Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Our team discovered a critical remote code execution vulnerability in Next.js. If you self-host Next.js, update immediately. Vercel managed Next.js hosts are safe! We’ll publish the technical details and proof of concept soon!

Hacktron AI

4,676 subscribers

103,441 views • 8 days ago •via X (Twitter)

Science & Technology

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Quick demo of Stripe Managed Payments (MoR) Here's my tiny Next.js app, a few prompts in Cursor, and the Stripe docs handle the rest One line of code and it just works

Quick demo of Stripe Managed Payments (MoR) Here's my tiny Next.js app, a few prompts in Cursor, and the Stripe docs handle the rest One line of code and it just works

JR Farr

29,365 views • 9 months ago

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible

Rob Pruzan

184,796 views • 1 year ago

Midday's new website is out, and I'm so proud of Viktor. Viktor used to design in Figma, then hand it over to me. Now he uses Cursor and built the whole new site in Next.js, pushing it to Vercel. For a two-person team, this is the future.

Midday's new website is out, and I'm so proud of Viktor. Viktor used to design in Figma, then hand it over to me. Now he uses Cursor and built the whole new site in Next.js, pushing it to Vercel. For a two-person team, this is the future.

Pontus Abrahamsson — oss/acc

42,180 views • 7 months ago

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

Hakai Offsec

11,409 views • 3 months ago

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

International Cyber Digest

952,769 views • 3 months ago

We’re applying to the Pump.fun Build in Public Hackathon. We're building Clovr. An AI tool that turns ideas into real Next.js frontends. No more boilerplate. No more blank files. Just clean, ready-to-use, beautiful code you can export or open straight in a GitHub repo. We’re building the future of how frontends are built.

We’re applying to the Pump.fun Build in Public Hackathon. We're building Clovr. An AI tool that turns ideas into real Next.js frontends. No more boilerplate. No more blank files. Just clean, ready-to-use, beautiful code you can export or open straight in a GitHub repo. We’re building the future of how frontends are built.

Alby Churven

24,523 views • 6 months ago

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

CertiK

341,505 views • 2 years ago

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.

Guillermo Rauch

15,875,350 views • 6 months ago

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.

Santiago

33,004 views • 9 months ago

Sarah (sarah) built a production-ready AI chatbot connected to 1,000+ apps in 10 minutes. Here's exactly what she did: •Started with Vercel's chat template •Deployed it instantly: repo + storage + production •Integrated Composio: 1,000+ apps •Connected Gmail and Slack - zero OAuth config •Demonstrated it live: bot sent Julia Fedorin a Slack message Stack: Vercel AI SDK + Next.js + Composio (1,000+ toolkits) Using Vercel AI's template + Composio lets you enable cross-app actions without spending weeks on authentication flows. If you're building AI agents, this is how you skip the boilerplate. What's your stack for shipping agents fast?

Sarah (sarah) built a production-ready AI chatbot connected to 1,000+ apps in 10 minutes. Here's exactly what she did: •Started with Vercel's chat template •Deployed it instantly: repo + storage + production •Integrated Composio: 1,000+ apps •Connected Gmail and Slack - zero OAuth config •Demonstrated it live: bot sent Julia Fedorin a Slack message Stack: Vercel AI SDK + Next.js + Composio (1,000+ toolkits) Using Vercel AI's template + Composio lets you enable cross-app actions without spending weeks on authentication flows. If you're building AI agents, this is how you skip the boilerplate. What's your stack for shipping agents fast?

Composio

27,724 views • 5 months ago

New course: Building Coding Agents with Tool Execution, taught by Tereza Tizkova and Fra from E2B. Most AI agents are limited to predefined function calls. This short course teaches you to build agents that write and execute code to accomplish tasks, accessing entire programming language ecosystems instead of being restricted to a fixed set of tools. You'll learn to run agent-generated code safely in sandboxed cloud environments that protect your systems from harmful operations. Skills you'll gain: - Build agents that write and execute code, manage files, and handle errors autonomously through feedback loops - Run agent code safely in E2B cloud sandboxes and understand tradeoffs between local, containerized, and cloud execution - Create a data analyst agent that explores visualizes data with Pandas - Create a full-stack agent that builds complete Next.js web applications Join and build agents that code their way through complex tasks:

