Does your site or checkout run on Node.js? Researchers just showed a takeover. Update today.

Update, November 3, 2026

The Brotli flaw now has a documented route into WordPress sites. Public lab work has shown it crashing a WordPress site's PHP process and, in one specific setup, running a command. WordPress does not ship Brotli, so updating WordPress, plugins or themes does not fix it. The fix is the Brotli library on the server, then a restart. We found no report of an attack on a WordPress site, and a lab result is not an attack.

• How it reaches WordPress. Patchstack, Fortbridge and Wordfence describe the same route. A pingback is a WordPress feature that lets one site tell another that it links to it. Anyone can send a pingback request to a site's xmlrpc.php file without an account, and WordPress then fetches the web address it was given. If the server at that address answers with a specially crafted compressed reply, the decompression code on your own server (libcurl, using its Brotli library) can be made to corrupt memory. The harmful data comes back in the reply, not in the request, so Patchstack says there is nothing unusual in the request for a web firewall to catch. Patchstack says a standard WordPress install has XML-RPC on, pings open and at least one post that accepts them, and that many managed hosts already block xmlrpc.php. Wordfence lists what the route needs: XML-RPC reachable, pingbacks switched on, a post that accepts pings, a server that is allowed to make the outbound request, and an affected Brotli library. We leave out the technical details. (Patchstack, Fortbridge, Wordfence)
• WordPress does not ship Brotli. Patchstack says WordPress uses whatever Brotli the operating system provides, through libcurl, on every outbound request, so there is nothing to update in WordPress and no plugin to upgrade. Wordfence says updating WordPress, a plugin or a theme does not update this server-level library, and that the WordPress version shown in Site Health cannot tell you whether you are exposed. Fortbridge says updating WordPress alone is not a demonstrated fix. (Patchstack, Wordfence, Fortbridge)
• Crashes are reproducible. Patchstack said on October 30 that crashing a PHP worker is easy and works on any build, so one request can kill a worker and a few hundred can keep a site down. It points to a public lab, published October 27, that killed a worker and pinned another at full CPU with a tiny payload, and says that lab included no code execution. (Patchstack)
• Running a command: lab only, in one setup. On October 30, Patchstack said no public chain aimed at PHP behind Apache or FPM yet. That is out of date. A public proof of concept built for one specific WordPress setup was posted on GitHub on October 28, according to its repository record, and we do not link it. On November 2, Fortbridge published a write-up in which a WordPress 7.1.3 image in its lab returned the output of a harmless identity command run by the web server's own account. Fortbridge also used a debugger in a separate run to watch the memory change, and that run returned the same output. Fortbridge presents the plain run as its direct result. Also on November 2, Wordfence reproduced the public proof of concept in an isolated lab on WordPress 7.1.3, Debian 13.7, Apache and PHP 8.3.36, with Debian's vulnerable libbrotli1 1.1.0-2+b7. It ran code there, and stopped running code once only Brotli was patched. Wordfence says the same payload did not run code on PHP 8.3.35, where it crashed a PHP worker in one environment, so it is not a universal attack, and that it has not shown the attack adapted to an arbitrary server. Wordfence adds that attackers could still target sites that share the same server image. These are lab results, not attacks on real sites. (Patchstack, Fortbridge, Wordfence)
• No attacks on WordPress sites reported. Wordfence says the public reports it reviewed through November 2 do not document a successful attack on a live site, or any attack through WordPress. Its own code execution result came from a lab, not from a real site, and it notes that the absence of a public case does not mean none has happened. (Wordfence)
• CISA still lists the flaw as exploited. CISA's own CISA KEV catalog lists CVE-2026-111497, a Google Brotli flaw, since October 27, with a due date of November 10, 2026 for US federal civilian agencies. We checked the catalog directly on November 3: the newest version is dated October 30, 2026 and still lists it. CISA's entry does not name an affected application, an attack route or a victim, and it does not say whether WordPress is involved. Previdian says it last saw attack attempts on November 2, and that its data does not show whether the targets were vulnerable or the attempts succeeded. (CISA KEV catalog, Wordfence, Previdian)
• Check the package revision, not just the version. Debian and Ubuntu fix this inside the existing 1.1.0 package, so a patched server can still report Brotli 1.1.0. Upstream's fixes are 1.0.10, 1.1.1 and 1.2.1 (see the October 24 update). On Debian 13, Debian lists the unpatched source package 1.1.0-2 as vulnerable and 1.1.0-2+deb13u1 as fixed. Patchstack and Wordfence name 1.1.0-2+b7 as the vulnerable revision in their tests, a revision that Debian's tracker does not list. Our October 24 note said Ubuntu had no fix yet. That has changed: Ubuntu now lists fixed brotli packages, including 1.1.0-2ubuntu0.1 for Ubuntu 24.04 and 1.0.9-2ubuntu0.1 for Ubuntu 22.04. (Patchstack, Wordfence, Debian, Ubuntu)
• Docker images. Wordfence says restarting an existing container does not replace the vulnerable files inside it, so rebuild and redeploy. Patchstack said on October 30 that wordpress:latest still installed a vulnerable libbrotli1. We could not reproduce that. On November 3 we read the package list inside the amd64 images behind Docker Hub tags latest, fpm and php8.3-apache: all three were built on October 28 and carry libbrotli1 1.1.0-2+deb13u1, the fixed revision. We did not check other tags or architectures, and your own image may be older or built on another base. (Wordfence, Patchstack, Docker Hub)

