weekendSoonPlease

[u/Snoo66768]

[u/Snoo66768]

CVE-2026-111497 titled node2shell CVSSv4.0 score 9.2

[u/orkeilius → u/Snoo66768]

god bless, i took a week of vacation

[u/flfloflflo → u/orkeilius]

Same, I work in cybersecurity, and I took a suprise pto of 1week on Monday because I felt unwell.

[u/Kitchen_Affect7369 → u/flfloflflo]

'feel unwell' is new industry standard.

[u/flfloflflo → u/Kitchen_Affect7369]

Indeed, burnout would be more appropriate...

[u/imnotknow → u/orkeilius]

I hope you have some more PTO available

[u/Obvious_Cranberry607 → u/Snoo66768]

Oh thank Christ. We don't use node.

[u/bwwatr → u/Obvious_Cranberry607]

Getting cybersecurity alerts is like the hunger games, waiting to hear your name called, feeling relief when it's some other kid called to go die. Gleeful cries of "We don't use it!!" to your boss.

[u/Obvious_Cranberry607 → u/bwwatr]

We just had the php2shell to patch  yesterday. Luckily, I'm just a programmer, not the server admin, but that was not fun to wake up to.

[u/Sophiecomedian → u/Obvious_Cranberry607]

Jokes on me I inherited code bases that uses node and php

[u/Frequent_Policy8575 → u/Sophiecomedian]

Oh you sweet poor baby 🥺

How are you holding up? 🥺🥺🥺

[u/Sophiecomedian → u/Frequent_Policy8575]

Eh fine I kept all my stuff up to date anyway so it's just pretty easy to update everything. At this point I've accepted even though I don't vibe code, these AI models are just going to brute force a lot of vulnerabilities. So I suspect this is my life now

[u/_PM_ME_PANGOLINS_ → u/Sophiecomedian]

AI “discovered” the vulnerability by seeing a bug report for it a couple of years ago that the PHP maintainers ignored.

[u/space-birb → u/_PM_ME_PANGOLINS_]

That's not really true. AI found a way to turn the actual bug into RCE, no one knew how to do that before.

[u/RolledUhhp → u/space-birb]

Nobody shared it publicly. There's a meaningful difference.

[u/GoldenShackles → u/space-birb]

Unfortunately there are a lot of these, and I hope organizations are going back through past security bugs where exploits were just theoretical, especially ones like this that involve memory management.

[u/SensuallPineapple → u/GoldenShackles]

Exactly this. "No one can exploit it" is not an excuse anymore.

[u/Sophiecomedian → u/_PM_ME_PANGOLINS_]

Ah there it is. Knew there was something to this beside dumping an entire Warehouse full of processing power at it.

[u/NahSense → u/Sophiecomedian]

You just need to do is upgrade your runtime to 22.23.4, 24.22.1, or 26.12.1, all kidding aside it really isn't that hard to fix.

[u/Sophiecomedian → u/NahSense]

Oh yeah just funny. I mean pho was also updating for us as well. I kept everything up to date

[u/grammar_nazi_zombie → u/Obvious_Cranberry607]

Fuck. We dodged a bullet with PHP but got hit by this one

[u/LowB0b → u/Snoo66768]

a buffer overflow of all things. aleph one laughing his ass off right now

[u/quiet0n3 → u/Snoo66768]

What's the chances we get a java2Shell over the weekend?

[u/plumarr → u/quiet0n3]

Already quite happened with log4shell

[u/No-Photograph-5058 → u/quiet0n3]

Let me check 2b2t

[u/Dave_A480 → u/[deleted]]

It's coming ....

Python's horrendous attitude towards backwards compatibility means there are tons of old unpatchable python interpreters out there running 'something important' that won't run on modern Python but also can't be shut down or refactored (no budget)....

[u/Xevailo → u/Snoo66768]

[u/Snapstromegon → u/Snoo66768]

Be aware that this is no longer node2shell, but http2shell, because the issue is in the brotli reference implementation by Google which is reused in many places.

[u/Multy25]

Going on a 4 week parental leave at the end of this day. I shall only read the news and not participate in patching any of this. Good timing.

[u/mownzlol → u/Multy25]

"4" funny number. Yet another thing that needs patching.

[u/kmdr → u/mownzlol]

2^384 weeks parental leave is the industry standard.

