正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

Our team discovered a critical remote code execution vulnerability in Next.js. If you self-host Next.js, update immediately. Vercel managed Next.js hosts are safe! We’ll publish the technical details and proof of concept soon!

Hacktron AI

4,676 subscribers

103,441 次观看 • 8 天前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

Quick demo of Stripe Managed Payments (MoR) Here's my tiny Next.js app, a few prompts in Cursor, and the Stripe docs handle the rest One line of code and it just works

Quick demo of Stripe Managed Payments (MoR) Here's my tiny Next.js app, a few prompts in Cursor, and the Stripe docs handle the rest One line of code and it just works

JR Farr

29,365 次观看 • 9 个月前

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible

Rob Pruzan

184,796 次观看 • 1 年前

Midday's new website is out, and I'm so proud of Viktor. Viktor used to design in Figma, then hand it over to me. Now he uses Cursor and built the whole new site in Next.js, pushing it to Vercel. For a two-person team, this is the future.

Midday's new website is out, and I'm so proud of Viktor. Viktor used to design in Figma, then hand it over to me. Now he uses Cursor and built the whole new site in Next.js, pushing it to Vercel. For a two-person team, this is the future.

Pontus Abrahamsson — oss/acc

42,180 次观看 • 7 个月前

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

In our latest analysis, we dive into CVE-2026-4802, a high-severity vulnerability discovered by our team in Cockpit that allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). Read the full analysis on our blog:

Hakai Offsec

11,409 次观看 • 3 个月前

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

International Cyber Digest

952,769 次观看 • 3 个月前

We’re applying to the Pump.fun Build in Public Hackathon. We're building Clovr. An AI tool that turns ideas into real Next.js frontends. No more boilerplate. No more blank files. Just clean, ready-to-use, beautiful code you can export or open straight in a GitHub repo. We’re building the future of how frontends are built.

We’re applying to the Pump.fun Build in Public Hackathon. We're building Clovr. An AI tool that turns ideas into real Next.js frontends. No more boilerplate. No more blank files. Just clean, ready-to-use, beautiful code you can export or open straight in a GitHub repo. We’re building the future of how frontends are built.

Alby Churven

24,523 次观看 • 6 个月前

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

The CertiK Skyfall team identified and collaborated with Apple to fix a vulnerability (CVE-2024-27801) in the low-level implementation of NSXPC, affecting all Apple platforms. This vulnerability could have potentially allowed malicious apps to gain unauthorized access to system services or steal user data from certain third-party applications, particularly those with architectures similar to Telegram. Our proof-of-concept attack demonstrated how a malicious app could steal chat history (such as pictures) from Telegram and transfer it to a remote server. Upgrade all your Apple devices and stay safe! Source:

CertiK

341,505 次观看 • 2 年前

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.

Guillermo Rauch

15,875,350 次观看 • 6 个月前

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.

MCP now supports authentication using OAuth2. This is huge! I want to share a complete example (code) so you can learn how to use it. Here is the thing: You don't want to build agentic applications that access resources without proper guardrails. With authentication, you can: • Call third-party APIs on the user's behalf • Perform actions that should be traceable • Enforce different permissions for different roles Here is an MCP-based web shop demo, built with WorkOS AuthKit and Next.js. With this example, you can do the following: • Connect to an MCP server • Authenticate using AuthKit • Order a T-shirt using MCP tools • View order details if you are an admin This GitHub repository contains everything you need: The WorkOS team has one of the best authentication platforms in the world. If you haven't looked into AuthKit, take a look at the code of this demo. Thanks to the WorkOS team for sponsoring this post.

Santiago

33,004 次观看 • 9 个月前

Sarah (sarah) built a production-ready AI chatbot connected to 1,000+ apps in 10 minutes. Here's exactly what she did: •Started with Vercel's chat template •Deployed it instantly: repo + storage + production •Integrated Composio: 1,000+ apps •Connected Gmail and Slack - zero OAuth config •Demonstrated it live: bot sent Julia Fedorin a Slack message Stack: Vercel AI SDK + Next.js + Composio (1,000+ toolkits) Using Vercel AI's template + Composio lets you enable cross-app actions without spending weeks on authentication flows. If you're building AI agents, this is how you skip the boilerplate. What's your stack for shipping agents fast?

Sarah (sarah) built a production-ready AI chatbot connected to 1,000+ apps in 10 minutes. Here's exactly what she did: •Started with Vercel's chat template •Deployed it instantly: repo + storage + production •Integrated Composio: 1,000+ apps •Connected Gmail and Slack - zero OAuth config •Demonstrated it live: bot sent Julia Fedorin a Slack message Stack: Vercel AI SDK + Next.js + Composio (1,000+ toolkits) Using Vercel AI's template + Composio lets you enable cross-app actions without spending weeks on authentication flows. If you're building AI agents, this is how you skip the boilerplate. What's your stack for shipping agents fast?

