Node.js/Bun runtime spawning shell or interpreter child (Node2Shell post-exploit

Suraj A@cytech

•updated 4 days ago•25•0•26

Detects post-exploitation activity where a Node.js or Bun runtime process spawns a shell, interpreter, or network download utility, which could indicate exploitation such as CVE-2026-111497 (Node2Shell).