ELLIO Threat Research Lab
ellio-threat-research · B · candidate
Added 2026-10-28 (S1): first-hand internet-scale sensor telemetry on mass exploitation; its post of 2026-10-26 recorded the first exploit traffic for CVE-2026-111497 and is cited by the Node2Shell entry. No RSS (feed and sitemap paths 404); `extract https://ellio.tech/en/blog/` reads titles and teasers without hrefs, WebFetch of the listing returns the hrefs, and `extract <post URL>` reads a post. Candidate: promote to active after 3 contributing runs.
Cited in 2 entries
Citation cadence
Citation days per ISO week (2 weeks of coverage span, total 2).
- CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)2026-10-26
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24