Search — “/tmp/.kworker”

Since Oct 30, 2026, VulnCheck has observed attackers exploiting CVE-2026-58115, a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices. A single HTTP request deploys and auto-triggers a malicious flow that runs a shell wrapper using wget (curl fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests plant persistent webshells: an HTTP in endpoint (e.g. /cmd) wired to an exec node that runs commands from a query parameter. SecurityWeek reports VulnCheck called the exploitation successful; hunt for wget/curl/sh spawned by the Node-RED process, hidden files in /dev/shm and /tmp, and unexpected exec nodes or HTTP endpoints in deployed flows.

VulnCheck observed attackers, from October 30, 2026, exploiting CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices, against its honeypots. The exploit deploys and auto-triggers a malicious Node-RED flow that runs a shell wrapper using wget (with curl as fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests create HTTP-in endpoints (e.g. /cmd) wired to exec nodes as a persistent command backdoor. Observations are from honeypots; no confirmed victim compromises are reported. Hunt for Node-RED spawning sh/wget/curl, new flows deployed via the admin API, and executables in /dev/shm or /tmp hidden files.