alt Hacker NewsWell, whoever picked the name HTTP2Shell certainly didn't use any intelligence, artificial or genuine.
It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?
You might as well call it Exploit Pro Max...
Replies
I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later.
AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it.
No human reviews anything anymore so of course they aren't going to catch it.
Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"
Feels like the goal was sensationalism.
Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.
Actually it does, if the server is willing to decompress POST bodies.
I immediately thought HTTP/2 was having a bad day somehow. Might I suggest Software2Shell to be less confusing.
The author clearly used super intelligence.
It looks like marketing HTTP2Shell seems to appeal to everyone that uses HTTP, while Brotli2Shell might not wake up people that know what it is.
Now, whether it's warranted or not, that's another matter, but they know how to appeal for maximum awareness/interaction.
A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it?
(Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)