Cybersecurity threats evolve with BYOVD economy and Node.js vulnerability

The cybersecurity landscape is facing two distinct high-level threats. First, the technique known as Bring Your Own Vulnerable Driver (BYOVD) has transitioned from an isolated tactic into a structured service industry. Cybercriminal groups, such as the Ransomware-as-a-Service (RaaS) operator ‘hastalamuerte’, are utilizing proprietary frameworks to bypass Endpoint Detection and Response (EDR) solutions. This industrial-scale approach involves specialized product logic, resale channels, and technical support. The ‘hastalamuerte’ kit includes multiple variants designed to exploit vulnerable legitimate drivers from companies like NSecsoft, Zemana, Qihoo 360, and Safetica, targeting over 400 processes across approximately 48 different security products.

Separately, a critical vulnerability in Node.js, dubbed ‘Node2Shell’ (CVE-2026-111497), has been identified. Researchers at Imperva demonstrated that an attacker can achieve arbitrary code execution by using specially crafted Brotli-compressed data. While initial public proofs of concept were limited, Imperva researchers successfully demonstrated code execution on official Node.js images for Linux arm64. The vulnerability affects the decoder and poses a significant risk to applications that decompress untrusted Brotli data from HTTP requests or external servers. Patches are available in Node.js versions 22.23.4, 24.22.1, and 26.12.1.