Lessons from Cybersecurity Black Week

In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October.

Node2Shell: From Node.js to HTTP2Shell Node2Shell (CVE-2026-111497) is an out-of-bounds write in Google’s Brotli decoder, which Node.js bundles.

According to Aikido, researchers demonstrated code execution against the official, unmodified Node.js 24.22.0 image on Linux ARM64.

Node.js 25.x, 23.x, 20.x, and earlier releases are end-of-life and will not receive the fix.

Cutting through the noise Cybersecurity Black Week showed that a severity score rarely tells the whole story.