are technically unrelated; their shared lesson is dependency visibility below the application layer.
Why it matters
Teams that search only for Node.js may miss exposure in libraries, proxies, service meshes, containers or statically linked software. Conversely, simply finding Brotli does not establish that a system is exploitable: reachability of the affected decoder is the prioritization question Check Point emphasizes. That distinction can make incident response more useful by directing attention first to internet-facing services and systems that automatically decompress external data.
The telemetry figures can justify checking logs and defenses for automated probes, but they should not be turned into a claim that a given share of systems was compromised. Check Point presents them as proportions of its analyzed IPS events, and says malformed payloads and server errors are signals for investigation, not proof of successful exploitation. Security teams should keep those evidence categories separate while patching reachable affected components.
Limits and uncertainty
Check Point does not provide a global estimate of scanning, a denominator for the number of exposed systems, or evidence that the reported IPS events resulted in successful compromise. Its percentages describe only the telemetry analyzed for this assessment. The post names potentially relevant runtimes and infrastructure but does not provide product-by-product affected ranges or fixed versions in the supplied material. It also does not establish reachability for any particular deployment; teams must assess their own data paths and component versions.
Skill to build now
Build a dependency-and-reachability checklist for compressed-data decoders. Inventory Brotli implementations in application dependencies, runtime distributions, proxies, service meshes, container images and statically linked binaries; record version and patch status. For each exposed service, trace whether attacker-controlled requests, files or external responses can reach decompression. This turns Check Point's two-part exposure model into a repeatable triage step rather than a broad package scan.
Reader takeaway
Treat CVE-2026-111497 as a Brotli implementation and reachability problem, not just a Node.js problem. Check Point's telemetry shows probing, but not confirmed compromise in those events. Inventory embedded decoders, determine which can receive untrusted compressed data, and prioritize those systems for remediation and investigation.