A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?

(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)

I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.

AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.

No human reviews anything anymore so of course they aren't going to catch it.

Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"

Feels like the goal was sensationalism.

Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.

Actually it does, if the server is willing to decompress POST bodies.

I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.

The author clearly used super intelligence.

It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.

Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.

All these names are silly. It's just marketing.

Why do critical vulnerabilities get a cutesy name and website nowadays? Who’s paying for these sites?

I'm not seeing any source for the claim that OpenAI discovered this in February. The source that the article links (a tweet by OpenAI) doesn't claim that.

I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.

So as a hotfix I block this on my reverse proxy.

My experience with Brotli is from back when all the hype was mobile first and India etc was super mobile first so all these social networks lost their mind optimizing for request success and speed. So they were going crazy over micro-wins like that.

There's this other name for the same vuln: https://broccoli2shell.com/

Not when you're prioritising sensationalism over accuracy. Everyone's heard of HTTP, but hardly anyone's heard of brotli.

That's why it's important to practice your processes for both shipping quickly and overriding cooldowns. There's a baseline of things which are not easy to exploit where you want to patch on a regular cadence and the risk posed by a supply chain attack is greater than the risk of an attacker having enough of a footprint inside your systems to escalate. The fact that sometimes you have a specific situation like this where that's not true doesn't mean that 9 times out of 10 the cooldown was the better risk-reduction strategy.

It used to be a flex to say you deploy daily but it’s going to become a necessity just to keep up with the vulns

Yeah, obviously? Deploy fixes to security issues which apply to you as soon as possible, deploy random feature additions and non-critical bug fixes after some cooldown.

As always, the easiest way to manage this is to have as few dependencies as possible. If you have a lockfile with thousands of entries, you won't be able to go through them and decide which upgrades are legitimate urgent security updates and which can wait. If you have 10? You'll manage.

Yeah that doesn't make a lot of sense that they reported it but also nobody knew it was a security issue..

Maybe an LLM just happened to do one of those "while I'm here" fixes in Feb and because nobody reviews anything anymore..

"Fixed reading too many bytes."

LGTM!

Edit: I was close! "Detect and report invalid stream earlier." Could have been a person.

Nah man. We were on casual mode all along. This is the new normal.

They’ll have it for few months and then make you pay to get the update.