New course: Building Coding Agents with Tool Execution, taught by Tereza Tizkova and Fra from E2B. Most AI agents are limited to predefined function calls. This short course teaches you to build agents that write and execute code to accomplish tasks, accessing entire programming language ecosystems instead of being restricted to a fixed set of tools. You'll learn to run agent-generated code safely in sandboxed cloud environments that protect your systems from harmful operations. Skills you'll gain: - Build agents that write and execute code, manage files, and handle errors autonomously through feedback loops - Run agent code safely in E2B cloud sandboxes and understand tradeoffs between local, containerized, and cloud execution - Create a data analyst agent that explores visualizes data with Pandas - Create a full-stack agent that builds complete Next.js web applications Join and build agents that code their way through complex tasks:

Andrew Ng

204,109 views • 9 months ago

Just added visual editing for any coding agent. Works with your: ✅ Claude Code CLI ✅ Codex CLI ✅ GitHub Copilot ✅ Cursor CLI Make visual tweaks -> view diffs -> commit, all in the browser! Works with your app framework of choice: ✅ Next.js ✅ React (Vite) ✅ Svelte ✅ Angular ✅ Other frameworks (.NET, Ruby, etc.) So if you liked Cursor's visual editor, check us out! It's live today as a VS Code extension called 'Wuunu'.

Just added visual editing for any coding agent. Works with your: ✅ Claude Code CLI ✅ Codex CLI ✅ GitHub Copilot ✅ Cursor CLI Make visual tweaks -> view diffs -> commit, all in the browser! Works with your app framework of choice: ✅ Next.js ✅ React (Vite) ✅ Svelte ✅ Angular ✅ Other frameworks (.NET, Ruby, etc.) So if you liked Cursor's visual editor, check us out! It's live today as a VS Code extension called 'Wuunu'.

Wesley

57,809 views • 8 months ago

We skipped our own wedding and flew to SF. LLMs are the last piece of software that application developers still can’t easily build themselves. We’re letting every developer build their own LLMs in TypeScript, not Python. It’s Next.js + Vercel, but for building LLMs. In the last 7 days, users made 80k+ calls to models they fine-tuned. 3 devtool companies are running Arkor in their production pipelines to serve task-specific models with lower latency. Even users with PhDs in ML love the convenience of handling the entire training + deployment flow in Node.js. Meet Arkor. The best TypeScript framework for fine-tuning & deploying open models.

We skipped our own wedding and flew to SF. LLMs are the last piece of software that application developers still can’t easily build themselves. We’re letting every developer build their own LLMs in TypeScript, not Python. It’s Next.js + Vercel, but for building LLMs. In the last 7 days, users made 80k+ calls to models they fine-tuned. 3 devtool companies are running Arkor in their production pipelines to serve task-specific models with lower latency. Even users with PhDs in ML love the convenience of handling the entire training + deployment flow in Node.js. Meet Arkor. The best TypeScript framework for fine-tuning & deploying open models.

Hina

53,248 views • 1 month ago

7AM update: Our crews are continuously salting and plowing around the city. Please stay off the roads if you can. If you must drive, do so carefully and give the plows plenty of space. A message from a District Snow Team member:

7AM update: Our crews are continuously salting and plowing around the city. Please stay off the roads if you can. If you must drive, do so carefully and give the plows plenty of space. A message from a District Snow Team member:

DC Department of Public Works

20,364 views • 7 months ago

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

NebuSec

105,966 views • 2 months ago

I host a ton of events. This video was so fun to make, capturing how my team and I leverage AI when curating an incredibly high volume of intimate, tasteful, and high-quality events using some of our favorite tools like OpenAI Developers Codex, Eve by Vercel and more. But we are also excited to learn. Let me know if you have any suggestions or favorite tools and workflows :) And if you're heading to ICML, definitely say hi to the Cerebras team.

I host a ton of events. This video was so fun to make, capturing how my team and I leverage AI when curating an incredibly high volume of intimate, tasteful, and high-quality events using some of our favorite tools like OpenAI Developers Codex, Eve by Vercel and more. But we are also excited to learn. Let me know if you have any suggestions or favorite tools and workflows :) And if you're heading to ICML, definitely say hi to the Cerebras team.

Sarah Chieng

135,745 views • 2 months ago