Untitled

Should have definitely been Brotli2Shell, but Google ingeniously managed to dodge that bullet by having NodeJS come out with a fix before they did (others might call that accidental exposure), and then barely communicating about that with the broader community once they finally did. Here's a timeline of events[0] and here's me more broadly complaining about Google's stance[1] [0] https://www.bugsink.com/blog/http2shell-timeline/ [1] https://news.ycombinator.com/item?id=50230362

I think we've all seen where an LLM names a session, issue, or PR based on its early understanding and fails update it later. AI isn't being asked to review the title, and it doesn't have experience or think, so of course it's not going to flag it. No human reviews anything anymore so of course they aren't going to catch it. Edit: AI for as good as it is at "writing" is terrible at writing and particularly at naming things. I had an AI name a client OpenAICompatibleEmbeddingClient. "Brooooo.. I think "compatible" is implied, who names stuff like that?!"

A better name is Konduktsemmel, which is a bread roll (Semmel) which you eat on a funeral (Kondukt) in Austria. Fits to Brotli, doesn't it? (Actually you eat cake and drink coffee on a funeral, but it's still called like that in some parts of Austria.)

Feels like the goal was sensationalism.

Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss.