![sweet]()
NEW YORK, Oct. 27, 2026 (GLOBE NEWSWIRE) —
The oot-cause repair will take weeks; p otectio ca ’t waitCandy Secu ity right now a ou ced Candy Security Internet, exte di g its u time Vi tual Patchi g p otectio to eve y o ga izatio affected by HTTP2Shell (CVE-2026-111497). The aptitude will e in a position use s to block a y exploitatio of Node2Shell at o price fo 30 days, whethe o ot they a e Candy custome s.
HTTP2Shell sits i aspect the B otli decode constructed i to Node.js, Bu , Pytho , E voy, Istio a d, as Candy’s ow esea ch evealed this week, Go f amewo ks similar to T aefik, Fibe a d I is. Patchi g it eve ywhe e will take weeks. Candy Security Internet provides affected groups p otectio on the vul e in a position code path, with o code cha ges, o commitme t, whereas e gi ee i g ships the pe ma e t repair.
Candy Secu ity is al eady obse vi g lively exploitatio makes an attempt ac oss 88% of mo ito ed e vi o me ts.
“We a e watchi g HTTP2Shell exploitatio makes an attempt i eal e vi o me ts ight ow,” mentioned D o Kashti, CEO a d co-fou de of Candy Secu ity. “We’ e exte di g ou p otectio to o ga izatio s that eed assist secu i g affected applicatio s. Candy Security Internet exists as a result of eve y o ga izatio dese ves the identical visibility a d p otectio ou custome s have – particularly i a mome t like this. Vi tual Patchi g closes the exploitatio path right now. The pe ma e t repair ca comply with.”
The Root-Trigger Repair Will Take Weeks. P otectio Ca ’t Wait.HTTP2Shell lives i the B otli decode compiled i to the u instances a d lib a ies that applicatio s a e constructed o . Fixi g it on the oot mea s updati g eve y affected depe de cy, ebuildi g applicatio s that bu dle the decode , testi g the cha ges a d edeployi g them ac oss p oductio . Fo most o ga izatio s, that can take weeks. Fo the entire time, the vul e in a position code retains u i g a d stays eachable by attacke s.
Candy’s Vi tual Patchi g closes that hole with a su gical repair at u time. I stead of waiti g fo the code to cha ge, Candy stops the assault payload befo e it eaches the vul e in a position code path, a d authentic t affic retains flowi g. The bug continues to be i the code, but it surely ca o lo ge be exploited.
Groups get p otectio ow a d ca ship the pe ma e t repair o thei ow timeli e, with out the p essu e of a ope exposu e.
What Vi tual Patchi g DoesCandy Secu ity’s Vi tual Patchi g p otects u i g applicatio s whereas e gi ee i g completes the pe ma e t repair. Candy applies a p otectio coverage th ough its se so , ta geti g the vul e in a position code path a d blocki g exploitatio whereas authentic t affic co ti ues. No applicatio code cha ge is equi ed. Groups apply the coverage f om Candy’s Vul e talents Catalog, a d Candy dist ibutes it to se so s o every ode u i g the affected wo kload. O ce the se so s co fi m e fo ceme t, the wo kload is ma ked P otected f om that vul e skill. P otectio follows the wo kload because it scales a d esta ts.
Candy custome s ca use the Vul e talents Catalog to use p otectio to affected wo kloads a d co fi m e fo ceme t th ough the P otected standing.
Candy Secu ity custome s a e al eady p otected. Candy’s u time se so s a d L7 detectio ules a e lively ac oss all custome te a ts, with exploitatio makes an attempt al eady detected a d blocked i mo ito ed e vi o me ts.
The Candy Security InternetEfficient instantly, a y o ga izatio ca declare Candy Secu ity se so s with Vi tual Patchi g p otectio fo 30 days. No pu chase commitme t is equi ed.
To assert the offe , please go to: https://hello.candy.secu ity/http2shell-vi tual-patchi g-sweet-safety- et#activate
About Candy Secu ityCandy Secu ity delive s a p oactive u time secu ity platfo m fo cloud a d AI. By u de sta di g how applicatio s, ide tities, a d AI age ts behave i dwell e vi o me ts, Candy helps secu ity groups discove what’s u i g, p ove which weak esses attacke s ca exploit befo e it happe s, ha de thei defe ses, a d cease malicious exercise i eal time. T usted by the wo ld’s leadi g AI compa ies to secu e the ext f o tie , Candy provides o ga izatio s the visibility a d co t ol to undertake ew tech ologies with co fide ce whereas p otecti g the programs thei busi esses depe d o .
Co tacts
VP Ma keti gNoa Glumche Candy Secu ity oag@candy.secu ityChloe Ama teMo t e Tech PRcama te@mo t e .com
A photograph accompa yi g this a ou ceme t is obtainable at https://www.globe ewswi e.com/NewsRoom/Attachme tNg/03258dcd-1b9d-449f-962e-e9771fae7950
![]()
