Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

nayuki just now
I see some irony here. For a period of time, Google chose not to include JPEG XL in Chrome because vulnerabilities in the library could compromise the software - a legitimate concern. Yet, Google is the author of the Brotli data compression format a decade before the JPEG XL drama, and was happy to use it in Chrome and let others use the library, despite the fact that it also increases the attack surface.
netsharc 18 hours ago
Well, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
- Rapzid 15 hours ago
  I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.
  AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.
  No human reviews anything anymore so of course they aren't going to catch it.
  Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"
  - rafram 9 hours ago
    That means that it supports other services with OpenAI-compatible embeddings APIs (not just OpenAI's own API). Seems reasonable!
    Rapzid 3 hours ago
    Fortunately I didn't ask it for excuses and so it didn't give them like a pedantic junior on the spectrum.
    Which they will happily do if you ask them "why" they did something. 100% they will give their best "well actually" impression.
  - rmaxdev 11 hours ago
    LLM-based AI is a synthesis of human observed behavior
    PalmPilotProMax 5 hours ago
    But does it bring synergy with our current paradigm?
  - lifeisloving 9 hours ago
    Descriptive type names are a good thing. Id argue that one isnt that bad, but llms do take it to another level sometimes.
- super256 5 hours ago
  A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?
  (Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)
- CharlieDigital 18 hours ago
  Feels like the goal was sensationalism.
  - cromka 6 hours ago
    Something that OpenAI would coin. Just like Anthropic did with Mythos.
- rererereferred 14 hours ago
  Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.
  - kevincox 6 hours ago
    I can maybe remember CVE-2026. But there is no way I can remember 6 random digits.
    ygjb 5 hours ago
    Yeah, because the six number chunk is near the limit of recall. Don't remember CVE-2026 since the year and CVE can be reconstructed from time memory. You know it came up this year. Remember that vuln 111-497 (as two chunks) came out this year, and remembering two short chunks is easier.
  - N19PEDL2 14 hours ago
    Or EUVD-2026-108169.
- cowlevel 15 hours ago
  Actually it does, if the server is willing to decompress POST bodies.
  - croes 15 hours ago
    Brotli bodies, so Brotli2Shell
- techpression 17 hours ago
  I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
  - CharlieDigital 17 hours ago
    Specifically Brotli2Shell
    photios 16 hours ago
    google2shell would have been nice :D
    anilakar 16 hours ago
    Alt-tabbing from browser to terminal and back has always felt exhausting. Nice.
    devsda 15 hours ago
    With ad served malware, this wouldn't be the first time though :)
- reddozen 17 hours ago
  The author clearly used super intelligence.
  - Stitch4223 4 hours ago
    You and I, my friend, are the only ones in this thread not being sent to work in the glitter mines of south Arkansas as enemies of God's Country. SI has the best names, other intelligence is vastly inferior, using it is worse than many schisms of -isms combined.
- TZubiri 13 hours ago
  It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.
  Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.
- groundzeros2015 15 hours ago
  All these names are silly. It's just marketing.
  - sigmarule 14 hours ago
    There are levels of silliness, and this has achieved a new one.
pimterry 16 hours ago
Much prefer the Broccoli2Shell name & site (for the same vuln): https://broccoli2shell.com/. For starters, I'm pretty sure you can hit this without HTTP if you do any manual Brotli decoding, HTTP just happens to be the most common case that comes up.
- illusive4080 13 hours ago
  Why do critical vulnerabilities get a cutesy name and website nowadays? Who’s paying for these sites?
  - sbarre 11 hours ago
    Small static websites are effectively free (Cloudflare, GCP free tier, etc)..
    reassess_blind 10 hours ago
    Domains aren’t
    mynameisvlad 10 hours ago
    Sure, but domains aren't going to be more than $10 or $20 for the year they're relevant.
    ygjb 5 hours ago
    \o/
    1. See a vuln domain reported, clone the site. 2. Wait for it to expire and snag it. 3. Republish the site with malware 4. Watch people dither about domain names and stuff instead of taking time to fix things.
    ygjb 5 hours ago
    Sure they are. The domain you want isn't.
    GitHub.io domains, workers.dev domains, etc are all free domains.
    Clever use and abuse of some startups can get you a free domain with a signup package that you can subsequently transfer out, but those are harder to find these days.
    Seriously, the bad guys figure this out all the time.
  - cubefox 12 hours ago
    I'm certainly not complaining about some selfless guy making a helpful website without expecting anything in return!
    nicce 10 hours ago
    They excpect fame and may make things look worse than they are
    mynameisvlad 10 hours ago
    How, exactly, are they making "things look worse than they are"? By.... showing what the issue is?
    nicce 9 hours ago
    Not particularly referencing to this link, but usually severity is made more severe than it actually is. One kind of sensationalism is usually used.
    cubefox 8 hours ago
    No, they aren't. The website doesn't list an author, so fame is out of the question, and they say exactly how severe the bug is rated ("Rated 9.2 Critical (CVSS 4.0) by GitHub, High by Node.js.") right at the top.
    nicce 8 hours ago
    There is named entity in the end, and "we" statement. But yeah, I was speaking in general, not so specifically about this page. It is better than most who do this.