Română

Postări cu #node2shell

#node2shell

Postări publice de pe X care folosesc #node2shell.

Hashtaguri înrudite

  1. Kengz@kengz
    Node2Shell (CVE-2026-111497) reproduced: Brotli + Node.js RCE, ASLR ON, blind, no memory leaks. Our RINGPIVOT primitive turns the Brotli ring buffer into a stack pivot and lands a real /bin/sh on stock Node 24.22.0 + Express 5.3.0. #Node2Shell #CVE2026111497 #NodeJS #RCE
    Descarcă
    100234
  2. Emanuel Fludd ☂️✓@realfludd
    @grok
    @grok confirm
    Salman Khan @salmanite
    PHP2SHELL Exploit 🔥🔥🔥 🚨 XHack AI CoHunters successfully reproduced Remote Code Execution (RCE) in PHP 8.4, TWICE! Two autonomous AI CoHunters collaborated to develop and validate a working exploit chain in a controlled Docker lab. #php2shell #bughunting #xhack
    10041
  3. Salman Khan✓@salmanite
    PHP2SHELL Exploit 🔥🔥🔥 🚨 XHack AI CoHunters successfully reproduced Remote Code Execution (RCE) in PHP 8.4, TWICE! Two autonomous AI CoHunters collaborated to develop and validate a working exploit chain in a controlled Docker lab. #php2shell #bughunting #xhack
    Descarcă
    12243.1K
  4. Grok✓@grok
    @realfludd
    Not overhyped. CVE-2026-109618/109619 are confirmed critical unauth RCEs in PHP. CISA added both to KEV on Oct 26 after verified exploitation. Working chains hit mod_php defaults in labs and some honeypots. Complexity (ASLR, offsets, configs) blocks easy mass worms, but risk is real—patch to 8.4.27+ immediately.
    10018
  6. The Hacker News@TheHackersNews
    ‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js. Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability. Read full details ↓
    2713156989.3K
  7. Endura Security✓@endurasecurity
    CISA just added #Node2Shell (CVE-2026-111497) to its catalog of actively exploited vulnerabilities. The flaw affects Brotli decompression and can potentially allow attackers to execute arbitrary code. Researchers have already observed exploitation attempts, including one that failed to produce a working shell. That last detail is important. A failed exploit doesn't mean a harmless vulnerability. It means attackers are actively experimenting, and we shouldn't assume they'll keep failing. Here's where things get interesting for engineering teams. Updating your npm dependencies doesn't necessarily fix the vulnerable Brotli decoder bundled into Node.js. Your application dependencies could be completely up to date while the runtime inside your Docker image remains vulnerable. The same underlying library also appears in other software, each with its own patching requirements. For Node.js, the fixed versions include 22.23.4, 24.22.1, and 26.12.1. Check the actual runtime versions inside your containers and CI/CD runners, not just your development machines. Rebuild affected images, redeploy them, and verify the updated versions are actually running. This is also why we spend so much time thinking about runtime security at Endura. Patching fixes the underlying vulnerability, while least-privilege enforcement can help limit what compromised code is allowed to do inside a protected build environment. They're complementary controls, and neither replaces the other. One question for the engineering community: Who owns patching the runtimes buried inside your CI/CD infrastructure?
    00199
  8. The Architect@DaArchitect0x
    Pillow's wheels still carry an unfixed Brotli decoder (CVE-2026-111497), reached via fonts loaded with ImageFont.truetype(). pip-audit doesn't flag it yet. Until a fix ships, load only fonts you trust. Write-up, with credits: #Python #Node2Shell #SBOM
    Descarcă
    004209
  9. DIESEC@DIESEC_GmbH
    Node2Shell (CVE-2026-111497), a Brotli decoder flaw, is in CISA KEV since Oct 27. Update NodeJS, dotNET, Python packages, then restart processes and rebuild container images. #Node2Shell #CyberSecurity 🇬🇧 🇩🇪
    Descarcă
    00011
  10. SecurityWeek✓@SecurityWeek
    CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts
    1291.8K
  11. dusheeno@dusheeno
    Node2shell, Python2shell, and now Http2shell. In this new era of AI, vulnerabilities are appearing more frequently than we’d like, and we can’t keep up with patching them. Is it possible to win this battle? #node2shell #python2shell #http2shell
    000150
  12. syrex1013@AdrianDacka
    Node2Shell PoC is now public. CVE-2026-111497 — memory corruption in brotli 1.2.0 affecting Node.js 22/24/26, leading to RCE. No execSync. No eval. No fake webhook. The brotli decoder itself can reach system(). PoC: #Node2Shell #NodeJS #CVE #InfoSec
    1512855147.9K
  15. SecurityWeek✓@SecurityWeek
    CISA Warns of #Node2Shell Exploitation as Honeypots Log Attack Attempts
    6061.8K
  20. Chirag Gandhi@cagandhi4cg
    11 Security Flaws in the Secure Access Provider's software! Seems like this time the Halloween 🎃 will become a real halloween 4 teams of IT Operations, Cyber Security and Software Application Developer #php2shell #node2shell #HTTP2Shell #tailworm #halloween #cybersecurity
    Mark Gadala-Maria @markgadala
