AI found it: OpenAI's agents turned it up in late September during a high-compute red-teaming campaign. HTTP2Shell shows why that gap matters, and how Sweet Virtual Patching protects running applications until the fixes land.
ai-devtools —
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more.
Reported by helpnetsecurity.com.
