6 min read

HTTP2Shell is a critical flaw in Brotli, a compression library that sits on your server, not in WordPress. A public attack reaches it through WordPress pingbacks. Updating WordPress won’t fix it: your host has to update Brotli, and you should check that they did.

Last updated: 7 November 2026.

In 30 seconds

  1. Updating WordPress won’t fix it. The fix is in Brotli, on your server.
  2. Ask your host if Brotli is patched for CVE-2026-111497, and if they restarted everything after. There’s a message to copy below.
  3. Turn off pingbacks if you don’t use them (almost nobody does). It closes the route the public attack uses.
  4. Take five minutes to check for signs of a hack. Here’s how.

What is HTTP2Shell?

Brotli is a compression format, like zip for web traffic. Your server uses a Brotli library to shrink pages before sending them, and to unpack compressed answers it gets from other sites. On 21 October 2026, the Brotli project fixed a flaw in that library (CVE-2026-111497, rated 9.2 out of 10). A specially crafted compressed file can make it write outside its memory, and in the worst case, let a stranger run their own code on the server.

The name is misleading. It has also been called Brotli2Shell and Node2Shell, and it has nothing to do with HTTP/2. It’s also not PHP2Shell, the PHP flaw from the same week, even if the fix is the same kind of thing: your host updates something on the server.

Where WordPress comes in: when someone sends your site a pingback (“I linked to your post”), WordPress visits their page to check that the link is real. A public attack abuses exactly that. The attacker’s server answers with a poisoned Brotli file, and if your server unpacks it with an unpatched library, the attacker’s code can run. No password needed. Wordfence reproduced it on a test WordPress site.

Is my site affected?

Nothing in wp-admin can tell you, because Brotli isn’t part of WordPress. It comes with the server, the operating system or the container image. Your host is the only one who can answer, which is the next step.

The honest part: the public attack is picky. It was built for one exact server setup, and Wordfence found that the same payload failed (or only crashed PHP) on a slightly different PHP build. As of early November, nobody had publicly reported a real site hacked this way. But CISA (the US cybersecurity agency) added it to its list of actively exploited flaws on 27 October, attackers are probing for it, and an attack built for one common server image works on every server built from it. Treat it as urgent, not as a panic.

For people who run their own servers, these are the first fixed versions:

Brotli versionFixed from
1.2.x1.2.1
1.1.x1.1.1
1.0.3 to 1.0.91.0.10
Debian 13libbrotli1 1.1.0-2+deb13u1 (the number still starts with 1.1.0)

Linux distributions often fix a library without changing its main version number, so trust your distribution’s security notice (Ubuntu’s is USN-8956-1) rather than the first three digits.

What do I need to do?

If a hosting company runs your server (shared or managed WordPress hosting), updating Brotli is their job. Your part is to ask, and to get a real answer.

Message for your host

Hi, about HTTP2Shell (CVE-2026-111497): is every Brotli library used by my site patched, and were the web server and PHP restarted after the update? Thank you!

The restart matters: a running server keeps using the old library in memory until it restarts. “We updated the package” without a restart isn’t finished.

If you run your own server (a VPS, a cloud server), install your distribution’s security update, then restart Apache, PHP-FPM, and anything else that loaded the old library. With Docker, rebuild your image from an updated base and redeploy: restarting a container changes nothing inside it. On CloudLinux and similar platforms, read the vendor’s advisory: a server can hold several copies of Brotli (system, web server, bundled PHP), and fixing one doesn’t fix the others.

Turn off pingbacks. It doesn’t fix Brotli, but it closes the door the public attack uses, and honestly, pingbacks are a 2005 feature that mostly brings spam today. Go to Settings → Discussion and untick “Allow link notifications from other blogs”. That only changes new posts, though: your existing posts keep accepting pings. To switch off the feature everywhere, add this small snippet (with Code Engine, or in your theme’s functions.php):

add_filter( 'xmlrpc_methods', function ( $methods ) {
  unset( $methods['pingback.ping'] );
  return $methods;
} );

Careful with the shortcuts you’ll see around: the “Disable XML-RPC” filter (xmlrpc_enabled) and Wordfence’s “Disable XML-RPC authentication” option don’t stop pingbacks, because pingbacks never needed a login in the first place.

To check that pingbacks are really off, run this from your computer (replace the address). If it prints nothing, they’re off:

curl -s -d '<methodCall><methodName>system.listMethods</methodName></methodCall>' https://yoursite.com/xmlrpc.php | grep pingback.ping

How would I know if I was hacked?

If your host patched quickly, the chance is small. If it took a while, take five minutes:

  • Users: in wp-admin, open Users and filter by Administrator. Anyone you don’t know?
  • Plugins: anything installed that you didn’t install?
  • Uploads folder: a .php file inside wp-content/uploads is a red flag.
  • Your logs, if you can read them: lots of POST requests to xmlrpc.php, PHP crashing and restarting, or your server connecting to addresses you don’t know.
  • Google: search site:yourdomain.com and look for pages you never wrote.

None of these signs is proof on its own, and their absence isn’t proof either. If something looks wrong, ask your host to scan the server and restore a backup from before it appeared, then change your passwords and keys. There’s more in my PHP2Shell guide.

Quick answers

Will a WordPress update or a security plugin fix it? No. Brotli lives below WordPress, on the server. Only the host (or you, on your own server) can update it.

Is it the same as PHP2Shell? No. PHP2Shell was a flaw in PHP; HTTP2Shell is in Brotli. Both are fixed on the server, both came out the same week, and you should ask your host about both.

Is it the same as the WordPress update flaw? No. CVE-2026-119977 is in WordPress itself, and a WordPress update fixes it.

Will turning off pingbacks break anything? Almost certainly not. You’ll stop getting “someone linked to your post” notifications from other blogs, which these days are mostly spam. A few old tools rely on XML-RPC, but the snippet above only removes pingbacks, not XML-RPC.

I look after many client sites. Where do I start? Group them by host and ask each host once. Then check your own servers and containers yourself, including staging and old ones: one package check doesn’t cover every PHP pool or image.

Timeline

  • 21 October The Brotli project releases the fixed versions (1.0.10, 1.1.1 and 1.2.1).
  • 22 October Google publishes CVE-2026-111497, rated 9.2 out of 10.
  • 27 October CISA adds it to its catalog of actively exploited flaws.
  • By 2 November A public proof of concept attacks WordPress through pingbacks. Check Point, Previdian and others see scanning and attack attempts, none with a confirmed hacked site.
  • 2 November Wordfence reproduces the attack on a test WordPress site, and finds the public payload only works on the exact setup it was built for.

Sources: Wordfence’s analysis (with links to the Brotli release, the CVE record, CISA, Debian, Ubuntu and CloudLinux advisories), and the CISA catalog.

Hear about the next one early

Three server-and-WordPress flaws in three weeks: there will be a next one. If you work with an AI assistant (Claude, ChatGPT, Codex, Cursor…), connect it to Today WP ↗, a free server we made that knows what is true in WordPress today. Give it your WordPress and PHP versions and your plugins, and it tells you what to update first: core security releases, PHP branches that no longer get fixes, server-level flaws like this one, and known vulnerabilities in the exact versions you run, refreshed every day. It’s read-only and needs no account. Add https://todaywp.com/mcp as a connector, then ask it: is my site safe?

Questions? Come talk about it on our Discord. Stay safe 🙂