What to do

This is for whoever runs the server. If you are on managed WordPress hosting, ask your host whether every Brotli copy used by your site contains the fix and whether the affected services were restarted or redeployed. Wordfence's wording of the question: "Is the process serving my WordPress site using a Brotli decoder patched for CVE-2026-111497, and were all affected services restarted or redeployed after the update?" If you run your own server, install the security update from your operating system or platform vendor, check the full package revision, and restart Apache, PHP-FPM or whatever loaded the old library. On Debian and Ubuntu, Patchstack gives this check, which prints the installed revision:

dpkg-query -W -f='${Version}\n' libbrotli1

If you use containers, rebuild from an updated base image and redeploy. Wordfence warns that some platforms, CloudLinux for example, can hold separate system, web server or bundled PHP copies of Brotli, and that updating one copy may not update the others. Agencies and hosts should check every production, staging and older environment.

Stopgaps, not fixes. Patchstack says none of these fixes the bug. They only cut off ways to reach it while you arrange the real update, and Wordfence warns that changing XML-RPC or pingback behavior may disrupt legitimate integrations. Test first.

• Remove pingbacks. Patchstack's snippet, for a must-use plugin or your theme's functions.php, removes the pingback methods. The common xmlrpc_enabled filter does not close this route: the WordPress developer documentation says it only controls methods that require a login and does not control pingbacks. Wordfence says its own "Disable XML-RPC authentication" option does not disable unauthenticated pingbacks either.

  add_filter( 'xmlrpc_methods', function ( $methods ) {
      unset( $methods['pingback.ping'] );
      unset( $methods['pingback.extensions.getPingbacks'] );
      return $methods;
  } );

• Or block xmlrpc.php at the web server. Patchstack gives these rules, for Apache 2.4 and for nginx. Blocking it closes only the pingback route.

  <Files xmlrpc.php>
      Require all denied
  </Files>
  
  location = /xmlrpc.php {
      deny all;
  }

• Or tell WordPress not to ask for compressed replies. Patchstack's snippet stops libcurl from decompressing outbound responses, so the Brotli decoder is never handed a hostile reply. Patchstack says this covers pingbacks, oEmbed, feeds and plugin fetches in one go, and that WordPress still unpacks gzip itself if a server sends it anyway.

  add_action( 'http_api_curl', function ( $handle ) {
      // Don't let libcurl auto-decompress responses, so the Brotli
      // decoder is never handed an attacker-controlled body.
      curl_setopt( $handle, CURLOPT_ENCODING, 'identity' );
      curl_setopt( $handle, CURLOPT_HTTP_CONTENT_DECODING, 0 );
  }, 10, 1 );

Patchstack says plugins or themes that fetch an address a visitor supplies, oEmbed and feed fetching can also reach the decoder, so closing pingbacks narrows the exposure and does not remove it. Wordfence advises keeping your web server, PHP, process, firewall and outbound network logs from before the public disclosure until each environment was patched and restarted, and, if patching was delayed, looking for unexpected pingback requests, unusual outbound connections and PHP or web server crashes and restarts. These are not proof of an attack, and their absence is not proof that nothing happened. If you find signs of a break-in, Wordfence says to contain the system before you rotate database passwords, API keys, WordPress salts and other secrets. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which Brotli library your server uses, whether pingbacks are open or whether your services were restarted. (Patchstack, Wordfence, WordPress developer documentation)

Update, October 28, 2026

CISA lists this flaw as exploited, two security firms say they recorded real attack attempts, and Broadcom says VMware's SDDC Manager is affected with no patch yet. If your site, store, API or VMware Cloud Foundation setup runs Node.js, or any program that carries Brotli, act now. Our earlier updates said no attacks had been reported. That is no longer true.

