Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost

What happened

New York, NY, October 27th, 2026, CyberNewswire The root-cause fix will take weeks; protection can’t wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497 (the public catalogue number for a specific software flaw)). HTTP2Shell sits inside the Brotli decoder built into Node.js, Bun, Python, Envoy, Istio and, as Sweet’s own research revealed this week , Go frameworks such as Traefik, Fiber and Iris.

Sweet Safety Net gives affected teams protection at the vulnerable code path, with no code changes, no commitment, while engineering ships the permanent fix. Sweet’s Virtual Patching closes that gap with a surgical fix at runtime.

The bug is still in the code, but it can no longer be exploited.

The capability will enable users to block any exploitation of Node2Shell at no cost for 30 days, whether or not they are Sweet customers. Sweet Security is already observing active exploitation attempts across 88% of monitored environments.

HTTP2Shell lives in the Brotli decoder compiled into the runtimes and libraries that applications are built on. Fixing it at the root means updating every affected dependency, rebuilding applications that bundle the decoder, testing the changes and redeploying them across production.

For the whole time, the vulnerable code keeps running and stays reachable by attackers. Instead of waiting for the code to change, Sweet stops the attack payload before it reaches the vulnerable code path, and legitimate traffic keeps flowing.