Terminal2Shell PoC shows you get a shell even when the exploit command fails
kingslyj · x · 2026-11-10
Security researcher 0xTib3rius released a 'fully weaponized' proof of concept at terminal2shell.com: the page embeds an interactive terminal, warning 'The page you are reading now has a shell in it.' Clicking in and typing triggers the exploit — and even if the exploit command fails ('command not found'), you still get an interactive shell, underscoring how severe the flaw is. The reposter's take: 'We're cooked.'
More from Safety
- METR's report on Anthropic's RSI progress was redacted as "commercially sensitive"; call to subpoena — trevposts · 2026-11-10
- YC-backed 0.security says it found 30+ Linux kernel 0-days and 500+ CVEs — ycombinator · 2026-11-10
- Cloudflare studies quantum-proof Privacy Pass as forged tokens could bypass bot checks — shashib · 2026-11-10
- Grok API text outputs now watermarked by default across 7 models for EU AI Act — thione · 2026-11-10
- CrowdStrike adds AI Kill Switch in Falcon Guardian to stop rogue agents at gateway — thione · 2026-11-10
- Anthropic unveils open-source FlashProve to cryptographically prove which AI model made an output — thione · 2026-11-10