{"type":"post","id":"cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4","slug":"cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4","title":"CISA adds Brotli flaw CVE-2026-111497 (Node2Shell) to KEV as honeypots log first in-the-wild exploit attempts","description":"CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog.","retrieval_nugget":"CISA has added the Brotli decoder vulnerability CVE-2026-111497, also called Node2Shell, to its Known Exploited Vulnerabilities catalog.","published_at":"2026-10-28","updated_at":"2026-10-28","record_date":"2026-10-28","date_kind":"published_at","topics":["google"],"entities":["CISA","Brotli","Node2Shell","Node.js","OpenAI","Broadcom","VMware Cloud Foundation","ELLIO"],"related_patterns":[],"novelty_label":"new_fact","what_changed":"CISA added CVE-2026-111497 to KEV with a November 10 federal remediation deadline, while honeypots reported new exploitation attempts.","prior_refs":["memory:7d323280-7bea-858b-a67e-e81be0c917f4","memory:2ec195eb-13e9-8ae3-a850-d1c3b4f6ccaf"],"source_url":"https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts","source_urls":["https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4/","markdown":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4.md","json":"https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4.json"},"next_reads":[{"type":"topic","path":"/topics/google/","url":"https://newruntime.com/topics/google/","title":"Google","reason":"Explore the google topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/google.md","json_url":"https://newruntime.com/topics/google.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}