Microsoft and others race to patch 'HTTP2Shell' flaw in Brotli compression library

Summary

Microsoft and other vendors are scrambling to patch a flaw dubbed 'HTTP2Shell', which TechRadar says could become the next PHP-level issue, and a related Node.js problem may also affect millions of sites. The flaw is a remote code execution (RCE) vulnerability in Brotli, an open source data compression algorithm built by Google.

Timeline

1. TechRadar

   27 Oct 2026, 18:45 UTCSource ↗

   TechRadar reports that Microsoft and others are scrambling to patch the 'HTTP2Shell' flaw, which it says could be the next PHP-level issue, and that a Node.js problem may also affect millions of sites.