--- title: HTTP2Shell Virtual Patching | Sweet Safety Net description: Protect your HTTP2Shell exposure today and fix on your timeline. Sweet Safety Net brings Virtual Patching to your environment for 30 days. No code change. image: https://hi.sweet.security/hubfs/featureimage.png --- [![Sweet Security](https://hi.sweet.security/hubfs/raw_assets/public/sweet-safety-net/images/sweet-logo-white.svg)](https://www.sweet.security?hsLang=en) [Activate Safety Net](https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net#activate) SWEET SAFETY NET # Virtual Patching for organizations affected by HTTP2Shell Block any exploitation of Node2Shell. Fix on your timeline. A full fix takes time. 'Sweet Safety Net' puts Virtual Patching between HTTP2Shell and your applications, so your team can remediate calmly, on its own schedule. [Activate Safety Net](https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net#activate) - 30 days of protection - No code change - No commitment - Expert-guided setup ## Cast your Safety Net Our team will reach out to schedule a short discovery call and a guided installation. Your 30 days begin when the sensors are deployed. ## HTTP2Shell can't wait for a full fix. Neither should you. HTTP2Shell (CVE-2026-111497) sits inside the Brotli decoder used by major runtimes.  ### Scanners can't block it. Blocking exploit attempts requires runtime protection, including when vulnerable code is embedded in binaries or bundled into apps. ### Fixing takes weeks. Bun apps need a full rebuild. Envoy and Istio depend on configuration. Every fix has to be tested and redeployed. ### The edge isn't enough. WAFs watch inbound traffic. The vulnerable decoder runs inside your runtime, including on responses your services fetch. ## Get protection while you work toward the permanent fix ### Virtual Patching. A protection policy on the vulnerable code path blocks exploitation attempts while legitimate traffic continues. No application code change. Workloads are marked Protected once enforcement is confirmed, and protection follows them as they scale and restart.  ### Sweet runtime sensors. See what's actually running in production, not just what's in your package list. 30 ### No strings attached. 30 days of protection from deployment. No commitment. ## Protection where the vulnerability lives > “Sweet Security turns to virtual patching to help mitigate exploits at machine speed.” ![forbes](https://hi.sweet.security/hubfs/forbes.png) [Read the full article \>\>](https://www.forbes.com/sites/timkeary/2026/10/19/why-runtime-security-could-hold-the-key-to-defending-against-ai-agents/) ## FAQ Is there a cost? No. Sweet covers the 30 days of protection in full. There's no purchase commitment. When do my 30 days start? When the first sensor is deployed in your environment, not when you sign up. Do I need to change the application code? No. Virtual Patching is a protection policy applied through the sensor. Your application code stays as it is. Does this replace patching? No. Virtual Patching protects affected workloads while your team tests and deploys the permanent fix, on its own timeline. Which environments are supported? \- Linux kernel version \>= 5.10 \- No support for serverless or managed container environments without host access, such as AWS Fargate, Azure Container Instances, and Google Cloud Run. Are there any requirements to get started? You will need to sign the [Master Subscription Agreement](https://www.sweet.security/legal/sweet-master-subscription-terms?hsLang=en). What happens after 30 days? The evaluation ends, unless you decide to continue with Sweet. If you do not wish to continue, the platform will not be responsive. I'm already a Sweet customer. Do I need to sign up? No. Your CS team can help you apply protection. ## Protect your exposure today. Fix on your timeline. [Activate your Safety Net](https://hi.sweet.security/http2shell-virtual-patching-sweet-safety-net#activate) [![Sweet Security](https://hi.sweet.security/hubfs/raw_assets/public/sweet-safety-net/images/sweet-logo-white.svg)](https://www.sweet.security?hsLang=en)