Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

We recently found a new RCE chain affecting the Node.js ImageResponse implementation in Next.js. Vercel has published CVE-2026-94545. Next.js versions from 16.2.0 through 16.3.5 are affected. Upgrade to Next.js 16.3.6. I'll share more details soon, once the remaining upstream advisories are out! Credit also to RagRocks, who discovered this...

rafabd1_'s profile picture

sy.br1d

1,927 subscribers

17,651 görüntüleme • 27 gün önce •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

9 Yorum

rixardo profil fotoğrafı
rixardo27 gün önce

presente professor

992 profil fotoğrafı
99227 gün önce

Is there no public PoC available for this yet?

sy.br1d profil fotoğrafı
sy.br1d27 gün önce

Not yet, probably next week

Tomi profil fotoğrafı
Tomi26 gün önce

Hi, great finding! Btw, is there a way to keep the app running even after RCE is achieved?

sy.br1d profil fotoğrafı
sy.br1d26 gün önce

If the app is using multiple workers/replicas probably, here since I used just a simple process it ends up crashing inevitably

Tomi profil fotoğrafı
Tomi26 gün önce

I see, thanks for the insight

Alex Kolovsky profil fotoğrafı
Alex Kolovsky27 gün önce

Nice find, the Node-only part is the interesting bit. Different rasterizer on that path or same lib with a different sandbox?

sy.br1d profil fotoğrafı
sy.br1d27 gün önce

Different rasterizers. Edge uses Resvg/WASM, while the Node path uses a different lib

DEGEN 👑 profil fotoğrafı
DEGEN 👑26 gün önce

What makes this wild is how the unescaped user input inside Satori's SVG parser gets passed straight down to underlying native bindings like resvg-js to pull off the full RCE.

Benzer Videolar

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible
1:34

Hi Next.js, I’m Rob. I’m a student at the University at Buffalo. I built: - Re-implementation of React from scratch (reconciler, dom renderer, and core hooks) that went #6 on Hacker News - Next.js collaborative algorithm playground w/ live code execution, inspection, and visualizations - Next.js memory diagram quiz app used by 5 courses and >1000 students at my university - (And many other projects here This is a bit of a reach – I’d love to go to Next Conf but tickets are sold out :( It would be so awesome to meet others who care deeply about the tech, let me know if anything is possible

Rob Pruzan

185,173 görüntüleme • 2 yıl önce

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:
1:21

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here:

Nextron Research ⚡️

21,588 görüntüleme • 20 gün önce

Today we're excited to launch `create-llama` - a single CLI command that allows you to scaffold a full stack LLM app over your data, powered by LlamaIndex 🦙 🔥 It’s the equivalent of `create-react-app` for AI engineers. Choose from 3 different backends: ✅ FastAPI (w/ LlamaIndex 🦙 Python) ✅ ExpressJS (w/ LlamaIndex 🦙 TS) ✅ Next.js (w/ LlamaIndex 🦙 TS) The frontend is a Next.js template using initial chat components from the Vercel AI SDK - with full streaming support, + shadcn UI or vanilla HTML/CSS for styling. This is a full-stack starting point, from which you can customize any component to build the LLM app of your liking, whether it’s simple extensions (change data source) or complete revamps (upgraded chat UX)! Next steps 🔮: - We’re going to be coming out with more examples in the next few weeks showing what you can build. - We’re going to be upgrading `create-llama` with a variety of different templates Check out the video (also attached) to see how it works 🎥: Repo directory: Full blog post detailing the usage here:
3:22

Today we're excited to launch `create-llama` - a single CLI command that allows you to scaffold a full stack LLM app over your data, powered by LlamaIndex 🦙 🔥 It’s the equivalent of `create-react-app` for AI engineers. Choose from 3 different backends: ✅ FastAPI (w/ LlamaIndex 🦙 Python) ✅ ExpressJS (w/ LlamaIndex 🦙 TS) ✅ Next.js (w/ LlamaIndex 🦙 TS) The frontend is a Next.js template using initial chat components from the Vercel AI SDK - with full streaming support, + shadcn UI or vanilla HTML/CSS for styling. This is a full-stack starting point, from which you can customize any component to build the LLM app of your liking, whether it’s simple extensions (change data source) or complete revamps (upgraded chat UX)! Next steps 🔮: - We’re going to be coming out with more examples in the next few weeks showing what you can build. - We’re going to be upgrading `create-llama` with a variety of different templates Check out the video (also attached) to see how it works 🎥: Repo directory: Full blog post detailing the usage here:

Jerry Liu

259,064 görüntüleme • 2 yıl önce

Big Oil has a new playbook. Instead of getting their Internet goons to deny climate change, they've figured out how to manipulate the public in a whole new way. Are we going to let them get away with it? Share this video and go to to learn more.
1:00

Big Oil has a new playbook. Instead of getting their Internet goons to deny climate change, they've figured out how to manipulate the public in a whole new way. Are we going to let them get away with it? Share this video and go to to learn more.

