[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:node-red-cve-2026-58115-exploited-in-the-wild-one-http":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"node-red-cve-2026-58115-exploited-in-the-wild-one-http","rapid-alert","Node-RED CVE-2026-58115 exploited in the wild: one HTTP request drops Linux bots and webshells","A missing authentication flaw in Node-RED (CVSS 10.0) is under active exploitation. Attackers send a single POST to deploy a flow that runs arbitrary code, planting a Linux bot and persistent webshells. Check whether your instance is reachable and whether adminAuth is set.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode-red-cve-2026-58115-exploited-in-the-wild-one-http-e1d48fa9-cover.png","Node-RED CVE-58115 rapid alert: Node-RED reachable from outside? One POST and the box runs their code.","Marcus Lenngren","2026-11-04T12:56:21.464+00:00","![Node-RED CVE-58115 rapid alert: Node-RED reachable from outside? One POST and the box runs their code.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode-red-cve-2026-58115-exploited-in-the-wild-one-http-e1d48fa9-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nAttackers are exploiting CVE-2026-58115, a missing authentication flaw in the Node-RED HTTP interface, to run arbitrary code on exposed servers. Siemens disclosed it on 11 Aug after finding it in SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. It carries a CVSS score of 10.0.\n\nNode-RED is a low-code, flow-based programming tool built on Node.js. It runs on small devices like the Raspberry Pi, in the cloud, and embedded in commercial ICS\u002FOT products. Without adminAuth set, the HTTP interface lets anyone reach the programming nodes that execute system commands.\n\nTwo built-in node types make the attack trivial. An inject node fires a message on a schedule or at startup. An exec node runs a shell command. Wire one to the other and the flow runs a command the moment it is deployed, with no further interaction.\n\nOn 30 Oct, a VulnCheck canary caught a complete exploit: a single POST \u002Fflows that deployed a flow, triggered it automatically, and pulled a binary from an attacker server, all behind three layers of encoding. The flow downloaded a file named bot-linux-amd64, saved it under a hidden name in a memory-backed location, and ran it in the background.\n\n## Timeline\n\n- 11 Aug 2026: Siemens discloses CVE-2026-58115, CVSS 10.0.\n- 30 Oct 2026: First in-the-wild exploit caught by a VulnCheck canary.\n- 30 Oct to 1 Nov: Same IP hits Node-RED 16 times, delivering bots and persistent webshells.\n- 1 Nov: VulnCheck warns publicly and adds the flaw to its KEV catalog.\n\n## Am I affected?\n\nYou are at risk if you run Node-RED anywhere that is reachable from outside your network and adminAuth is not configured. That includes cloud instances, Raspberry Pi deployments, and Node-RED embedded in ICS\u002FOT products.\n\nSiemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED, in versions before V4.3.4.1, are vulnerable. Version 4.3.4.1 and later contain patches.\n\nThe attacks are opportunistic mass scanning. The source IP in Microsoft's network (geolocating to Brazil) logged 125 hits against 8 different CVEs across Apache Solr, Camunda, Gitea, MLflow, Traefik and Joomla, so this actor is sweeping for many flaws at once.\n\n## What to do now\n\n1. Check whether your Node-RED instance is reachable from outside your network today. Block port 1880 at the firewall if it does not need external access.\n2. Enable adminAuth on the editor and admin API. An instance without it is open to anyone who can reach it.\n3. On SIMATIC IoT2050 Advanced, update to V4.3.4.1 or later.\n4. Review all deployed flows for unexpected exec nodes or HTTP endpoints you did not create.\n5. Assume compromise if your instance was exposed. The in-memory bot is lost on reboot, but webshells survive a restart, so a reboot alone does not clean a compromised host.\n\n## How to hunt\n\n- Check for binaries saved under hidden names in memory-backed locations such as \u002Fdev\u002Fshm, and for processes named to look like kernel worker threads.\n- Look in your web server and Node-RED logs for POST \u002Fflows requests from unexpected sources.\n- Review deployed flows for inject nodes wired to exec nodes, or for HTTP-in endpoints acting as webshells.\n- Check outbound connections to the payload servers listed in VulnCheck's indicators of compromise.\n- Watch for shell scripts fetched from external servers and files disguised as kernel threads.\n\n## What does not help\n\n- Rebooting alone. The in-memory bot clears, but any webshells planted stay in place.\n- Patching without enabling adminAuth. If the interface is still open with no authentication, the exploit path remains. CISA had not listed this in its own KEV catalog at the time of writing, so do not wait on that signal.\n\n## Sources\n\n- [Critical Node-RED Flaw Exploited in Attacks](https:\u002F\u002Fwww.securityweek.com\u002Fcritical-node-red-flaw-exploited-in-attacks\u002F), SecurityWeek, 3 Nov\n- [Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F03\u002Fnode-red-cve-2026-58115-exploitation\u002F), Help Net Security, 3 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]