# Critical Security Update: RNS 1.3.9 fixes severe rnsh security flaw

_General · started by Mark on Sun, Jul 19, 2026 12:52 AM_

---

## Original post

**Mark** · Sun, Jul 19, 2026 12:52 AM

Release is out on Aleph, pip and GitHub.

Update **now**.

Due to the nature of the issue, I will not disclose any further details for the time being. Once operators have had time to update, I will of course provide a full report for transparency. If you use `rnsh`, update **right now**.

Earlier today, I became aware of an issue that has been hiding in `rnsh` since the very early versions. Most likely, *all* versions of `rnsh` are affected. Regrettably, I did not spot this bug when I merged `rnsh` into RNS as an included utility (at version 1.2.0).

Turnaround time on this issue has been approximately 9 hours. As soon as I became aware of the situation, I dropped everything else to thouroughly analyze it, and implemented a fix, as well as combing over the code for potential similar bugs. It's looking good now, but I can assure that I will take another round at the `rnsh` code once I've had the chance to catch some sleep.

**Important**: The new version of `rnsh` changes default identity file locations, and these will now be sourced from `~/.rnsh/identity` (initiator) and `~/.rnsh/identity.default` (listener). Make sure you copy your old files to this directory, or specify a custom identity path using the command line arguments. The `--config` argument has also been renamed to `--rnsconfig`, and the `--config` argument will now specify the `rnsh` configuration directory instead of the RNS configuration directory, bringing the behavior into alignment with other RNS utilities.

See the release changelog for additional details about this release.

---

## Reply 1

**ButcherPete** · Mon, Jul 20, 2026 8:12 AM

Thank you Mark for your dilligence and speedy update.

---

## Reply 2

**m0nad** · Mon, Jul 20, 2026 1:01 PM

Folks, I just manage to build an exploit to it! It is an unauth RCE, update right away!

---

## Reply 3

**Mark** · Mon, Jul 20, 2026 5:34 PM

Yeah, so if people couldn't guess already that it's an unauthenticated RCE, it's definitely official now. Probably goes without saying, but don't publish the exploit m0nad - there may still be people who haven't seen this and had time to update.

I'm curious whether you figured it out yourself, or used an LLM on the git diffs to find it?

---

## Reply 4

**kc1awv** · Mon, Jul 20, 2026 5:45 PM

"look at what I can do!"

---

## Reply 5

**m0nad** · Tue, Jul 21, 2026 7:01 AM

**Mark** wrote:
> Yeah, so if people couldn't guess already that it's an unauthenticated RCE, it's definitely official now. Probably goes without saying, but don't publish the exploit m0nad - there may still be people who haven't seen this and had time to update.
> 
> I'm curious whether you figured it out yourself, or used an LLM on the git diffs to find it?

Not publishing until the full details are released. 

The reason for posting was to alert people that is not that hard to do this. If I can do it, adversaries can do it. But of it is not appreciated I will avoid warning people next time.

And yes, open weights llms on the git history did the trick.

---

## Reply 6

**Mark** · Tue, Jul 21, 2026 9:23 AM

Didn't mean to say it was not appreciated, I was just genuinely curious how you went about it.

---