Security News
Current Advisories and Information
27 October 2026
Node2Shell: StableNet® not affected
CVE-2026-111497, nicknamed “Node2Shell” or “Broccoli2Shell”, is a memory-corruption bug in Google’s Brotli decompression library, which is built into Node.js and several Python packages. Specially crafted compressed data can crash the application, leak memory contents and, under some conditions, let an attacker run their own code.
StableNet® is not affected as it doesn’t ship Node.js, Python or Google Brotli. Customers using those dependencies in their own business process scripts are advised to update them, although actually triggering this vulnerability would require those scripts to accept Brotli-compressed input, either via input parameter or userscriptdata. We are not aware of any customer script using this.
22 October 2026
PHP2Shell: StableNet® not affected
As widely reported, a pair of critical vulnerabilities in the PHP language runtime (CVE-2026-109618 and CVE-2026-109619), called PHP2Shell, was disclosed in October 2026. These vulnerabilities let attackers run their own code on a web server that serves PHP pages, without needing to log in. They are already being exploited, and fixed PHP releases are available.
Neither StableNet® nor any measurement script shipped by Infosim® uses PHP. If there is a customer installed PHP runtime, we advise updating it to the latest version containing the fixes. Secure versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as of now.
If you run PHP-based applications elsewhere in your environment, such as websites, intranet tools or monitoring dashboards, check those systems separately and update them to a patched PHP release.
Software
Made in Germany