Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
CVEVerifiedSignal 82/100EPSS 32.8%
CVE-2026-111497
Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Found in 10 reports: PHP2Shell Was Exploited Before the Patch; eMudhra, Brotli, and the Long Tail of a Security Fix; CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder · all 10 reports
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
EPSS Score
32.78%
EPSS Percentile
98.3th
Confidence
89%
Signal Score
82 / 100
IDS Rule
No
CVE Intelligence
Exploit Probability32.78%
98.3th percentile of all CVEs
Threat Context
Feed Intelligence Summary
10 reports89% confidence
Rapid7
Yesterday
1 IOC in report
Wiz
2d ago
1 IOC in report
ORKL Threat Library
Jan 1, 1
74 IOCs in report
Activity Timeline
Threat Activity Heatmap
Related Reports
PHP2Shell Was Exploited Before the Patch
Sekoia Blog6 IOC
eMudhra, Brotli, and the Long Tail of a Security Fix
Socket Security1 IOC
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Rapid71 IOC
The Pwn Request Reckoning: What Still Works Against GitHub Actions
Wiz2 IOC
Node2Shell: Brotli Flaw Hits Python Packages
SOCRadar3 IOC
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Wiz6 IOC
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Wiz1 IOC
CVE-2026-111497 Brotli Bug Reaches Far Beyond Node.js
OpenSourceMalware1 IOC
Python Packages Vulnerable to Node2Shell Brotli CVE
OpenSourceMalware1 IOC
⚡ Weekly Recap: This2shell, That2shell, Everything's an Rce? Rogue Ai, Supply Chain Chaos and More
ORKL Threat Library74 IOC