Node.js or Bun Runtime Spawning Shell or Download Utility (Node2Shell CVE-2026-1

Suraj A@cytech

•updated yesterday•2•0•13

Detects a Node.js or Bun process spawning a shell or common download utility on Linux, indicating potential post-exploitation activity such as remote code execution (e.g., CVE-2026-111497).