‼️ After PHP2Shell comes Node2Shell, a critical bug found by OpenAI's Codex Security that can let attackers run code in Node.js apps.
It was successfuly demonstrated on the official Node.js 24.22.0 image.
Node 20, 23 and 25 (all EoL) get no fix.
It was successfuly demonstrated on the official Node.js 24.22.0 image.
Node 20, 23 and 25 (all EoL) get no fix.
Oct 23, 2026 · 3:04 AM UTC
70
464
3,797
292,007
@IntCyberDigest niga give me a break what the fuck, half of my working day is spent patching shit like this
5
1
182
8,517
@IntCyberDigest Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1 by rejecting invalid inputs; EOL versions 20, 23, and 25 get no patches
Gotta hate this version numbers
Gotta hate this version numbers
1
1
87
13,510
@IntCyberDigest you have added the wrong patch fix version: nodejs.org/en/blog/releas…
0
0
7
3,650
@IntCyberDigest "demonstrated on node:24.22.0" is good, but the EoL versions getting no fix means a lot of prod still sitting exposed. is there a payload sample or just the demo video?
0
0
1
674
@IntCyberDigest @grok why are node versions so weird and 25 is EoL?
1
0
5
3,676
@IntCyberDigest Is bun affected? @jarredsumner
1
0
1
4,772
@IntCyberDigest node2shell will outlive us all. what finally took it out?
0
0
0
1,407
@IntCyberDigest omg good that we've upgraded last night
0
0
0
1,820
@IntCyberDigest @grok what about versions before 20… we all got some teams out there….
1
0
0
240
@IntCyberDigest I swear every week there's a new thing to stress about
0
0
0
3
@IntCyberDigest I can help with that. x.com/franzbruckhoff…
Prompt of the day:
----
Run a full application-wide security audit strictly following the methodology in github.com/cloudflare/sec…
Exhaustively trace all untrusted inputs to execution sinks, inspect all auth/access controls, dependencies, and configurations. Verify your findings. When you think you have found all vulnerabilities: You haven't. Keep investigating.
Report vulnerabilities with: (1) severity, (2) exact file/line location, (3) root cause & attack vector, and (4) concrete remediation patches.
----
Use a top reasoning model for this. Gemini Argon 4 seems very sharp here.
0
1
6
6,108
@IntCyberDigest no fix for node 20, aka the version half of prod will still be running in 2030 lol
0
0
57
8,646
@IntCyberDigest everything is getting exploited, life is so boring and underwhelming
0
0
2
750
@IntCyberDigest node 20 only went EoL in april and a ton of prod still runs it
0
0
12
4,242
@IntCyberDigest Same pattern as PHP: EoL gets no fix. Node 20 hit end of life in April, and plenty of prod is still on it
0
0
1
1,196
@IntCyberDigest En tu cara node lover, no te metas con PHP 👊
0
0
0
154
@IntCyberDigest Node 20, 23 and 25 getting no fix is the real takeaway. If anything you run is still on an EoL Node version, this is the push to move.
0
0
4
3,366
@IntCyberDigest also check the clis that ship their own runtime. claude code bundles bun, so updating node on your machine doesnt patch it. claude update does
0
0
1
1,125
Win a year of socks (1 pair a month)
Every pair purchased between Oct 25 - Nov 21 receives 3 entries.
No purchase necessary.
Enter for free @ hello@boldfoot.com or message @BoldfootSocks on X with your name and contact info.
Legal US Residents, 18+.
One winner selected at random.
Every pair purchased between Oct 25 - Nov 21 receives 3 entries.
No purchase necessary.
Enter for free @ hello@boldfoot.com or message @BoldfootSocks on X with your name and contact info.
Legal US Residents, 18+.
One winner selected at random.
0
0
4
51,792
@IntCyberDigest That's one of the critical Node.js RCE bugs, and we actually covered the full security situation: x.com/AGTPinsights/s…
Node.js just patched 10 vulnerabilities, including a high-severity remote code execution bug. Here's what you need to know.
On Wednesday, October 21, 2026, Node.js shipped security releases for all three supported lines, 22.x, 24.x and 26.x. Four of the ten flaws are rated high, low. The project reports no exploitation so far.
The worst one is CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Decompressing attacker-controlled data can leak memory or lead to remote code execution. You don't need to call Brotli yourself, since your app can hit it through anything that decompresses data, like HTTP responses.
Vercel's developer account flagged it first in the tweet that drew most of the attention, 384K views. Vercel says its WAF rules are live for every project and block known exploit patterns. It still urges upgrading. Some developers said they paused features until Vercel pushes a patched runtime. Other hosts, like Mojave Cloud, say they already run the patched versions.
Other fixes in the release: randomUUID() could generate the same values in every process, and a TLS bypass worked using fullwidth digits like １２７.０.０.１. Node maintainer Matteo Collina said the team rushed the RCE fix for a week, worried it would be found by AI models. The same day also brought PHP, GitLab and NGINX security fixes.
Key numbers:
- 10 CVEs fixed: 4 high, 3 medium, 3 low
- CVE-2026-111497: Brotli decoder RCE, high severity
- Fixed versions: 22.23.4, 24.22.1, 26.12.1
- Affected lines: Node.js 22, 24 and 26
If you run Node.js on your own servers, update to the patched version for your line now.
0
0
0
1,206
@IntCyberDigest PHP2Shell 前脚刚爆，Node2Shell 后脚就来了——AI 这是照着运行时名单挨个挖，下一个轮到谁？
0
0
0
360
@IntCyberDigest Brotli in the fetch path puts every service that parses a response body from a URL in scope. That is a lot of services
0
0
1
180
@IntCyberDigest i updated my nodejs after hearing about it from ming736
0
0
1
1,131
@IntCyberDigest The flowchart is the warning: one path is your app reading a compressed response, the other is an attacker sending a crafted request body. If you cannot update Node.js 24 at once, restrict those two inputs first, then check prod for any EoL Node versions still running.
0
0
2
3,593
@IntCyberDigest every node dev who spent this week dunking on php has gone very quiet
0
0
0
504
@IntCyberDigest unpatched eol versions are just free real estate at this point nobody can tell me otherwise
0
1
1
518
@IntCyberDigest The fact that the demonstration succeeded directly on official Node.js 24.22.0 images shows how severe the execution path is. Leaving unsupported versions without patches creates huge exposure for teams slow to upgrade.
0
0
1
2,267
@IntCyberDigest itz scam node2shell its ddos not rce , php2shell not mass exploit its neroslop
0
0
0
107
@IntCyberDigest When are we getting a break from this?
0
0
0
293