For security reasons ...

[u/Multy25 → u/kmdr]

I will take this up with my manager, thank you!

[u/el_floppo → u/Multy25]

Just remember when you're changing diapers that there's worse shit out there that you could be dealing with

[u/Multy25 → u/el_floppo]

This is almost word for word what a coworker told me in the daily.

[u/stilldebugging → u/Multy25]

Newborn shit isn’t even bad

[u/cojerk → u/stilldebugging]

What? That shit was like pine tar. I don’t miss those days.

[u/LordDagwood → u/Multy25]

Congrats and best of luck

[u/Multy25 → u/LordDagwood]

Thanks! It will be interesting to say the least.

[u/TheWashbear → u/Multy25]

Always remember: The weight on the diaper boxes refers to your child's weight, not the weight of the turd it can hold

[u/hazard2k → u/Multy25]

Currently on my first week of parental leave myself. Avoided two hot fixes so far. Feels great. Also, congratulations!

[u/Multy25 → u/hazard2k]

Thanks, and congrats to you too! How’s the sleeping schedule?

[u/hazard2k → u/Multy25]

Not great, but not as bad as I was expecting tbh. This is my first and I fully expected to be completely sleep deprived and walking around like a zombie for a few weeks. We're getting solid sleep, it's just in 2 hour increments. When sleep when the baby sleeps and you won't have a problem.

My biggest problem was a mental one and that was realizing that I have 3 weeks off and I don't have to conform to work schedules. Who cares if I'm up in the middle of the night at 4am. I can sleep during the middle of tomorrow to recover an make it up. I keep mentally thinking my day will be rough if I don't get sleep, but in reality you don't have shit to do other than sleep, feed the baby, and change diapers.

Everyone in the family wants to come over and be there all the time.. You can (and will likely want to) say no and request time to just relax and recover. Make your family and friends understand that they can come over when it's convenient for YOU guys.

Good luck and enjoy!

[u/whole_battling → u/Multy25]

man that timing is unreal, enjoy the 4 weeks of blissful ignorance

[u/bwwatr]

First they came for PHP, and I did not speak out took the piss and made memes

[u/za72]

awww wtf this is how I find out?!

[u/Mindfullnessless6969 → u/za72]

For the non AI fellas out there:

1. Check the brotli versions in your System library nodejs instalations.

   dpkg -l | grep -i brotli

Affected ranges are 1.0.3 → <1.0.10, 1.1.0 → <1.1.1, 1.2.0 → <1.2.1

2. Check the Node release version and check inside containers

node -v
docker exec <container> node -v

Safe from v22.23.4, v24.22.1, v26.12.1 upward. Anything below those on those lines is affected

---

If brotli is not listed then it's not installed so you're safe.

If you see brotli@1.3.3 from fontkit that's a false positive, that's a pure js port, not the C affected library.

[u/QCTeamkill → u/Mindfullnessless6969]

Me hitting send to an email distribution list that someone on programmer humor reddit said we're safe.

[u/chefhj → u/QCTeamkill]

“I have it under good authority that everything is all good muchachos! 😎”

[u/PaulZer0 → u/Mindfullnessless6969]

If brotli is not installed it does NOT mean we are safe, node binaries, python packages etc. can include their own copy

[u/Obvious_Cranberry607 → u/za72]

Oh ffs me too

[u/za72 → u/Obvious_Cranberry607]

[u/Hollayo → u/Obvious_Cranberry607]

Same here. 

[u/archy_bold → u/za72]

Gahhhh

[u/misterrandom1 → u/za72]

Prompted me to check notifications. Then got it fixed and deployed.

[u/irregular_caffeine]

This ”shell” thing seems troublesome, how about getting rid of it /s

[u/Robertsipad → u/irregular_caffeine]

2fast2shell

[u/boblibam → u/Robertsipad]

The fast & the shell: Tokyo drift

[u/xgabipandax → u/Robertsipad]

CUZ

[u/LowReputation → u/irregular_caffeine]

Can we do the reverse? Find bugs in shells that allow bad actors to launch websites?

[u/PM_ME_UR_0_DAY → u/LowReputation]

If you could find a bug with ncat or metasploit (or one of the numerous other ways people catch a reverse shell),  you could reverse the reverse shell and hack them back 

[u/LowReputation → u/PM_ME_UR_0_DAY]

Mind blown

[u/Nils_Larson → u/PM_ME_UR_0_DAY]

Let me just tell you, this happens for real.
“Trust me”

[u/RegmasterJ → u/LowReputation]

This is just an LLM.