Mark Ruffalo

711,963 görüntüleme • 2 yıl önce

Favorite Crystals we Sold in 2025💎✨ A look back at some unforgettable crystals from our collection that found new homes this year. Each one had something special and unique to offer. We’re so grateful for everyone who has supported us this past year through our journey and we can’t wait to share even more stunning rocks with you all in 2026!💎🎆✨
0:58

Favorite Crystals we Sold in 2025💎✨ A look back at some unforgettable crystals from our collection that found new homes this year. Each one had something special and unique to offer. We’re so grateful for everyone who has supported us this past year through our journey and we can’t wait to share even more stunning rocks with you all in 2026!💎🎆✨

Rocks for the Spirit

24,277 görüntüleme • 9 ay önce

The party is going to launch a national campaign across India. 👉 This will not be only at the national level, but also at the state, district, and block levels. Wherever people are facing difficulties, the Congress party will go there, share their sentiments, and fight for them. 👉 Not only through traditional forms of agitation, we will go to the people who are suffering, to those who are in pain. We will try to share their pain and carry their voice to the national level through maximum agitation. Every Congress leader and worker should be out on the streets. We will chalk out the details of the program in the next two to five days. : Congress General Secretary (Org.) Shri K C Venugopal
2:02

The party is going to launch a national campaign across India. 👉 This will not be only at the national level, but also at the state, district, and block levels. Wherever people are facing difficulties, the Congress party will go there, share their sentiments, and fight for them. 👉 Not only through traditional forms of agitation, we will go to the people who are suffering, to those who are in pain. We will try to share their pain and carry their voice to the national level through maximum agitation. Every Congress leader and worker should be out on the streets. We will chalk out the details of the program in the next two to five days. : Congress General Secretary (Org.) Shri K C Venugopal

Congress

70,927 görüntüleme • 4 ay önce

Mark is a good man who is concerned for the future generations in Liverpool. He reached out to me to have a coffee, and a genuine friendship has been built. We are now taking our families out together for a digital detox and a walk in the countryside this weekend. The people of Liverpool have discovered that someone is trying to set us against each other. It's not working. We're coming closer together ❤️
5:30

Mark is a good man who is concerned for the future generations in Liverpool. He reached out to me to have a coffee, and a genuine friendship has been built. We are now taking our families out together for a digital detox and a walk in the countryside this weekend. The people of Liverpool have discovered that someone is trying to set us against each other. It's not working. We're coming closer together ❤️

Adam Kelwick

44,242 görüntüleme • 2 yıl önce

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.
0:53

Vercel AI Gateway now supports video generation. Grok Imagine Video & Image are 🆓 until tomorrow. We used v0 to create an open source Creative Studio powered by xAI Grok. Create images, videos, or make your own design tool! – it's quite fast. Some cool technical tidbits: ▪️ Vercel Workflows for reliable generation Video generation can take long. Users might restart their browsers or their wifi / LTE might drop. We smooth over that automatically. ▪️ Instant vector search Try searching the public generations. Now back to me. We used Mixedbread to index the content visually, so you can search 𝚋𝚕𝚊𝚌𝚔 𝚏𝚎𝚕𝚒𝚗𝚎 and get a cat (try it!) ▪️ Vercel AI Gateway All existing and future Grok models are accessible via our gateway without extra setup. When you deploy to Vercel, you get access to hundreds of models with a single account and unified billing It's obviously built with Next.js (RSC). Open it in v0 to make it your own! h/t Esteban Suárez for shipping this.

Guillermo Rauch

15,876,082 görüntüleme • 7 ay önce

As I am holding on hope for the safe return of all hostages, I also want to share with all victims of terror some details of our shared pain. To everyone, who has been silent, you are complicit. To everyone who stood up for the safety of innocent hostages and freedom from terror, we will not break under pain, we will come together. It is strength, love and resilience that will get us through the toughest times. #StandWithUs #bringthemhomenow #BibasFamily
2:34

As I am holding on hope for the safe return of all hostages, I also want to share with all victims of terror some details of our shared pain. To everyone, who has been silent, you are complicit. To everyone who stood up for the safety of innocent hostages and freedom from terror, we will not break under pain, we will come together. It is strength, love and resilience that will get us through the toughest times. #StandWithUs #bringthemhomenow #BibasFamily

