The "HTTP2Shell" vulnerability affects servers that know how to speak Google's 'brotli' compression protocol, which would likely make its way into your server through an innoccuous-sounding speedup dep like urllib3[brotli] or aiohttp[speedups] , and could be used by basically any server, including Flask, Quart, Starlette, FastAPI, etc. It was downloaded 4,200,000 times from PyPI yesterday alone, to give you a sense of the scale.

To find out if you're affected, run a command like on of these...

pip list | grep -i brotli uv tree | grep -i brotli poetry show | grep -i brotli

...etc., looking for brotli <= 1.2.0 and/or brotlicffi <= 1.2.0.2. If you're affected, obviously update & redeploy immediately.

Beyond that... well, the (colloquial) name kinda says it all. Given the new Cyber normal , I would assume that you have malicious software running on that system and any connected to it until proven otherwise.…