A critical flaw present in every operating system since 1971 allows anyone who opens a terminal to obtain a fully interactive shell. Instantly. With no authentication beyond the one they already did.
CVSS score (out of 10): 11.0
Time to exploit: 0ms
Window of exposure: 55 years
Attack complexity: 1 click
REDACTED is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user’s keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.
Available exploits:
whoami: identify the attacker
id: enumerate privileges
sudo: attempt privilege escalation
ls: exfiltrate directory
patch: apply vendor fix
exit: attempt to escape
clear: destroy the evidence
Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.
Exploitation steps: 1. Open terminal. 2. There is no step 2.
Exploitation requires local access, a working keyboard, and the ability to locate the Terminal application. Threat intelligence indicates all three are widely available to attackers.
Affected systems:
MacOS (all versions): vulnerable
Linux (all distributions): vulnerable
Windows: vulnerable
FreeBSD/OpenBSD: vulnerable
Dec VT100 (1978): vulnerable
Your router: vulnerable
VS Code: vulnerable
Microsoft Paint: not affected
If you see any of the following characters followed by a blinking cursor, your system is actively compromised:
$ % > ❯ #
A # prompt indicates the attacker has obtained root. Disconnect from the network, then from society.
No vendor patch is available. Until one is released, we recommend the following compensating controls:
Do not open terminals: This is the most effective mitigation. Note that many developers report opening terminals “for work,” which security teams should treat as a red flag.
Close terminals immediately after opening them: Partial mitigation only. Reopening the terminal reintroduces the vulnerability.
Type slower: Reduces commands per minute and therefore attack throughput.
Remove the keyboard: Effective, but the on-screen keyboard is a known bypass.
Set SHELL=/bin/false: Fully remediates the issue. Also fully remediates your ability to use the computer.
1971 - Vulnerable code ships in Unix v1 as the Thompson shell.
1979 - Bourne shell released. Vulnerability preserved with full backwards compatibility.
1989 - Bash released. Name confirms the attack is intentional.
2009 - zsh adoption grows. Now the shell is also pretty, which researchers believe lures more victims.
2026 - Researchers notify all vendors simultaneously.
2026 - Vendors respond: “That is what a terminal is.”
2026 - Researchers register a domain, design a logo, and contact the press. Coordinated disclosure considered complete.
Am I affected? If you own a computer, yes. If you own a phone, you are affected but have not found the terminal yet.
Is this being exploited in the wild? Yes. Telemetry shows millions of developers exploiting REDACTED every day, often dozens of times per hour. Some have set it to open automatically on login.
Can the attacker escalate to root? Only if they know the user’s password. Unfortunately, in the most common attack scenario, the attacker is the user.
Why does it have a logo? Every serious vulnerability needs a logo, a domain, and a name ending in a number followed by a noun. This one has all three, so it must be serious.
Is this related to the other *REDACTED vulnerabilities? Directly. We reviewed the public proof-of-concept for every *REDACTED vulnerability we could find, and nearly all of them begin the same way: the researcher opens a terminal and types a command. Every one of those exploits depends on REDACTED. It is the vulnerability underneath the vulnerabilities, and the only one that comes with a free shell before the attack even starts. Fixing REDACTED would neutralize most of the *REDACTED family overnight. It would also stop the researchers from writing their next blog post, which is why no vendor will touch it.
Should I panic? Yes. Panicking is the recommended response to any vulnerability with a website. Please share this page with your CISO, your mother, and at least three news outlets.
