‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitation

2026-10-28T20:51:31Z•f3c40105e5443608ba30a8a895db9ca406e0e5a314473781cd33e2d645c8a41e

CVE-2026-109618CVE-2026-109619CVE-2026-111497AI-assisted attacksBRONZE SANDCASTLEDLL sideloadingMeterpreterNode2Shellactive exploitationproof-of-concept exploitthreat intelligenceweb application security

Open source link →

What happened

Sophos reports that the Node2Shell vulnerability (CVE-2026-111497) is being actively exploited. The feed also highlights proof-of-concept exploitation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, AI-assisted web application intrusion activity, and BRONZE SANDCASTLE use of modified Meterpreter shells via DLL sideloading. The primary security concern is active exploitation of CVE-2026-111497.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sophos_news
Record identifier: f3c40105e5443608ba30a8a895db9ca406e0e5a314473781cd33e2d645c8a41e
Enrichment time: 2026-10-28T20:51:31Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records