NEW YORK, Oct. 27, 2026 (GLOBE NEWSWIRE) -- Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497). The capability will enable users to block any exploitation of Node2Shell at no cost for 30 days, whether or not they are Sweet customers.
HTTP2Shell sits inside the Brotli decoder built into Node.js, Bun, Python, Envoy, Istio and, as Sweet’s own research revealed this week, Go frameworks such as Traefik, Fiber and Iris. Patching it everywhere will take weeks. Sweet Safety Net gives affected teams protection at the vulnerable code path, with no code changes, no commitment, while engineering ships the permanent fix.
Sweet Security is already observing active exploitation attempts across 88% of monitored environments.
“We are watching HTTP2Shell exploitation attempts in real environments right now,” said Dror Kashti, CEO and co-founder of Sweet Security. “We’re extending our protection to organizations that need help securing affected applications. Sweet Safety Net exists because every organization deserves the same visibility and protection our customers have - especially in a moment like this. Virtual Patching closes the exploitation path today. The permanent fix can follow.”
The Root-Cause Fix Will Take Weeks. Protection Can’t Wait.
HTTP2Shell lives in the Brotli decoder compiled into the runtimes and libraries that applications are built on. Fixing it at the root means updating every affected dependency, rebuilding applications that bundle the decoder, testing the changes and redeploying them across production. For most organizations, that will take weeks. For the whole time, the vulnerable code keeps running and stays reachable by attackers.
Sweet’s Virtual Patching closes that gap with a surgical fix at runtime. Instead of waiting for the code to change, Sweet stops the attack payload before it reaches the vulnerable code path, and legitimate traffic keeps flowing. The bug is still in the code, but it can no longer be exploited.
Teams get protection now and can ship the permanent fix on their own timeline, without the pressure of an open exposure.
What Virtual Patching Does
Sweet Security’s Virtual Patching protects running applications while engineering completes the permanent fix. Sweet applies a protection policy through its sensor, targeting the vulnerable code path and blocking exploitation while legitimate traffic continues. No application code change is required. Teams apply the policy from Sweet’s Vulnerabilities Catalog, and Sweet distributes it to sensors on each node running the affected workload. Once the sensors confirm enforcement, the workload is marked Protected from that vulnerability. Protection follows the workload as it scales and restarts.
Sweet customers can use the Vulnerabilities Catalog to apply protection to affected workloads and confirm enforcement through the Protected status.
Sweet Security customers are already protected. Sweet’s runtime sensors and L7 detection rules are active across all customer tenants, with exploitation attempts already detected and blocked in monitored environments.
The Sweet Safety Net
Effective immediately, any organization can claim Sweet Security sensors with Virtual Patching protection for 30 days. No purchase commitment is required.
To claim the offer, please visit: https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net#activate
About Sweet Security
Sweet Security delivers a proactive runtime security platform for cloud and AI. By understanding how applications, identities, and AI agents behave in live environments, Sweet helps security teams discover what’s running, prove which weaknesses attackers can exploit before it happens, harden their defenses, and stop malicious activity in real time. Trusted by the world’s leading AI companies to secure the next frontier, Sweet gives organizations the visibility and control to adopt new technologies with confidence while protecting the systems their businesses depend on.
Media Contacts:
Noa Glumcher
VP Marketing, Sweet Security
noag@sweet.security
Chloe Amante
Montner Tech PR
camante@montner.com
