Blog
Tag: Threat Intelligence
Node2Shell: remote code execution on stock Node.js builds (CVE-2026-111497)
A checker calling itself node2shell-check is already mapping which hosts decompress Brotli. CVE-2026-111497 turns a malformed Brotli body into a shell on an official, unmodified Node.js build, which ELLIO reproduced on x86-64 against four targets.
"IgnoreAllPreviousInstructions": a peek into 340 billion daily reverse DNS (PTR) records
A network named itself IgnoreAllPreviousInstructions, and an AI search summary obeyed with a poem about an axolotl. A Dutch home connection's PTR tells any AI agent that looks it up to attack whoever sent it. And 28 fake Googlebots passed the check Google tells you to use.
ELLIO for Google SecOps: Visibility into Live Attacker Recon and Exploitation
ELLIO provides two integrations for Google Security Operations that incorporate its external reconnaissance, internet-wide scanning, and mass exploitation intelligence into Google Security Operations workflows.
ELLIO Gets a Major Upgrade in Its Recon & Mass Exploitation Intelligence
Today, we’re releasing a major set of improvements to ELLIO Reconnaissance and Mass Exploitation Intelligence.
