The decoder: CVE-2026-111497 is the library, and the library is everywhere

Sunday's post on this site framed the Brotli exposure from the angle that reached community servers first — git's HTTPS transport decoding attacker-controlled responses via the CURLOPT_ENCODING alias, beside git-annex's separate autoenable problem. That framing was right as far as it went, and the week has now gone further: the flaw is in Google's Brotli decoder itself (a potential buffer overflow, CVSS v4.0 9.2, versions 1.0.3–1.2.0), so every program that decodes Brotli with that C code — however it got there — inherits the bug. The nickname started as node2shell and is now Broccoli2Shell because the blast radius refused to stay in one runtime.

What CISA added on October 27 is the part that changes posture: exploitation confirmed in the wild. CISA publishes no details about scale or targets, and the absence of detail is not the presence of safety — for catalog entries the working assumption is the opposite.

The inventory question is about the C code, not the package manager:

  • Python: brotli and brotlicffi at 1.2.1 (brotlicffi at 1.2.1.0). These arrive via transitive dependencies in web-scraping, compression-handling and API code as often as they are installed on purpose — pip list | grep -i brotli in every venv is the honest check.
  • Node.js: fixed builds are 26.12.1, 24.22.1, 22.23.4; anything running a vulnerable build decodes network data by default.
  • .NET: Microsoft shipped out-of-band runtime and SDK updates October 25 — their announcement lists the affected components.
  • Bundled C decoders: Bun, Envoy, C++ applications, PHP and Ruby extensions, Java JNI wrappers, Go cgo bindings — audit by version number against the fixed list (1.0.10, 1.1.1, 1.2.1), not by package manifest, because these link or vendor the library under their own names.
  • The classic self-host stack buys time here: Apache and Nginx do not decode Brotli in default configurations — the bug is in decoding, not encoding — which is genuine relief for the LAMP-and-Nginx installations most community servers run, and no comfort at all for the Python-side tooling installed next to them.

Two findings in the reportage deserve their own line each. OpenAI found this in February; the fix landed in the repo back then and was not labeled as a security fix, and a fixed release took until this month to appear. That is the third entry in this site's October ledger of fixes that shipped without saying what they fix — after Keycloak's one-line release note and Gitea shipping seven CVEs in a release note that names none of them — and the lesson is converging from three directions: a clean-sounding changelog entry is not an inventory of risk, and "just update" requires knowing what the update was for. Second: proof-of-concept code is public and Imperva achieved code execution on an unmodified Node build after several attempts. The reproducibility bar has been crossed; the exploitation bar has been reported crossed by CISA.

The escalation: Fragnesia, patched since May, now proven in chains

Fragnesia — CVE-2026-46300, CVSS 7.8 — is a Linux kernel privilege escalation that Microsoft warned about in mid-May, with kernel updates available since then. The October 28 KEV addition confirms what the intervening months implied: someone is using it, and the Dream Group's report shows how — a suspected AI-assisted campaign rooted 25 firewall servers across the US, Japan, Taiwan and South Korea, with php2shell as the entry and Fragnesia as the elevation step after the initial foothold. Dream did not name the product; Palo Alto Networks separately began warning Wednesday that the same php2shell bugs (CVE-2026-109618) are being used against PAN-OS, with hotfixes out.

Monday's php2shell post ended with the inventory homework — every PHP binary that can execute, visible or not. The Fragnesia entry adds the second act to that story: once arbitrary code runs, the kernel is the escalation material, and the kernel version matters even on machines with no web server at all — that is what a firewall server is. The patches have existed since May. The servers being rooted this month did not take them. Community networks that run Linux firewalls and admin boxes on long-lifespan distros: the update you deferred in June is the one the KEV catalog is now documenting as in use.

The eraser: CVSS 2.7, and how scores keep failing as triage

The same October 28 batch includes CVE-2026-41709 — a VMware ESX flaw that lets administrators perform certain operations without them being logged, scored CVSS 2.7, which Broadcom has kept at low even as CrowdStrike's legal-sector threat report attributes zero-day use of it to "Warp Panda," a China-linked group, clearing tracks inside US legal-industry vCenter environments alongside planted malware. The ESX logging patch has been out since July.

Set the three entries from these two days side by side and read the scores: a library buffer overflow at 9.2, a kernel escalation at 7.8, a trace-hiding defect at 2.7. The one with a named state-attributed actor and a sector-targeted campaign is the 2.7. CVSS measures an attack's technical ceiling in isolation; forensically, the least spectacular bug is often the one that decides whether the campaign is visible at all. Triage by score alone would have left the eraser last, and the eraser is what makes the other two survivable for the attacker.

The cadence, and what it means for volunteer-run infrastructure

Rapid7's quarterly threat report puts a number on the week's pattern: critical vulnerabilities now face attempted attacks about three days after disclosure on average, and 71 percent of observed exploit attempts fall within the first seven days. For a team with a monthly patch cycle, that is no longer a cycle — it is three maintenance windows past the point of safety. The realistic adaptation is not speed at all costs; it is deciding in advance which of your systems get same-week patching (internet-reachable decoders, PHP runtimes, kernels on anything with an SSH rule pointing at it) and which can ride the normal cadence, and then actually looking at advisories in the first three days — which is the whole reason this site publishes on them.

Patch order tonight, for the stack most readers here run: Python venvs for brotli/brotlicffi ≥ 1.2.1; Node builds to the fixed versions if any container or bot embeds one; kernel on firewalls and admin hosts to the Fragnesia-fixed versions that have been sitting in your repo since May; and if any of the vulnerable decoder versions ran exposed since the PoC went public — treat the system as compromised and act accordingly. That last instruction is CISA's standing posture for confirmed-exploited entries, not this site's dramatization.