CISA alerts on Node2Shell vulnerability exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are actively exploiting a critical vulnerability in the Brotli compression library known as Node2Shell, also referred to as Broccoli2Shell and HTTP2Shell. The agency issued an advisory on Tuesday warning that attackers are leveraging the flaw to gain remote code execution on vulnerable servers.

The vulnerability affects any system that uses the Brotli library for data compression, which includes many web servers, content delivery networks, and applications that rely on HTTP/2. By sending specially crafted requests, attackers can trigger the flaw and execute arbitrary commands on the target machine, potentially taking full control of the server. Organizations that run services behind web servers or use third‑party software that incorporates Brotli should assume they are at risk until patches are applied.

CISA’s advisory recommends that administrators apply the latest patches from software vendors as soon as they become available. In the meantime, disabling Brotli compression on affected services can reduce exposure. Network operators should monitor traffic for unusual HTTP/2 patterns and consider blocking suspicious requests at the perimeter. Users should be wary of unexpected prompts to download software or provide credentials, as compromised servers may be used to host phishing pages or deliver malware.

For individuals, the immediate steps are to keep browsers and operating systems up to date, use strong, unique passwords, and enable two‑factor authentication where possible. Free tools on ComputerScams.com, such as the Email Scam Checker, the Website Checker and the Password Breach Checker, can help you check suspicious messages, links and passwords.

The agency also urges anyone who discovers a compromised system to report it to the appropriate incident response team and to CISA’s reporting portal. Prompt disclosure helps limit the spread of the exploit and protects the broader internet community.

Stay vigilant, keep software current, and use reputable security tools to guard against emerging threats.

Source: Read the original report

Practical tip: Check that your web server software is running the latest version and disable Brotli compression until a patch is applied.