A flaw nicknamed http2shell could let attackers run commands on servers built with Node, Python and other tools. Site owners should check if they are exposed.
Security firm Aikido Security has shared details of a new flaw called http2shell. It affects Node, Python and other web tools. In the worst case, an attacker could run their own commands on a server from far away. If your website, app or online store runs on these tools, it is worth a quick check.
The flaw is an RCE, short for remote code execution. In plain terms, someone outside your business could take control of a machine and tell it what to do. That could mean reading data, changing a site or using the server for other attacks. Aikido Security posted the news publicly, and it drew strong attention on the Hacker News forum.
Node and Python are named, along with other tools. Both are widely used to build websites and apps, so many businesses could be touched without knowing it. Most owners will not run this software themselves. A developer, agency or hosting company usually does. Customers of affected sites could also be exposed if a business is hit.
Anyone whose site does not use these tools has less to worry about. The same goes for people who only visit websites and do not run one.
The material shared so far is thin. It does not say which versions are affected, whether fixes exist or whether attackers are already using the flaw. Those details matter, and they may change as more information comes out.
The steps in the alert box above are the place to start. The first and simplest is to ask your developer or IT provider whether your systems use Node or Python, then follow up on patches.
Ask whoever runs your website whether it uses Node or Python, and make sure they are watching for http2shell fixes.
A modified Gboard called GboardWu Privacy keeps the features of Google's keyboard but stops it from sending usage data back to Google.
Read more: A modded Google keyboard keeps its features but blocks trackingA new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksEA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a name
