HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

Reported by Wordfence (Alex Thomas)

Summary by Cyber Security News2 Nov 2026, 16:48 CET

About this summary. This is a short excerpt from the description that Wordfence published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/11/http2shell-wordpress-brotli/

On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. Despite the first name, the flaw does not involve the HTTP/2 protocol.

Read the full article at Wordfence →

Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.