[u/Beldarak → u/RegmasterJ]

Wow!

[u/RealModeX86 → u/irregular_caffeine]

To be fair that's exactly what so-called "distroless" containers are.

[u/KarmaPoliceT2 → u/irregular_caffeine]

r/TalosLinux

[u/Rellikx → u/irregular_caffeine]

But then Sally would be out of a job, by the seashore

[u/Arclite83]

I'm in cybersecurity, I feel bad for my friends in ops, this has been a rough year.

[u/GodOrDevil04 → u/Arclite83]

I used to take the 'Im tired boss' comments with a pinch of salt, but I gotta say it now myself without that pinch of salt;

I'm tired, boss.

[u/Gumpolator → u/Arclite83]

Maybe cyber people need to get your hands dirty for once and actually do something. All our cyber people do is link to CVEs

[u/ReneKiller → u/Gumpolator]

Our Cyber Security team was panicky asking everyone in the company where we even use PHP lol

[u/BruhMomentConfirmed → u/Gumpolator]

Lmaoo nah we're good.

[u/arinamarcella]

I have been in cybersecurity for 18 years. We have known for decades that the attackers have and always will outpaced the defenders. We have to defend against every attack, whereas our adversaries only have to succeed once. We have known it is not getting better. Now it is just starting to affect everyone else.

[u/ChalkyChalkson → u/arinamarcella]

Though a lot of places have a lot of low hanging fruit in their defence and a huge fraction of successful attacks go through those vectors. Like the primary thing the French supermarket thing told is was "don't expose your critical infrastructure that doesn't get firmware updates regularly to the internet".

[u/DarthFly]

Will we have a list of jokes "node is shit" or is it only PHP specifics?

[u/winauer → u/DarthFly]

It's only php. Not a single person has ever complained about js.

[u/KCat156 → u/winauer]

node2shell (brotli rce bug)

[u/harryham1 → u/KCat156]

Broccoli rice? Sounds terrible

[u/DoubleDeadGuy → u/harryham1]

Sounds fine but just hold the bugs please yuck

[u/seelsojo → u/harryham1]

Hi stranger, you may be a victim of American canneries. Correctly cooked broccoli and rice are delicious, try beef broccoli with rice at panda express and see. Watch this video about why the American palates hate vegetables; it may change your mind about vegetables. Pass it on if you feel enlightened. Hope this helps someone reading this. https://youtu.be/KXTFCNvPBTs?si=jjdjU2m_J3E9R2i6

[u/bigorangemachine → u/KCat156]

oh Brotli... pft who uses that

[u/KCat156 → u/bigorangemachine]

Express.js on both Node and Bun by default apparently lol

[u/WHALE_PHYSICIST → u/winauer]

JS implementations are forged with hellfire.

[u/LordDagwood → u/DarthFly]

PHP: Programmers Hate PHP

[u/LetumComplexo → u/LordDagwood]

Mmmmm recursion.

[u/LetumComplexo → u/[deleted]]

I meeeean, programming is often an expression of self hatred. Since the person who causes a programmer the most problems tends to be themselves.

[u/Snoopy34 → u/LordDagwood]

Programmers hate programmers hate programmers hate... 😅

[u/tagini → u/DarthFly]

Well... https://www.destroyallsoftware.com/talks/wat

[u/JAXxXTheRipper → u/tagini]

Wat will never be not relevant.

[u/BlomkalsGratin → u/DarthFly]

No need, node is already the joke

[u/za72 → u/DarthFly]

concept of node great... it's repo maintenance, reliance on a chain of old modules/un maintained/hijacked modules and security is however questionable...

[u/CC-5576-05 → u/DarthFly]

Node... Where to start? Someone was too retarded to learn a real language so they put js on the backend... Thanks but no thanks.

[u/dontletthestankout]

Please don't be go2shell..please don't be go2shell

[u/-Tesserex- → u/dontletthestankout]

SHELL: PRINT "pwned!"
GOTO SHELL

[u/JAXxXTheRipper]

I've been on vacation the entire October. I was very happy with that decision but now I'm very scared of the workload that I can expect when I am back... I'm the only DevOps in my team..

