Sweet Security offers all organizations affected by HTTP2Shell Virtual Patching protection at no cost. October 27, 2026 18:52 ET | Source: Sweet Security NEW YORK, Oct. 27, 2026 (GLOBE NEWSWIRE) - The root-cause fix will take weeks; protection can't wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497). The capability will enable users to block any exploitation of Node2Shell at no cost for 30 days, whether or not they are Sweet customers. HTTP2Shell sits inside the Brotli decoder built into Node.js, Bun, Python, Envoy, Istio and, as Sweet's own research revealed this week, Go frameworks such as Traefik, Fiber and Iris. Patching it everywhere will take weeks. Sweet Safety Net gives affected teams protection at the vulnerable code path, with no code changes, no commitment, while engineering ships the permanent fix. Sweet Security is already observing active exploitation attempts across 88% of monitored environments. "We are watching HTTP2Shell exploitation attempts in real environments right now," said Dror Kashti, CEO and co-founder of Sweet Security. "We're extending our protection to organizations that need help securing affected applications. Sweet Safety Net exists because every organization deserves the same visibility and protection our customers have - especially in a moment like this. Virtual Patching closes the exploitation path today. The permanent fix can follow." The Root-Cause Fix Will Take Weeks. Protection Can't Wait. HTTP2Shell lives in the Brotli decoder compiled into the runtimes and libraries that applications are built on. Fixing it at the root means updating every affected dependency, rebuilding applications that bundle the decoder, testing the changes and redeploying them across production. For most organizations, that will take weeks. For the whole time, the vulnerable code keeps running and stays reachable by attackers. Sweet's Virtual Patching closes that gap with a surgical fix at runtime. Instead of waiting for the code to change, Sweet stops the attack payload before it reaches the vulnerable code path, and legitimate traffic keeps flowing. The bug is still in the code, but it can no longer be exploited. Teams get protection now and can ship the permanent fix on their own timeline, without the pressure of an open exposure. What Virtual Patching Does Sweet Security's Virtual Patching protects running applications while engineering completes the permanent fix. Sweet applies a protection policy through its sensor, targeting the vulnerable code path and blocking exploitation while legitimate traffic continues. No application code change is required. Teams apply the policy from Sweet's Vulnerabilities Catalog, and Sweet distributes it to sensors on each node running the affected workload. Once the sensors confirm enforcement, the workload is marked Protected from that vulnerability. Protection follows the workload as it scales and restarts. Sweet customers can use the Vulnerabilities Catalog to apply protection to affected workloads and confirm enforcement through the Protected status. Sweet Security customers are already protected. Sweet's runtime sensors and L7 detection rules are active across all customer tenants, with exploitation attempts already detected and blocked in monitored environments. The Sweet Safety Net Effective immediately, any organization can claim Sweet Security sensors with Virtual Patching protection for 30 days. No purchase commitment is required. About Sweet Security Sweet Security delivers a proactive runtime security platform for cloud and AI. By understanding how applications, identities, and AI agents behave in live environments, Sweet helps security teams discover what's running, prove which weaknesses attackers can exploit before it happens, harden their defenses, and stop malicious activity in real time. Trusted by the world's leading AI companies to secure the next frontier, Sweet gives organizations the visibility and control to adopt new technologies with confidence while protecting the systems their businesses depend on. VP Marketing Noa Glumcher Sweet Security [email protected] Chloe Amante Montner Tech PR [email protected]

Sweet Security, a runtime security platform for cloud and AI, has launched Virtual Patching. The feature protects running applications from specific vulnerabilities as soon as they are identified. Fixing a vulnerability can take days or weeks, leaving applications exposed. With Virtual Patching, a security team picks a vulnerability in Sweet's Vulnerabilities Catalog, selects "Enforce protection," and deploys a policy to every node running that workload. The sensor blocks exploit attempts while normal traffic flows. Protection follows the workload as it scales and restarts, and can be removed once a permanent fix ships. The tool works with Sweet Attack, the company's AI red-team agent, which suggests patching policies when it finds a vulnerability. "When a team knows an application can be exploited, waiting is not an option," said Dror Kashti, chief executive officer and co-founder of Sweet Security.

