Sweet Security offers free 30-day HTTP2Shell virtual patching

Sweet Security has opened free access to its Sweet Safety Net virtual patching for all organizations affected by HTTP2Shell (CVE-2026-111497) in the Brotli decoder. The protection runs for 30 days with no purchase commitment while teams prepare a permanent fix; exploitation attempts are already seen in 88% of monitored environments.

• Flaw affects Node.js, Bun, Python, Envoy, Istio and Go frameworks
• Protection is free for 30 days with no purchase commitment
• Exploitation attempts observed in 88% of monitored environments
• Virtual patch blocks attacks without code changes