Composio

27,724 次观看 • 5 个月前

New course: Building Coding Agents with Tool Execution, taught by Tereza Tizkova and Fra from E2B. Most AI agents are limited to predefined function calls. This short course teaches you to build agents that write and execute code to accomplish tasks, accessing entire programming language ecosystems instead of being restricted to a fixed set of tools. You'll learn to run agent-generated code safely in sandboxed cloud environments that protect your systems from harmful operations. Skills you'll gain: - Build agents that write and execute code, manage files, and handle errors autonomously through feedback loops - Run agent code safely in E2B cloud sandboxes and understand tradeoffs between local, containerized, and cloud execution - Create a data analyst agent that explores visualizes data with Pandas - Create a full-stack agent that builds complete Next.js web applications Join and build agents that code their way through complex tasks:

New course: Building Coding Agents with Tool Execution, taught by Tereza Tizkova and Fra from E2B. Most AI agents are limited to predefined function calls. This short course teaches you to build agents that write and execute code to accomplish tasks, accessing entire programming language ecosystems instead of being restricted to a fixed set of tools. You'll learn to run agent-generated code safely in sandboxed cloud environments that protect your systems from harmful operations. Skills you'll gain: - Build agents that write and execute code, manage files, and handle errors autonomously through feedback loops - Run agent code safely in E2B cloud sandboxes and understand tradeoffs between local, containerized, and cloud execution - Create a data analyst agent that explores visualizes data with Pandas - Create a full-stack agent that builds complete Next.js web applications Join and build agents that code their way through complex tasks:

Andrew Ng

204,109 次观看 • 9 个月前

Just added visual editing for any coding agent. Works with your: ✅ Claude Code CLI ✅ Codex CLI ✅ GitHub Copilot ✅ Cursor CLI Make visual tweaks -> view diffs -> commit, all in the browser! Works with your app framework of choice: ✅ Next.js ✅ React (Vite) ✅ Svelte ✅ Angular ✅ Other frameworks (.NET, Ruby, etc.) So if you liked Cursor's visual editor, check us out! It's live today as a VS Code extension called 'Wuunu'.

Just added visual editing for any coding agent. Works with your: ✅ Claude Code CLI ✅ Codex CLI ✅ GitHub Copilot ✅ Cursor CLI Make visual tweaks -> view diffs -> commit, all in the browser! Works with your app framework of choice: ✅ Next.js ✅ React (Vite) ✅ Svelte ✅ Angular ✅ Other frameworks (.NET, Ruby, etc.) So if you liked Cursor's visual editor, check us out! It's live today as a VS Code extension called 'Wuunu'.

Wesley

57,809 次观看 • 8 个月前

We skipped our own wedding and flew to SF. LLMs are the last piece of software that application developers still can’t easily build themselves. We’re letting every developer build their own LLMs in TypeScript, not Python. It’s Next.js + Vercel, but for building LLMs. In the last 7 days, users made 80k+ calls to models they fine-tuned. 3 devtool companies are running Arkor in their production pipelines to serve task-specific models with lower latency. Even users with PhDs in ML love the convenience of handling the entire training + deployment flow in Node.js. Meet Arkor. The best TypeScript framework for fine-tuning & deploying open models.

We skipped our own wedding and flew to SF. LLMs are the last piece of software that application developers still can’t easily build themselves. We’re letting every developer build their own LLMs in TypeScript, not Python. It’s Next.js + Vercel, but for building LLMs. In the last 7 days, users made 80k+ calls to models they fine-tuned. 3 devtool companies are running Arkor in their production pipelines to serve task-specific models with lower latency. Even users with PhDs in ML love the convenience of handling the entire training + deployment flow in Node.js. Meet Arkor. The best TypeScript framework for fine-tuning & deploying open models.

Hina

53,248 次观看 • 1 个月前

7AM update: Our crews are continuously salting and plowing around the city. Please stay off the roads if you can. If you must drive, do so carefully and give the plows plenty of space. A message from a District Snow Team member:

7AM update: Our crews are continuously salting and plowing around the city. Please stay off the roads if you can. If you must drive, do so carefully and give the plows plenty of space. A message from a District Snow Team member:

DC Department of Public Works

20,364 次观看 • 7 个月前

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

Here goes nginx-quicburst (CVE-2026-42530), a new RCE in Nginx discovered by our security agent VEGA and demonstrated by Nebula Security. This is only the third NGINX vulnerability since 2014 to receive NGINX’s “major” severity rating. If you use Nginx 1.31 with QUIC enabled, we recommend upgrading to the latest version. This bug has been patched in the latest Nginx release. We will publish the technical writeup, including the ASLR bypass, on July 18 together with the previous nginx-poolslip writeup.

NebuSec

105,966 次观看 • 2 个月前

I host a ton of events. This video was so fun to make, capturing how my team and I leverage AI when curating an incredibly high volume of intimate, tasteful, and high-quality events using some of our favorite tools like OpenAI Developers Codex, Eve by Vercel and more. But we are also excited to learn. Let me know if you have any suggestions or favorite tools and workflows :) And if you're heading to ICML, definitely say hi to the Cerebras team.

I host a ton of events. This video was so fun to make, capturing how my team and I leverage AI when curating an incredibly high volume of intimate, tasteful, and high-quality events using some of our favorite tools like OpenAI Developers Codex, Eve by Vercel and more. But we are also excited to learn. Let me know if you have any suggestions or favorite tools and workflows :) And if you're heading to ICML, definitely say hi to the Cerebras team.

Sarah Chieng

135,745 次观看 • 2 个月前