this post was submitted on 09 Nov 2026
169 points (96.2% liked)

Programmer Humor

44080 readers
29 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

founded 7 years ago
MODERATORS
cat_programmer@lemmy.ml
AgreeableLandscape@lemmy.ml
169
terminal2Shell is a critical flaw present in every operating system since 1971 allows anyone who opens a terminal to obtain a fully interactive shell. Instantly. With no authentication beyond the one (terminal2shell.com)
submitted 3 days ago by Infrapink@thebrainbin.org to c/programmerhumor@lemmy.ml
30 comments fedilink hide all child comments
 

Terminal2Shell is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user's keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.

Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.

Product Vector Status
macOS Terminal.app, iTerm2, Ghostty, Warp VULNERABLE
Linux gnome-terminal, Konsole, xterm, Ctrl+Alt+F2 VULNERABLE
Windows cmd.exe, PowerShell, Windows Terminal, WSL VULNERABLE
FreeBSD / OpenBSD Literally the default experience VULNERABLE
DEC VT100 (1978) Physical serial cable VULNERABLE
Your router SSH, telnet, the little console port on the back VULNERABLE
VS Code Ctrl+` (one keystroke!) VULNERABLE
Microsoft Paint None known Not affected
you are viewing a single comment's thread
view the rest of the comments
[โ€“] commanderred@chaos.social 1 points 3 days ago (1 children)

@Infrapink ngl I first thought this was real and retooted. This should be marked with a CW imho for it being a shitpost

[โ€“] Guiorgy@lemmy.ml 4 points 3 days ago (1 children)

It's literally in the programmerhumor community ๐Ÿ˜‚

[โ€“] commanderred@chaos.social 0 points 3 days ago (1 children)

@Guiorgy so? I don't have reddit. This is fedi, not some bullshit American platform lol

[โ€“] Guiorgy@lemmy.ml 4 points 3 days ago (1 children)

What are you talking about? I don't know what you use to browse Lemmy, but I use Voyager and it shows clearly that this was posted on the programmerhumor lemmy community/world/instance ๐Ÿ˜‚

[โ€“] commanderred@chaos.social -2 points 3 days ago (1 children)

@Guiorgy whatever a Lemmy is. Well, its a instance to block is what I'm sure lol

[โ€“] Infrapink@thebrainbin.org 2 points 2 days ago (1 children)

OK, let's all calm down and stop insulting each other.

@commanderred@chaos.social is using Mastodon account, so they probably won't even see the magazine, as Mastodon doesn't really support them.

Lemmy is a federated social media software; basically, Lemmy is to Reddit as Mastodon is to Twitter. @Guiorgy@lemmy.ml should know that the Fediverse is bigger than just Lemmy (I use mbin, which is also federated Reddit but different to Lemmy).

Because Mastodon, Lemmy, and mbin all use ActivityPub, we can all talk to each other despite our accounts being on different websites running different software.

[โ€“] Guiorgy@lemmy.ml 2 points 2 days ago (2 children)

For what it's worth I've been on Lemmy for barely over a month, so I'm still pretty new to this. I was not at all expecting to be talking to people from Mastodon or mbin here ๐Ÿค”

My understanding was that federation allowed many independent Lemmy instances to interact, but nit that it even included other platforms. Looks like I'll have to do some reading into this whole thing.

Thanks for trying to explain!

[โ€“] FuckBigTech347@lemmygrad.ml 2 points 2 days ago* (last edited 2 days ago)

Lemmy is technically capable of communicating with anything that speaks the ActivityPub protocol: https://fediverse.party/

It's kind of like SMTP/IMAP or XMPP or Matrix. Some software may implement more of the protocol than others, and some may implement the same thing in different ways, some may even have their own extensions that others lack or don't care about, etc.