Switch 2 was hacked by software: ns2jb exploit, Homebrew Launcher and missing SmileBASIC 4
On October 22, 2026, security researcher Sammy Hadjhamid, known as pepsipu, published ns2jb, an exploit that allows third-party code to run on the Nintendo Switch 2 without hardware modifications. To work, you need firmware 23.0.1 and the game SmileBASIC 4, launched through backward compatibility.
How hacking works
The exploit chain begins with a 32-bit integer overflow in SmileBASIC 4 array processing and ends with the execution of native code with elevated privileges. According to the developer, when assembling the exploit, he was helped by the OpenAI Codex model: it selected the console memory layout in which the vulnerability would work stably.
As a demonstration, Hadjhamid showed a modified Mario Kart World with unofficial characters ranging from Hatsune Miku to Peter Griffin. The hack is tied: after rebooting the console, it needs to be launched again, and ns2jb does not provide permanent custom firmware.
Nintendo is already reacting
The day after the exploit was published, users noticed that SmileBASIC 4 had disappeared from regional eShop storefronts in North America, Europe and Japan. Nintendo has not formally confirmed the connection between the delisting and the vulnerability, but to reproduce the hack you need version 4.4.9 of this game, so the window for new comers has narrowed sharply.
- Homebrew Launcher has already been launched on the console: the corresponding videos were published by users Alex CVJ and Ravens Claw X.
- Some enthusiasts showed Vulkan running on Switch 2 and reported game dumps, although there is no full-fledged homebrew environment yet.
- An already purchased copy of SmileBASIC 4 will not be removed from consoles, but installing firmware updates will close the exploit.
This is the first public software hack for the Switch 2. It's software, not hardware, so Nintendo could theoretically patch the vulnerability with a regular update - unlike the old Fusée Gelée on the original Switch.
Source: theloadout.com