Back Community.Fortinet

Outbreak Alert: Node2Shell Remote Code Execution

Community.Fortinet • October 28, 2026

FortiRecon Digital Risk Protection (DRP), a SaaS-based service, includes External Attack Surface Management, Brand Protection, and Adversary Centric Intelligence.

Adversary Centric Intelligence (ACI): leverages FortiGuard Threat Analysis to provide comprehensive coverage of dark web, open-source, and technical threat intelligence, including threat actor insights to enable organizations to respond proactively assess risks, respond faster to incidents, better understand their attackers, and guard assets.

The Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides a realistic view of the impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.

Google Brotli Unchecked Return Value Vulnerability

Exploited by Ransomware Group(s)

Exploited by APT Group(s)

Yes (Unknown (North Korea))

Included in CISA KEV List

Available working exploit(s)

Available POC exploit(s)

1 (🔪 That Dark Web Guy - Part 3 🔪)

FortiRecon Intelligence Reporting(s)

7 (OSINT), 1 (Darknet), 1 (FortiGuard Research)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Node2Shell Remote Code Execution Vulnerability Exploited by Ransomware Groups The Node2Shell vulnerability allows remote code execution and has been exploited by ransomware groups, including those linked to North Korea. This vulnerability is included in the CISA Known Exploited Vulnerabilities (KEV) list. The vulnerability is associated with Google Brotli's unchecked return value. FortiRecon's Adversary Centric Intelligence service provides insights into the discussions surrounding this vulnerability on the dark web and social media. Organizations are urged to assess their risk and respond proactively to mitigate potential impacts. The vulnerability affects multiple systems, and proof-of-concept exploits are available. Current exploitation status is confirmed, with observed in the wild. 2 sources 79

Extracted Entities

Outbreak Alert: Node2Shell Remote Code Execution

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Vulnerabilities (1)