A VulnCheck canary has caught the first live exploitation of CVE-2026-58115, an unauthenticated Node-RED admin API flaw.

Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and backdoors on unprotected ...

Hackers are exploiting CVE-2026-58115, a critical-severity Node-RED vulnerability, to deploy various payloads.

Attackers exploit CVE-2026-58115 in Siemens SIMATIC IoT2050 devices to deploy Linux bot payloads and command execution backdoors.

IntroductionIn the previous article, I introduced how to call the official SwitchBot API from Node-RED installed on a ...

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: ...

Chidera, who managed the project, explained that, as promised on the tin, HTTP/3 delivers the web faster than HTTP/2, though ...

ELLIO logs the first in-the-wild Node2Shell (CVE-2026-111497) attack — a 23 MB Brotli payload hitting stock Node.js. Patch ...

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

CVE-2026-111497 in Google’s Brotli decoder can corrupt memory across Node.js, Bun, Python and Envoy, with code execution ...

Cloudflare announced an emergency update to its Cloudflare Managed Ruleset, adding two web application firewall rules for the ...