Sweet enables immediate protection against exploitable vulnerabilities with Virtual Patching. October 19, 2026 Today, Sweet is releasing Virtual Patching, enabling security teams to protect running applications against exploitable vulnerabilities, including zero-days, without waiting for a vendor patch or permanent code fix. Teams can apply immediate runtime protection and keep applications operating while the underlying vulnerability is remediated. Close the exposure window attackers can exploit. Fixing a vulnerability takes coordination. Engineering develops the change, builds and tests it, gets approval, and deploys it across the affected environment. Each step serves a purpose, but each may belong to a different team with its own priorities and schedule. That process can take days or weeks. Until the fixed version reaches production, a ticket, remediation recommendation, or planned deployment leaves the application exposed. For zero-day vulnerabilities, that exposure window can begin before a patch even exists. AI is making that exposure window more dangerous by lowering the cost and effort required for attackers to discover weaknesses and exploit them. Defenders still depend on investigation, handoffs, and release schedules, with every finding competing for limited human capacity. Changing the economics of cloud security requires reducing the time and effort between understanding a risk and protecting the application. Security teams need a way to act immediately while engineering completes the permanent repair. "AI is accelerating vulnerability discovery and exploitation to the point where exploits are emerging days before patches are available; faster patching alone isn't enough. Sweet's Virtual Patching provides a critical layer of protection against known and unknown exploits, helping teams apply protection immediately while giving them the time they need to remediate vulnerabilities at their source." - James Berthoty, Latio Turn prioritized vulnerabilities into immediate protection. A virtual patch is a policy that protects a running workload from a specific vulnerability, whether it is a known CVE, a newly discovered zero-day, or a flaw in your own application code... Sweet applies that protection directly to the running application through its sensor by targeting the vulnerable code path and blocking exploitation while legitimate application traffic continues. No code change is required. The workflow begins in Sweet's Vulnerabilities Catalog, where findings are ranked by Sweet Score using runtime context: what actually runs, what is exposed, and how likely a vulnerability is to be exploited. Teams can identify the findings that matter and see where the affected workloads are running. From a vulnerability, the user selects "Respond > Enforce Protection," enters a short reason, and clicks "Run". Sweet distributes the policy to its sensor on each node running the affected workload. Once the sensors confirm enforcement, the workload is marked Protected from that vulnerability. That status represents an enforced control on the application. Requests attempting to exploit the weakness are blocked. Protection follows the workload as it scales and restarts, covering new instances too. With Virtual Patching from Sweet, security can now address immediate exposure while engineering completes the permanent repair. The release schedule can proceed with protection already in place. Keeping production running during an active attack: Shai-Hulud. During an active attack, investigating and updating every affected workload can take longer than the time available to intervene. Sweet's response to a Shai-Hulud supply-chain attack demonstrates the value of targeted runtime protection during that window. A Sweet customer facing Shai-Hulud needed to protect production against malicious processes capable of harvesting credentials, propagating, and exfiltrating sensitive data. Sweet applied targeted runtime protections across active sensors. When the associated malicious behavior appeared, those protections terminated the malicious process at its source while leaving the surrounding workload operational. The customer stopped the malicious activity without operational downtime while security and engineering investigated the affected software and completed permanent remediation. That response illustrates the operating principle behind Virtual Patching: apply a precise runtime control while the underlying repair proceeds. Shai-Hulud involved malicious package behavior; virtual patching applies that principle to a specific exploitable vulnerability. The same approach helps when a newly disclosed CVE affects production, a dependency update requires extensive testing, or a flaw in proprietary code needs engineering work. Teams can protect the application throughout the remediation window. Sweet delivers security outcomes with the Sweet Learning Loop. Security teams are judged on outcomes: the systems they actively protect and the risk they actively reduce. The data they collect matters when it helps deliver those results, but alone it is a signal. The Sweet Learning Loop connects runtime intelligence to outcomes through Attack, Fix, Defend. Virtual Patching strengthens the path from proving an exploit to protecting production. * Attack: Sweet Attack continuously tests a defined scope of the environment and runs again whenever an image changes. It tests from the outside, as an attacker would, and reports an exploit only after validating it. * Fix: Virtual Patching gives teams immediate protection against the identified weaknesses while engineering develops, tests, and deploys the permanent fix. * Defend: Sweet's lightweight eBPF sensors enforce that protection against the running workload, blocking exploitation attempts in 100 milliseconds or less while legitimate application Runtime information is only as useful as the security outcomes it enables. Sweet transforms unified runtime visibility into action through its patented LLM-driven reasoning agent and its Learning Loop of Attack, Fix, and Defend Together, these capabilities turn runtime vulnerability intelligence into enforced protection: less time exposed, exploitation blocked, and production kept running while engineering completes the permanent fix. Those are security outcomes a team can demonstrate. Ready to change the economics of cloud security? Request a customized demo to see how Sweet helps your team prove real attack paths, protect production faster, and deliver measurable risk reduction with less manual effort. Share the Sweetness Sweet Security is redefining enterprise cloud protection. As the leading provider of Runtime CNAPP and AI Security solutions, Sweet unifies runtime context with advanced AI intelligence to protect the modern enterprise. Stay updated