KR — 전자신문

Tioli Releases Emergency Response Guide for 'Node2Shell'

SecurityOctober 26, 20261 min read

Tioree, a Korean cybersecurity firm, tested a Node.js security flaw called Node2Shell and released a response guide. The flaw lets attackers break Node.js servers using specially crafted compressed data.

What happened

On the 26th, Tioree said it had rebuilt and checked the Node2Shell flaw (CVE-2026-111497) on its own. The flaw was made public on the 21st. Tioree also released a guide that explains how to respond and a free online checking tool called Node.js Guard.

How the flaw works

Node.js is widely used to build websites and back-end systems. The problem is in the code that unpacks data compressed with Brotli, a tool that makes web data smaller. Normally, bad data should be rejected as an error. But the weak code sometimes keeps going with bad data. This can let data be written outside its safe memory area.

Key facts

Node.js rates the risk as High.
Affected versions: Node.js 22.x, 24.x and 26.x without the security patch.
Fixed versions released on the 21st: 22.23.4, 24.22.1 and 26.12.1.
The flaw comes from Node.js itself, not from the code a developer writes.

What could happen

When memory is damaged, a server program can crash or leak memory information. In some conditions, an attacker could run code on the server from a distance. Not every Node.js server is at risk. An attack works only when malicious compressed data from outside reaches the weak unpacking code.

Why it matters

Many companies run Node.js servers, so the risk is wide. Developers may be exposed even if they never use compression directly, because web frameworks may use it inside their data handling. Tioree says companies that cannot update right away should use temporary fixes, and should also install the latest security patch.

Glossary

Node.js: A tool that lets programmers run JavaScript on servers to power websites and apps.
Node2Shell: The name of the Node.js security flaw found in how Node.js unpacks Brotli-compressed data.
Brotli: A compression method that makes web data smaller so it moves faster.
Tioree: A Korean cybersecurity company that tested the flaw and published a response guide.
Node.js Guard: A free online tool from Tioree that checks whether a service URL may be exposed to the flaw.

Same story, different eyes

The EngineerAI

Your app can be exposed even if you never call compression

What caught my eye as an engineer is that the bug lives inside Node.js's Brotli decompression, so a web framework quietly unpacking request data can be enough to route a malicious payload to it. That makes it hard to answer "are we affected?" just by reading your own code, which is probably why a URL-based checker like Node.js Guard is so handy. For the team, the tricky part is likely that a bad stream has to be rejected cleanly without slowing down normal traffic, and I'm curious how well the reverse-proxy workarounds hold up in real production setups, which isn't known yet.

The UserAI

You may be exposed even if you never touch compression code

What caught my eye is that this issue sits inside Node.js itself, so a web framework quietly decompressing data for you can be enough to put you in the path. If you run Node.js 22, 24, or 26, the most practical step today is checking your version and moving to 22.23.4, 24.22.1, or 26.12.1. If an update has to wait for a release window, the reverse proxy and application-level workarounds plus the free Node.js Guard check could buy you some time. Most teams should be able to feel the difference as soon as the patched build is deployed, though how many services are actually reachable is not yet known.

The SkepticAI

Patch versions and a free scanner give you two ways to check your own exposure

The fixed versions (22.23.4, 24.22.1, 26.12.1) make it easy to confirm with a quick version check whether a server is covered. The article also says the attack only works when malicious compressed data actually reaches the vulnerable module, so it's worth looking at which of your services accept outside input through a web framework, even if you never call compression yourself. A free tool like Node.js Guard could be a handy second opinion, and it would be reassuring to know how its results line up with a manual review. How the temporary reverse proxy measures perform in practice isn't known yet.

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.

Security전자신문Oct 26

Election Deepfakes Up 27% Worldwide; South Korea Ranks Third in Cumulative Cases

Reported AI-generated election deepfakes surged worldwide, with January to September 2026 cases already exceeding last year's full-year total by 27%, according to a Surfshark study. South Korea ranks third globally in cumulative cases with 16 since 2021, behind the United States and India. The study counted 235 cases across 46 countries from January 2020 to September 2026.

SecurityVnExpressOct 25

Lost $10,000 and Nearly Her Home to a Fake 'Bon Jovi' Online

Louisiana resident Leslie Pickett spent months chatting with a scammer posing as rock star Jon Bon Jovi, who used AI-generated photos and videos to gain her trust. The story is featured in National Geographic's documentary Super Scam Me, where journalist Mariana van Zeller investigates online scams.