Evidence · DiggingBeagle record
ELLIO observes Node2Shell Brotli exploitation attempt against stock Node.js
Sensor capture and separate lab replay of a crafted Brotli stream targeting Node.js 24.22.0.
- Source role
- primary disclosure
Evidence record
Sensor capture and separate lab replay of a crafted Brotli stream targeting Node.js 24.22.0.
Claim-level citations (2)
- supportsBrotli Node2Shell: AI-assisted discovery followed by observed exploit attempts: ELLIO states that the October 26 sensor payload combined a 1,031-byte instruction block and a 256-byte final placement stage, with a new x86-64 ROP chain for the official Node.js 24.22.0 binary. The observed request is an attempted exploit, not a confirmed victim execution.
Update, 26 October 2026, sensor payload construction and ROP chain
- supportsBrotli Node2Shell: AI-assisted discovery followed by observed exploit attempts: ELLIO reports capturing a crafted approximately 23.07 MB Brotli exploitation attempt on October 26 aimed at stock Node.js 24.22.0, and separately demonstrates control-flow effects in a laboratory reproduction. The sensor capture is not proof of successful execution against a production victim.
October 26 sensor capture: sample size, Node.js 24.22.0 target and separate proof-of-concept laboratory results