---
title: Hunt: first in-the-wild Node2Shell request was a single 23 MB Brotli body aimed at Node.js 24.22.0 x86-64 from 94.154.43.7; a "node2shell-check" scanner mapped Brotli decoders the day before | ctxsec
url: https://ctxsec.com/items/hunt-node2shell-ellio-in-the-wild-exploit-94-154-43-7
description: ""
status: "threat research (ELLIO sensor data and lab analysis, Oct 25-26); single observed attempt; Tenable says it has not independently confirmed it"
published: 2026-10-27
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-node2shell-ellio-in-the-wild-exploit-94-154-43-7.md)

threat research (ELLIO sensor data and lab analysis, Oct 25-26); single observed attempt; Tenable says it has not independently confirmed it

2026-10-27

### Hunt: first in-the-wild Node2Shell request was a single 23 MB Brotli body aimed at Node.js 24.22.0 x86-64 from 94.154.43.7; a "node2shell-check" scanner mapped Brotli decoders the day before

ELLIO says its sensors recorded the first exploit attempt for **CVE-2026-111497** on **Oct 26 at 15:08 UTC (11:08 AM ET)**. CISA added the bug to KEV the next day. Things you can look for:

1. **The exploit request:** one HTTP request with `Content-Encoding: br` and a body of **23,069,983 bytes**, SHA-256 `7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b`, from **94.154.43.7**. ELLIO rates that IP malicious with high confidence and has also seen it doing PHP2Shell exploitation, GlobalProtect and FortiOS SSL VPN probing and Kubernetes API scanning. The delivery code is copied from public PoCs; the ROP chain is new and targets only the official Node.js v24.22.0 x86-64 binary.
2. **Reconnaissance:** the user agent `Mozilla/5.0 (compatible; node2shell-check/1.0)` from AS44620, sending a `GET /` followed by 20 Brotli-encoded POST bodies in two bursts about two minutes apart (five malformed 1,032-byte stubs padded with "A", fifteen valid streams up to 65,743 bytes). It is building a list of hosts that decode Brotli at all.
3. **Side effects of failed attempts:** most misses crash the worker. Look for bursts of Node.js segfaults or restarts right after large `br` request bodies. Where systemd-coredump is on, each crash writes a core file to `/var/lib/systemd/coredump` that can hold other users' session cookies and tokens, so restrict and expire those files. Python Brotli, brotlicffi, the PHP extension's streaming API and the Ruby gem instead hang without error, and PHP spins at 100% CPU.
4. **Edge rule:** requests with `Content-Encoding: br` and multi-megabyte bodies are rare in normal traffic. Logging and, where you can, dropping inbound `br` bodies is a cheap stopgap until everything is patched.

ELLIO says this attacker's chain reached zero shells in 50 lab tries against an unpatched target (it crashed the process instead), and calls it a likely first-generation attempt. Its own chain built from public parts does get a shell, so expect fixed versions of this to follow. Version check: `process.versions.brotli` reads 1.2.0 on patched and unpatched Node.js builds, so check the Node.js release version (22.23.4, 24.22.1 or 26.12.1 and later).

Sources: [ELLIO: Node2Shell (CVE-2026-111497), RCE on stock Node.js builds (updated Oct 26 with in-the-wild traffic)](https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/) · [CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 27)](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [Tenable: Brotli2Shell FAQ for CVE-2026-111497](https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497) · [Node.js: October 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)