On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. Despite the first name, the flaw does not involve the HTTP/2 protocol. It has a CVSS v4.0 score of 9.2 out of 10. A specially crafted Brotli stream can corrupt memory. If an attacker can make a vulnerable network-facing process decode it, the flaw can lead to unauthenticated remote code execution.
This is not a vulnerability in WordPress Core, a plugin, or a theme. However, WordPress
