CISA warns of hackers now exploiting critical Node2Shell flaw

CISA has issued a warning that threat actors are actively exploiting a critical vulnerability in the Brotli compression library, referred to as Node2Shell, Broccoli2Shell, and HTTP2Shell. The flaw is considered critical and has moved from theoretical risk to active exploitation in the wild. CISA's alert signals that organizations using affected Node.js or HTTP/2 implementations leveraging Brotli should treat this as an urgent remediation priority. The vulnerability allows attackers to potentially gain shell-level access to affected systems, hence the 'Shell' suffix in its common names. This type of advisory typically precedes broader exploitation campaigns and ransomware or espionage activity. Organizations are advised to patch immediately and review CISA's Known Exploited Vulnerabilities catalog for guidance.