• CISA lists it as exploited. On October 27, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog "based on evidence of active exploitation." CISA lists it as a Google Brotli flaw, the compression library inside Node.js and many other programs. US federal civilian agencies must fix it by November 10, 2026. That rule applies only to federal agencies, but CISA says it "encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." CISA's notice does not say who is being attacked or how. (CISA, CISA KEV catalog, SecurityWeek)
• A real attack attempt, recorded by ELLIO. ELLIO, a security lab that watches for scanning and mass attacks, says its sensors recorded a single web request of about 23 megabytes at 11:08 AM ET on October 26, aimed at one specific build, Node.js 24.22.0 on x86-64. ELLIO says the part of the request that delivers the attack matched public exploit code, while the final step that would take over the program was written by the attacker. (ELLIO, SecurityWeek, Help Net Security)
• What we cannot say about it. ELLIO's report describes an attempt. It does not report any server taken over. ELLIO says the attacker's final step looked unfinished: in its lab, that attacker's version produced no shell, meaning no command prompt on the attacked server, in 50 tries, while ELLIO's own version built on the public approach did. ELLIO calls it "likely a first-generation attempt." ELLIO's one-line summary at the top of its post is stronger than its own detailed analysis, and we follow the analysis. Tenable said on October 26 that it has not independently confirmed ELLIO's activity. (ELLIO, Tenable, SecurityWeek)
• A second sighting, from Previdian. Previdian, a company that tracks attacks with its own sensors, says it recorded one exploitation attempt on October 27, from one source address in the United States, seen by one sensor, and rates its confidence in the exploitation "Confirmed." Previdian explains that this rating "does not mean the attempt succeeded," and that its sensor counts "do not show that the target was vulnerable or that the attempt succeeded." This is a different date from ELLIO's, and we cannot tell whether it is the same attacker. (Previdian, SecurityWeek)
• Why ELLIO calls it a warning. ELLIO says the address that sent its request had earlier been seen sending exploits for the PHP2Shell flaws and probing Palo Alto Networks and Fortinet VPN devices and Kubernetes systems, which it says "is indicative of the RCE being adopted by an operator focused on mass exploitation." That is ELLIO's assessment. (ELLIO, SecurityWeek)
• VMware Cloud Foundation is affected, and the patch is not out. Broadcom's Broadcom advisory VMSA-2026-0008 (issued October 27, updated October 28) says SDDC Manager, a management component of VMware Cloud Foundation, contains this flaw because it uses Node.js, and that "a malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code." Broadcom rates it Critical, CVSS 9.8, for SDDC Manager 9.1.1, and Important, CVSS 7.5, for 9.0.x, 9.1.0 and 5.2.x. Its table says "Patch pending" for every affected version, and points to interim workarounds in two knowledge base articles: KB460732 for 9.1.1 and KB460734 for the older versions. Broadcom's scoring vector for the older versions assumes an attacker on the same network segment and a harder attack, which fits the lower score. The advisory does not say the flaw is being exploited. (Broadcom advisory VMSA-2026-0008, SecurityWeek)
• Old Node.js lines will not be fixed. Help Net Security and ELLIO say Node.js 20.x, 23.x and 25.x are also affected and will not get a fix. Node.js says end of life versions are always affected when it ships security fixes. If you run one, move to a supported line. (Help Net Security, ELLIO)
• Correction: we said no attacks were reported. That is no longer true. Our October 24 and October 26 updates, our October 26 afternoon update and the "Has my business been hacked?" answer said no attacks had been reported and that the flaw was not on CISA's list. That was true when we wrote it. We have marked those items. (CISA KEV catalog)

What to do

The fix has not changed, but it is now urgent. Update every Node.js runtime to 22.23.4, 24.22.1 or 26.12.1 or later, rebuild container images and restart the processes, because Tenable says a restart or container rebuild is required. ELLIO notes that Node.js reports its bundled Brotli version as 1.2.0 on both patched and unpatched builds, so check the Node.js release number, not the Brotli number. Also update the other software that carries its own copy: Bun 1.4.4, fixed Envoy and Istio releases, Python's Brotli 1.2.1 and brotlicffi 1.2.1.0, Microsoft's October 25 .NET updates, and PHP's Windows -1 builds, all described in the updates below. If you run VMware Cloud Foundation: ask your VMware administrator today to apply Broadcom's interim workaround for your SDDC Manager version from KB460732 (9.1.1) or KB460734 (9.0.x, 9.1.0, 5.2.x), to watch the Broadcom advisory for patches, and, as our own advice, to keep network access to SDDC Manager limited to the administrators who need it. The workarounds are temporary and change files on the appliance, so follow Broadcom's steps exactly and back up first. Until you can update Node.js, Tenable lists blocking requests marked Content-Encoding: br at your proxy or load balancer, which does nothing for responses your app fetches from other servers. Tenable also warns that removing br from your own Accept-Encoding header is not enough on its own. ELLIO says failed attacks usually crash the Node.js process, so repeated unexplained restarts on a server that has not been updated are worth a look. They are not proof of an attack. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which Node.js, Bun, .NET, Brotli or VMware version your servers run, or whether anyone has attacked them. (CISA, Broadcom advisory VMSA-2026-0008, Tenable, ELLIO)

