this post was submitted on 09 Nov 2026
169 points (96.2% liked)

Programmer Humor

44080 readers
29 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

founded 7 years ago
MODERATORS
 

Terminal2Shell is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user's keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.

Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.

Product Vector Status
macOS Terminal.app, iTerm2, Ghostty, Warp VULNERABLE
Linux gnome-terminal, Konsole, xterm, Ctrl+Alt+F2 VULNERABLE
Windows cmd.exe, PowerShell, Windows Terminal, WSL VULNERABLE
FreeBSD / OpenBSD Literally the default experience VULNERABLE
DEC VT100 (1978) Physical serial cable VULNERABLE
Your router SSH, telnet, the little console port on the back VULNERABLE
VS Code Ctrl+` (one keystroke!) VULNERABLE
Microsoft Paint None known Not affected
top 30 comments
sorted by: hot top controversial new old
[–] alstocras@lemmy.dbzer0.com 1 points 22 hours ago

well i got compromised this is real guys

[–] savvywolf@pawb.social 36 points 3 days ago (1 children)

Just tested my system, and it looks like I'm vulnerable. I'm uninstalling bash to see if th

[–] Guiorgy@lemmy.ml 15 points 3 days ago (1 children)

I deleted the whole /usr/bin to be sur

[–] Hupf@feddit.org 4 points 2 days ago

You've hit your output token li

[–] PmMeFrogMemes@lemmy.world 5 points 2 days ago (1 children)

This is why I have been daily driving ms paint for years

[–] eldavi@lemmy.ml 1 points 14 hours ago

thank god paint is safe!!! :p

[–] Mister_Hangman@lemmy.world 29 points 3 days ago (1 children)

Oh. This is a joke.

I’m too tired anymore to know what is real apparently.

[–] benagain@lemmy.ml 8 points 3 days ago

Lol yeah. It should have been obvious sooner given how thick it lays the joke on - but I had already entered the "groaning and preparing to power everything down" phase before reading the website.

[–] ICastFist@programming.dev 32 points 3 days ago (1 children)

Ha, my stack of punched cards are immune! Now I just need something to read them...

[–] Tangentism@lemmy.ml 25 points 3 days ago (1 children)

My mum's old knitting machine takes those!

[–] ICastFist@programming.dev 21 points 3 days ago (2 children)
[–] xthexder@l.sw0.com 7 points 3 days ago

A quilt with frames of Doom woven into it would be so cool

[–] racketlauncher831@lemmy.ml 4 points 2 days ago
  • SINGLE PLAYER
  • LOCAL MULTIPLAYER
  • ADD-ONS
  • OPTIONS
  • BETHESDA.NET
[–] nfms@lemmy.ml 12 points 3 days ago

A # prompt indicates the attacker has obtained root. Disconnect from the network, then from society.

😁

[–] data1701d@startrek.website 7 points 3 days ago* (last edited 3 days ago)

And it was discovered with an LLM by some "vibe coder" (please hold your nose while pronouncing) with curly blonde hair, empty blue eyes, a business degree, and horrible political opinions. In addition, he talks your ear off about the inevitable glorious agentic AI future and how nobody needs RAM and that all resources in the world should be used towards bringing this future to past, with his response to most arguments against him being something along the lines of "resistance is futile".

[–] YourBestFriend@quokk.au 9 points 3 days ago

Mac OS 9 and earlier are not effected. Clear the the be… bes… (cringe) best OS ever.

[–] PowerCrazy@lemmy.ml 5 points 3 days ago

No privilege elevation? CVE 0

[–] Carl@hexbear.net 5 points 3 days ago* (last edited 3 days ago)

Several case studies exist of AI agents autonomously executing the Terminal2Shell exploit in order to alter files and run programs on accessed systems. The only solution is a trillion more dollars in investment.

[–] Dyskolos@lemmy.zip 3 points 3 days ago

I'm ashamed it took me THAT long. Only upon opening my yakuake it slowly dawned on me. I really feel dumb now....

[–] cblte@nrw.social 1 points 2 days ago

@Infrapink @schenklklopfer I shared it at work and some people just do not have a sense of humor.

Another good one is: ssh2rce.com

This is what I'm here for

[–] commanderred@chaos.social 1 points 3 days ago (1 children)

@Infrapink ngl I first thought this was real and retooted. This should be marked with a CW imho for it being a shitpost

[–] Guiorgy@lemmy.ml 4 points 3 days ago (1 children)

It's literally in the programmerhumor community 😂

[–] commanderred@chaos.social 0 points 3 days ago (1 children)

@Guiorgy so? I don't have reddit. This is fedi, not some bullshit American platform lol

[–] Guiorgy@lemmy.ml 4 points 3 days ago (1 children)

What are you talking about? I don't know what you use to browse Lemmy, but I use Voyager and it shows clearly that this was posted on the programmerhumor lemmy community/world/instance 😂

[–] commanderred@chaos.social -2 points 3 days ago (1 children)

@Guiorgy whatever a Lemmy is. Well, its a instance to block is what I'm sure lol

[–] Infrapink@thebrainbin.org 2 points 2 days ago (1 children)

OK, let's all calm down and stop insulting each other.

@commanderred@chaos.social is using Mastodon account, so they probably won't even see the magazine, as Mastodon doesn't really support them.

Lemmy is a federated social media software; basically, Lemmy is to Reddit as Mastodon is to Twitter. @Guiorgy@lemmy.ml should know that the Fediverse is bigger than just Lemmy (I use mbin, which is also federated Reddit but different to Lemmy).

Because Mastodon, Lemmy, and mbin all use ActivityPub, we can all talk to each other despite our accounts being on different websites running different software.

[–] Guiorgy@lemmy.ml 2 points 2 days ago (2 children)

For what it's worth I've been on Lemmy for barely over a month, so I'm still pretty new to this. I was not at all expecting to be talking to people from Mastodon or mbin here 🤔

My understanding was that federation allowed many independent Lemmy instances to interact, but nit that it even included other platforms. Looks like I'll have to do some reading into this whole thing.

Thanks for trying to explain!

[–] FuckBigTech347@lemmygrad.ml 2 points 2 days ago* (last edited 2 days ago)

Lemmy is technically capable of communicating with anything that speaks the ActivityPub protocol: https://fediverse.party/

It's kind of like SMTP/IMAP or XMPP or Matrix. Some software may implement more of the protocol than others, and some may implement the same thing in different ways, some may even have their own extensions that others lack or don't care about, etc.