ELLIO says its sensors recorded the first exploit attempt for CVE-2026-111497 on Oct 26 at 15:08 UTC (11:08 AM ET). CISA added the bug to KEV the next day. Things you can look for:

1. The exploit request: one HTTP request with Content-Encoding: br and a body of 23,069,983 bytes, SHA-256 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b, from 94.154.43.7. ELLIO rates that IP malicious with high confidence and has also seen it doing PHP2Shell exploitation, GlobalProtect and FortiOS SSL VPN probing and Kubernetes API scanning. The delivery code is copied from public PoCs; the ROP chain is new and targets only the official Node.js v24.22.0 x86-64 binary.
2. Reconnaissance: the user agent Mozilla/5.0 (compatible; node2shell-check/1.0) from AS44620, sending a GET / followed by 20 Brotli-encoded POST bodies in two bursts about two minutes apart (five malformed 1,032-byte stubs padded with "A", fifteen valid streams up to 65,743 bytes). It is building a list of hosts that decode Brotli at all.
3. Side effects of failed attempts: most misses crash the worker. Look for bursts of Node.js segfaults or restarts right after large br request bodies. Where systemd-coredump is on, each crash writes a core file to /var/lib/systemd/coredump that can hold other users' session cookies and tokens, so restrict and expire those files. Python Brotli, brotlicffi, the PHP extension's streaming API and the Ruby gem instead hang without error, and PHP spins at 100% CPU.
4. Edge rule: requests with Content-Encoding: br and multi-megabyte bodies are rare in normal traffic. Logging and, where you can, dropping inbound br bodies is a cheap stopgap until everything is patched.

ELLIO says this attacker's chain reached zero shells in 50 lab tries against an unpatched target (it crashed the process instead), and calls it a likely first-generation attempt. Its own chain built from public parts does get a shell, so expect fixed versions of this to follow. Version check: process.versions.brotli reads 1.2.0 on patched and unpatched Node.js builds, so check the Node.js release version (22.23.4, 24.22.1 or 26.12.1 and later).