Update, October 26, 2026, afternoon

PHP on Windows needs a new download. PHP has rebuilt its official Windows packages to include the fixed Brotli code. If your site runs PHP on a Windows server, last week's PHP2Shell update does not fix this flaw. Install the new "-1" build.

• New Windows builds. On October 26, PHP announced updated Windows builds, PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. They include Brotli 1.2.1, which fixes CVE-2026-111497. PHP says they use the same PHP source releases, so the PHP2Shell fixes from October 21 stay in place, and the PHP version itself does not change. (php.net, The Hacker News)
• How the bug is reached. PHP says that in its Windows builds the bug can be reached through the cURL extension when automatic HTTP response decompression is turned on. cURL leaves that off by default, but applications and HTTP client libraries can turn it on. The Hacker News says an attack would come as a crafted compressed response from a server the PHP app contacts. (php.net, The Hacker News)
• Guzzle may turn it on for you. The Hacker News reports that Guzzle, a PHP HTTP client library, turns this decompression on by default for requests it sends through cURL, based on the code in its 7.16.1 and 8.3.1 releases. It says an app that keeps Guzzle's default settings meets the condition for reaching the flaw on last week's Windows builds, but that it has not tested this on a Windows system. (The Hacker News)
• Last week's builds carry an affected version. The Hacker News says PHP's own component lists for last week's x64 Non Thread Safe Windows builds of all four versions show Brotli 1.2.0, one of the affected versions. (The Hacker News)
• How to tell you have the new build. Because the PHP version is unchanged, php -v shows the same number before and after. The Hacker News says the "-1" in the file name, as in php-8.5.12-1-nts-Win32-vs17-x64.zip, and the SHA-256 checksum listed on PHP's downloads page identify the new build. (The Hacker News)
• Exploit code is out. Attacks have since been reported; see the October 28 update above. As of October 26, BleepingComputer reported that proof of concept exploits for this flaw have been published, "but there are no reports of malicious exploitation in the wild." PHP's notice does not mention any attacks. (BleepingComputer, php.net)
• More Python apps to check. BleepingComputer says affected software includes the Python HTTP clients urllib3[brotli], requests, httpx and aiohttp[speedups] when they are set up with a vulnerable Brotli decoder. The fixed Python packages, Brotli 1.2.1 and brotlicffi 1.2.1.0, are in the morning update below. (BleepingComputer)

What to do

If your site runs PHP on Windows, ask your developer or host to install the new -1 build for your PHP version from PHP's downloads page, then restart PHP. PHP's notice offers no workaround. Until the new build is in, The Hacker News, citing OpenAI's advice to turn off automatic Brotli decompression, says that means not setting CURLOPT_ENCODING in PHP code, or setting Guzzle's decode_content option to false, which also stops gzip responses from being unpacked. PHP's notice covers its Windows builds only. For any affected software, BleepingComputer says to restart affected processes after updating and to rebuild and redeploy container images. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which PHP build, Brotli version or HTTP client settings your servers use. (php.net, The Hacker News, BleepingComputer)

Update, October 26, 2026

Microsoft has rushed out fixes for the same Brotli bug in .NET. If your site, store or checkout runs on .NET or ASP.NET Core, ask your developer to install Microsoft's October 25 update. Microsoft says an attacker who does not need to log in could read or corrupt the app's memory.

