VulnCheck reports that hackers are actively exploiting a critical vulnerability in Node-RED to deploy malicious payloads. The flaw, tracked as CVE-2026-58115, allows unauthenticated attackers to execute arbitrary code on servers. Siemens disclosed the issue in August after finding it in its SIMATIC IoT2050 Advanced devices. Attackers have been observed deploying Linux bots and persistent webshells from a single IP address. Organizations are advised to check if their Node-RED instances are accessible from outside their networks.
Read the full story at securityweek.com.
Photo: unknown (CC0) via Openverse
