Imperva, Inc.

Malicious compressed data can crash apps, expose memory, or run code.

which cybersecurity company Imperva confirmed.

Exploit code is public, but no malicious attacks have been reported.

Fixes include Brotli 1.2.1 and Node.js 22.23.4, 24.22.1, and 26.12.1. Also, restart affected processes and rebuild containers.

Today, Microsoft released emergency out-of-band updates for the same identifier, CVE-2026-111497, the public reference number for this vulnerability, in .NET, the framework behind many UK line-of-business applications.

Imperva's red team found the flaw, and proof-of-concept code is public.

Bleeping Computer reports no malicious exploitation in the wild yet, which is precisely when to act.

So, what actually broke? Brotli is a compression format that shrinks web traffic.

The sender seals it flat and the receiver's software unpacks it into a box sized in advance.

The decoder has to trust the packing instructions.

In Imperva's analysis of the Node.js copy, the decoder met an instruction the stream structure made impossible.

It treated that as a request for more data and carried on in a broken internal state.

Here's the evidence.

Imperva, a security firm, got code execution on an official node image, one version, one chip type, and it took them several attempts.

The public proofs of concept crashed servers reliably.

One team said blind remote execution with normal memory protections on didn't work for them.

The report says, malicious Brotli compression data can execute code natively on official Node.js builds.

Like, Imperva researchers got RCE on Node 24.22.0 for Linux ARM 64.

That's right.

Wait, so let me get this straight.

Then they all worked together to flesh out what they found and test the patches, drawing in a host of others to help.

Wiz thanked Automatic, Akamai, AWS Cloudflare, Fastly, Imperva, Microsoft, and Vercel.

While WordPress sites use PHP, WordPress has issued a statement saying that the flaw isn't WordPress specific and sites running its CMS must patch their servers and work with their web hosting companies to ensure their sites are protected.

OpenAI says that these flaws were found by researchers before hackers discovered them, so there were no reports of exploits in the wild.

Second is led by Elad Erez.

He's a former Imperva executive who runs the Cyburger Twitter account.

His co-founders are Daniel Drizin and Or Elias from Paragon.

They have already raised about $20 million from Lightspeed and Ballistic.

Greater than greater than, Cloudflare.

Imperva.

The product doesn't decide the level, the site's configuration does.

I met Turnstile on one site where a headed browser passed, and on another where it didn't.

Now, today I work for a company called Catel Networks.

If you've never heard of Catel Networks before, we were founded by a, a lovely chap called Shlomo Kramer, often known as the godfather of cybersecurity, who founded companies like Check Point and Imperva, and our goal really is to take networking and security and melt them together into one single platform with a single context.

You might have heard the term SASE, Secure Access Service Edge, not to be confused with what you hear on RuPaul's Drag Race.

That's a different type of sassy.

The first place you see it is in the traffic itself.

Every year, a cybersecurity company called Imperva publishes something called the Bad Bot Report.

It measures how much of the world's internet traffic comes from automated programs instead of real people.

For years, people made up more than half of it.

And it pinned the surge on one thing, the arrival of cheap, powerful AI, which made it easy for almost anyone to crank out convincing bots by the thousands.

And the scale is hard to picture.

Okay, hold onto your brains here because in a single year of data, Imperva says it blocked 13 trillion bad bot requests across the sites it protects.

That's the traffic from just the bad actors and just the ones that one company managed to catch.