• Emergency .NET updates. On October 25, Microsoft released out-of-band security updates, outside its normal schedule, for CVE-2026-111497: .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3. Microsoft says the bug "may allow an unauthenticated attacker to read or corrupt process memory," which "could lead to information disclosure, denial of service, or elevation of privilege." It rates it 8.1 out of 10, High, on the CVSS 3.1 scale. The older .NET Framework is not affected. (Microsoft .NET Blog, Microsoft advisory)
• Who is exposed. Microsoft says an app "is not exposed merely because an affected .NET package is installed." It is exposed only if it unpacks Brotli data an attacker controls in one of three ways: ASP.NET Core request decompression with Brotli (br) turned on, HttpClient automatic response decompression that includes Brotli, or code that uses the BrotliStream or BrotliDecoder APIs directly. Microsoft says request and response decompression are not turned on by default. (Microsoft advisory)
• More Microsoft fixes. SecurityWeek reports that Microsoft also updated Visual Studio 2019, 2022 and 2026 and PowerShell 7.4, 7.5 and 7.6 for the same bug. (SecurityWeek)
• Python packages too. SecurityWeek reports that the Brotli decoder is built into two Python packages, Brotli and brotlicffi, which are fixed in versions 1.2.1 and 1.2.1.0. (SecurityWeek)
• Superseded: attacks have since been reported. As of October 26, SecurityWeek reported that "No exploitation in the wild has been reported so far," and the flaw was not on CISA's list of known exploited flaws in the version dated October 23, checked October 26. CISA added it on October 27 and ELLIO and Previdian reported attack attempts; see the October 28 update above. (SecurityWeek, CISA KEV)

What to do

If your site or store runs on .NET or ASP.NET Core, ask your developer to install Microsoft's October 25 update and restart the app. Microsoft says apps that carry their own copy of .NET must be rebuilt and republished, and containers rebuilt on updated .NET images, because installing a newer .NET on the server does not update those. Until the update is in, Microsoft says to stop decompressing untrusted Brotli data, for example by removing br from request decompression settings you already use. Microsoft warns not to add decompression settings that are not already there, because turning on automatic decompression can bring its own risks. The Node.js, Bun, Envoy and Linux advice below is unchanged. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which .NET version your servers run or whether your app unpacks Brotli data. (Microsoft .NET Blog, Microsoft advisory)

Update, October 24, 2026

The same bug sits in other software that carries its own copy of Google's Brotli library. Bun, Envoy and some Linux distributions have now shipped fixes. If your site runs on Bun, sits behind an Envoy proxy, or runs on a Linux server, update those too, not just Node.js.

• It is a Brotli library bug. The CVE record says the flaw is in the decoder of Google's Brotli library, versions 1.0.3 through 1.2.0, and is fixed in 1.0.10, 1.1.1 and 1.2.1. It says a crafted compressed stream could crash a program, leak memory contents or potentially run attacker code. Every program that bundles its own copy has to ship its own fix. (CVE record via OSV)
• Bun. On October 23, Bun said versions 1.0.21 up to 1.4.3 carry an affected Brotli and that Bun 1.4.4 fixes it by moving to Brotli 1.2.1. Bun's built in fetch asks for Brotli and unpacks it automatically, so a server your app connects to could send the bad data, as could someone in the middle of an unencrypted connection. Programs built with bun build --compile stay affected until they are rebuilt with 1.4.4. Bun says it has not tested an attack against Bun but to treat this as a remote code execution risk. There is no global workaround; passing decompress: false to fetch protects only that one request. (Bun)
• Envoy. On October 23, the Envoy proxy project rated its version of the bug critical, 9.2 out of 10. It names Envoy 1.39.2, 1.38.5, 1.37.7 and 1.36.11 as vulnerable and fixes them in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Envoy says only setups with its Brotli decompressor configured are affected. (Envoy)
• Linux server packages. Debian fixed its brotli package on October 23 for Debian 12 (version 1.0.9-2+deb12u1) and Debian 13 (1.1.0-2+deb13u1). Alpine lists fixed brotli packages for Alpine 3.21, 3.23 and 3.24. As of October 24, Ubuntu lists its brotli packages as "Needs evaluation", so there is no Ubuntu fix to install yet. Distributions often fix older version numbers in place, so check for your distribution's security update rather than for Brotli 1.2.1. Debian notes that its own Node.js package uses the system Brotli library. (Debian, Alpine via OSV, Ubuntu)
• Superseded: attacks have since been reported. As of October 24, none of these advisories reported attacks, and the flaw was not on CISA's list of known exploited flaws in the latest version we checked, dated October 23, 2026. CISA added it on October 27; see the October 28 update above. (CISA KEV)

What to do

Ask your developer, agency or host three things: is any app on Bun, and is it on 1.4.4 or later with every compiled Bun program rebuilt? Does anything run Envoy with Brotli decompression, and is it on a fixed release? Have the Linux servers had their brotli security update, where one exists? The Node.js advice below is unchanged. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which Bun, Envoy, Node.js or Brotli version your servers run. (Bun, Envoy, Debian)