    🚨 BREAKING: 11 UNPATCHED Security Flaws Exposed in Tailscale and Headscale. Researchers Demonstrate a Potentially WORMABLE Attack That Can Take Over Entire Server Networks. A new security report called Tailworm has revealed serious vulnerabilities in Tailscale, the widely used zero-trust networking platform. The most alarming finding? Researchers demonstrated how ONE compromised device could gain ROOT access to other servers across a private network in under a second per hop. Here's what researchers discovered: ➜ ROOT ACCESS: Tailscale SSH forwarding flaws reportedly allow an attacker with access to one authorized device to escalate privileges on other permitted servers, bypassing normal Linux user restrictions. ➜ WORM-LIKE PROPAGATION: In laboratory tests, exploitation spread automatically between permitted devices without additional passwords, SSH keys, or user interaction. ➜ CREDENTIAL THEFT: Attackers could potentially capture device enrollment credentials and register malicious machines as legitimate network members. ➜ CLOUD INFRASTRUCTURE EXPOSURE: A vulnerability in experimental app connectors could bypass network access restrictions, potentially exposing AWS cloud credentials, Kubernetes services, and internal infrastructure. ➜ SERVER DISRUPTION: Additional flaws in Headscale, the self-hosted alternative, could allow unauthenticated attackers to exhaust server memory and disrupt device registration. ➜ ADMINISTRATIVE TAKEOVER: Certain Tailscale Serve configurations could expose privileged local management interfaces to remote devices. 🚨 Why this matters: Tailscale is specifically designed to provide secure, private access to infrastructure without exposing servers directly to the internet. But these findings suggest that in vulnerable configurations, an attacker who compromises ONE authorized machine could potentially pivot across multiple servers with administrator-level access. And the vulnerabilities remain unpatched as of October 26. Security researcher Erica Windisch of Cyberdione Labs disclosed the findings after testing Tailscale v1.104.2 and Headscale v0.29.5. Tailscale has acknowledged related security issues and says fixes are underway. The company is NOT recommending that everyone disable Tailscale SSH. ⚠️ Important: The most serious attack requires an existing foothold and specific SSH permissions. This is not an unauthenticated attack against every Tailscale installation. The worm-like propagation was demonstrated in a laboratory, not observed in the wild. What administrators should do NOW: → Audit Tailscale SSH permissions and eliminate unnecessarily broad access rules. → Disable SSH forwarding if it isn't required. → Review app connector permissions and Tailscale Serve configurations. → Enable device key expiration and restrict access to sensitive servers. → Monitor Tailscale's official security updates for patches. 🔒 At Lucid Security, we're offering FREE website security reviews to help businesses identify exploitable vulnerabilities before attackers do. Request yours: Full technical disclosure:
    00085
  21. Mark Gadala-Maria✓@markgadala
    🚨 BREAKING: 11 UNPATCHED Security Flaws Exposed in Tailscale and Headscale. Researchers Demonstrate a Potentially WORMABLE Attack That Can Take Over Entire Server Networks. A new security report called Tailworm has revealed serious vulnerabilities in Tailscale, the widely used zero-trust networking platform. The most alarming finding? Researchers demonstrated how ONE compromised device could gain ROOT access to other servers across a private network in under a second per hop. Here's what researchers discovered: ➜ ROOT ACCESS: Tailscale SSH forwarding flaws reportedly allow an attacker with access to one authorized device to escalate privileges on other permitted servers, bypassing normal Linux user restrictions. ➜ WORM-LIKE PROPAGATION: In laboratory tests, exploitation spread automatically between permitted devices without additional passwords, SSH keys, or user interaction. ➜ CREDENTIAL THEFT: Attackers could potentially capture device enrollment credentials and register malicious machines as legitimate network members. ➜ CLOUD INFRASTRUCTURE EXPOSURE: A vulnerability in experimental app connectors could bypass network access restrictions, potentially exposing AWS cloud credentials, Kubernetes services, and internal infrastructure. ➜ SERVER DISRUPTION: Additional flaws in Headscale, the self-hosted alternative, could allow unauthenticated attackers to exhaust server memory and disrupt device registration. ➜ ADMINISTRATIVE TAKEOVER: Certain Tailscale Serve configurations could expose privileged local management interfaces to remote devices. 🚨 Why this matters: Tailscale is specifically designed to provide secure, private access to infrastructure without exposing servers directly to the internet. But these findings suggest that in vulnerable configurations, an attacker who compromises ONE authorized machine could potentially pivot across multiple servers with administrator-level access. And the vulnerabilities remain unpatched as of October 26. Security researcher Erica Windisch of Cyberdione Labs disclosed the findings after testing Tailscale v1.104.2 and Headscale v0.29.5. Tailscale has acknowledged related security issues and says fixes are underway. The company is NOT recommending that everyone disable Tailscale SSH. ⚠️ Important: The most serious attack requires an existing foothold and specific SSH permissions. This is not an unauthenticated attack against every Tailscale installation. The worm-like propagation was demonstrated in a laboratory, not observed in the wild. What administrators should do NOW: → Audit Tailscale SSH permissions and eliminate unnecessarily broad access rules. → Disable SSH forwarding if it isn't required. → Review app connector permissions and Tailscale Serve configurations. → Enable device key expiration and restrict access to sensitive servers. → Monitor Tailscale's official security updates for patches. 🔒 At Lucid Security, we're offering FREE website security reviews to help businesses identify exploitable vulnerabilities before attackers do. Request yours: Full technical disclosure:
    Descarcă
    212367K
  25. Kingfish737✓@Kingfish737
    Critical Brotli compression flaw "Node2Shell" (CVE-2026-111497) hits Node.js, Python packages and Microsoft .NET, Visual Studio and PowerShell. Patches are out, no attacks reported yet. Update now. #CyberSecurity #Node2Shell
    00050
  26. Arată mai multe postări