Unverified50% confidenceFactExact time
Security research firm Aikido disclosed the HTTP2Shell vulnerability, tracked as CVE-2026-111497, which is related to the Brotli decompression stage and could allow attackers to achieve remote code execution.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/24/2026
First Seen
Valid until: 1/22/2027
Sources
Related Entities
Related Claims
UnverifiedAikido recommends paying attention to official patches and advisories and adding dependency scanning to CI pipelines, because the vulnerability involves the HTTP request handling path, and even if an application does not directly call Brotli it may still be passively exposed through framework default configurations.71% similarUnverifiedThe CVE-2026-90970 vulnerability exists in the GitLab AI Gateway component and allows authenticated users with access to the Duo Agent Platform to escape the prompt template sandbox via a specially crafted workflow configuration, thereby executing arbitrary commands on the AI Gateway.71% similarUnverifiedThe Log4j vulnerability (CVE-2021-44228) allows attackers to trigger a JNDI lookup via a crafted string to achieve unauthenticated remote code execution.69% similarUnverifiedCommon web application vulnerabilities are the entry points AI agents most easily exploit, including: misconfigurations, weak passwords and credential stuffing, unpatched known vulnerabilities, and missing access controls.67% similarUnverifiedRemote code execution (RCE) is one of the most damaging vulnerability types in web security.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1094256API
curl https://kongchang.com/api/v1/knowledge/claims/1094256MCP
get_claim(id=1094256)