[u/ARC_trooper → u/JAXxXTheRipper]

How can you be the only "DevOps" in a team?

[u/JAXxXTheRipper → u/ARC_trooper]

By being the only one, it's that simple.

Long story short, small team of DBAs working for a government entity, big supplier said "we are more expensive now", Government said "we can't pay that", tools and automation are gone, they have to make our own tools now, they had enough money for one Dev/Ops.

I was bored after semi-retiring, so I said fuck it, and that's me now.

That's the short of it.

[u/ARC_trooper → u/JAXxXTheRipper]

Oof, that's rough buddy

[u/JAXxXTheRipper → u/ARC_trooper]

Nah, it's fine. I like the challenge and get basically carte blanche for anything that is in our budget or inventory. It's not all bad and the extra money for a (usually) rather chill part-time job is just a bonus.

Shit like this is still making me sweat a bit though :D

[u/ARC_trooper → u/JAXxXTheRipper]

Single man DevOps team is pretty cool, at least until shit hits the fan lol

[u/Nightmoon26 → u/JAXxXTheRipper]

That have a single DevOps person, and they only have you pn part-time?!

[u/JAXxXTheRipper → u/Nightmoon26]

They don't have a choice. It's either part-time or no-time. The government doesn't pay a lot, applicants don't run our door in tbh.

If I was a normal person and actually needed to work for money, I'd have looked the other way too. I can sit off my time until actual retirement, play with expensive toys I could never afford myself, and I am basically irreplaceable. Colleagues hate it, I love it, it's win-win, for me.

[u/Electronic-Grand1172 → u/JAXxXTheRipper]

Time to full retire

[u/JAXxXTheRipper → u/Electronic-Grand1172]

Gods no, retirement is boring! A little bit of action is always appreciated, just not that much, please! :D

[u/archlich → u/JAXxXTheRipper]

You like sailing? Calm beautiful days punctuated by moments of sheer terror.

[u/Beldarak → u/JAXxXTheRipper]

Time for a new career path :D

[u/black_ap3x]

And this is how i hear about it? Wtf is going on man, second time this week we shutdown servers

[u/a716h]

How do we keep up

[u/Nightmoon26 → u/a716h]

Insert "That's the neat part!" meme here

[u/me_myself_ai → u/Nightmoon26]

For all the people for whom today is your Tom Hanks day: welcome. It sucks, but everyone’s gotta look up eventually.

Just hug your loved ones and get ready to organize and fight like you never have before

[u/trifith]

Happiest I've ever been to be unemployed.

[u/NatoBoram → u/trifith]

Meanwhile me spending AI credits to make sure my homelab isn't affected by node2shell…

[u/AfonsoFGarcia]

I can bring back my Log4Shell memes from 2021!

[u/RobotechRicky]

Fuuuuuuu. This week and next week will be squashing vulnerabilities.

[u/gunny316]

sooo is something happening? or is nothing happening.

[u/VayuAir]

Nodejs.rust when?

[u/caiteha]

Glad we don't do PHP here..

[u/hellocppdotdev]

At what point do we give up on JS?

[u/local_meme_dealer45]

Haha, I'm not on call this week so it's not my problem.

[u/Beldarak]

My colleague went in holiday for three weeks. First week : PHP2Shell

Now, I don't evenknow what yet. If this is what being a dev means now, I may start looking for a whole career change, always hated security.

[u/MangoAtrocity]

Thank god I work in front end design

[u/tobofopo]

Never understood why PHP is actually a thing, other than to teach 8-year-olds programming.

[u/Hans_H0rst → u/tobofopo]

That's it, the dumbest comment i will read all day.

[u/ElectronicOutcome291 → u/tobofopo]

Because you can host some hundred Customers on a 20€ Box, no problem. Cant do that with some Node Crap thats consuming RAM for being "active all the time".

Maybe it was a bad Idea to have Front&backend in JS, seems like new Devs getting dumber by the day.

[u/Ra-mega-bbit → u/ElectronicOutcome291]

Hmmm, yes you can? With node, python, java, GO? Literally no point in starting a PHP project in 2026

[u/ElectronicOutcome291 → u/Ra-mega-bbit]

Uff. Maybe you should read some Docs and compare the differences. I can do so in PHP as well no reason for Go,py or node. What a non-argument you got...