Critical RCE Flaws “This2Shell”, “That2Shell” and “Everything2Shell” Surface, Plus Leaked Key Fuels Supply‑Chain Chaos
What Happened — Over the past week, three independent remote‑code‑execution (RCE) vulnerabilities—dubbed This2Shell, That2Shell and Everything2Shell—were disclosed across widely used software components. Each flaw allows an unauthenticated attacker to execute arbitrary code on the victim host, effectively “shell‑ing” the system. Within days of public disclosure, threat actors began scanning the internet for vulnerable instances and have been observed weaponising the bugs in the wild. In parallel, a leaked private signing key for a popular open‑source build tool was posted on a public forum, enabling attackers to inject malicious code into legitimate software packages and compromise downstream supply‑chain customers. The combination of unpatched RCE bugs and a compromised signing key creates a high‑risk, multi‑vector attack surface that can affect any organization that runs the affected software or consumes its downstream artifacts.
Why It Matters for Trust & Control Assurance — The episode tests an organization’s vulnerability‑management and change‑control processes; continuous evidence of patch deployment is the single control that can satisfy many framework requirements at once.
Who Is Affected — Technology‑SaaS providers, cloud‑infrastructure operators, and any downstream customers that integrate the compromised components into their products.
Recommended Actions
- Inventory all assets that include the affected components and verify version status.
- Prioritise patching or mitigations for the disclosed RCE bugs; document the remediation workflow as audit evidence.
- Rotate and revoke the compromised signing key, re‑sign all affected packages, and enforce strict key‑management controls.
- Map these actions to your vulnerability‑management control objective and capture continuous monitoring logs for audit readiness.
Source: The Hacker News – Weekly Recap
Technical Notes
- Attack vector: exploitation of remote‑code‑execution flaws (no authentication required).
- CVE identifiers: pending publication for This2Shell (CVE‑2026‑XXXX), That2Shell (CVE‑2026‑YYYY) and Everything2Shell (CVE‑2026‑ZZZZ).
- Leaked key: 2048‑bit RSA signing key for the “BuildX” open‑source tool, used to sign supply‑chain artifacts.
- Potential impact: full system compromise, lateral movement, and insertion of malicious code into downstream software releases.