Gazelle غزاله شارمهد

12,422 görüntüleme • 1 yıl önce

📢 PCM Community Update! We’re making big moves with Pi KYB underway to boost trust & compliance in our ecosystem. Alongside this, we’re adding support for muxed account Pi deposits—no more address binding needed, just seamless Pi deposits! Once muxed accounts are supported, Pi withdrawal fees will drop to just 0.05 Pi! We’ve also been working hard on a new framework update for the PCM Wallet. This upgrade, powered by Flutter infrastructure enhancements, brings a smoother, more secure experience to your fingertips. Note: The email binding feature on PiChain Mall is currently under maintenance and will go live again after the new PCM Wallet framework update. More exciting features are in the pipeline: 🌐PCM Wallet with Multi-Chain & Multi-Token Support 🔐Passkey Login for Enhanced Security These are actively in progress—stay tuned for their rollout! We know some of you are facing delays with withdrawals. Rest assured, our in-house security checks for on-chain withdrawals are in place to keep everything safe & sound. Thanks for your patience! Check out this preview video of the PCM Wallet with the new framework in action. We’re building the future of PCM together!
1:25

📢 PCM Community Update! We’re making big moves with Pi KYB underway to boost trust & compliance in our ecosystem. Alongside this, we’re adding support for muxed account Pi deposits—no more address binding needed, just seamless Pi deposits! Once muxed accounts are supported, Pi withdrawal fees will drop to just 0.05 Pi! We’ve also been working hard on a new framework update for the PCM Wallet. This upgrade, powered by Flutter infrastructure enhancements, brings a smoother, more secure experience to your fingertips. Note: The email binding feature on PiChain Mall is currently under maintenance and will go live again after the new PCM Wallet framework update. More exciting features are in the pipeline: 🌐PCM Wallet with Multi-Chain & Multi-Token Support 🔐Passkey Login for Enhanced Security These are actively in progress—stay tuned for their rollout! We know some of you are facing delays with withdrawals. Rest assured, our in-house security checks for on-chain withdrawals are in place to keep everything safe & sound. Thanks for your patience! Check out this preview video of the PCM Wallet with the new framework in action. We’re building the future of PCM together!

PiChain Global

82,397 görüntüleme • 1 yıl önce

#WATCH | Ranchi, Jharkhand: Rishav Kumar Jha, SP ATS says, "We have extradited him from Baku, Azerbaijan. This is the first successful extradition in the history of Jharkhand police, and we hope that the remaining criminals who are based out of the country will also be extradited or deported very soon... Prima facie, he appears to be a point of contact between Aman Sahu and the Lawrence Bishnoi gang. We will interrogate him and get all the details as to what kind of relations the two gangs are having in the prison. He has 50 cases registered against him in Jharkhand, Rajasthan and other cases..."
1:14

#WATCH | Ranchi, Jharkhand: Rishav Kumar Jha, SP ATS says, "We have extradited him from Baku, Azerbaijan. This is the first successful extradition in the history of Jharkhand police, and we hope that the remaining criminals who are based out of the country will also be extradited or deported very soon... Prima facie, he appears to be a point of contact between Aman Sahu and the Lawrence Bishnoi gang. We will interrogate him and get all the details as to what kind of relations the two gangs are having in the prison. He has 50 cases registered against him in Jharkhand, Rajasthan and other cases..."

ANI

13,181 görüntüleme • 1 yıl önce

Proud Moment for SBI! We are delighted to share that SBI's All New YONO has been recognised as a Winner in the Transformation Category at the ISG Asia Paragon Awards 2026, Singapore. This recognition is a testament to our continued journey of innovation, transformation and excellence—powered by our commitment to transforming banking and setting new benchmarks. Here’s to many more moments of excellence as we continue to shape the future of banking together!
0:40

Proud Moment for SBI! We are delighted to share that SBI's All New YONO has been recognised as a Winner in the Transformation Category at the ISG Asia Paragon Awards 2026, Singapore. This recognition is a testament to our continued journey of innovation, transformation and excellence—powered by our commitment to transforming banking and setting new benchmarks. Here’s to many more moments of excellence as we continue to shape the future of banking together!

State Bank of India

541,951 görüntüleme • 1 ay önce

𝙂𝘼𝙇𝙇𝙀𝙍𝙔 𝙑𝙄𝙀𝙒𝙄𝙉𝙂 𝙂𝙐𝙄𝘿𝙀 The day has finally arrived. Before the doors open, here are a few important details to keep in mind for your visit to La Galería Yu. From venue details and dress code reminders to guest activities, freebies, and the livestream schedule, this guide highlights a few things to remember as we prepare to welcome you into the gallery today. Please take a moment to read through each slide carefully. Please take a moment to look through and read each slide carefully. We can’t wait to finally share this experience with you. 💙
0:39

𝙂𝘼𝙇𝙇𝙀𝙍𝙔 𝙑𝙄𝙀𝙒𝙄𝙉𝙂 𝙂𝙐𝙄𝘿𝙀 The day has finally arrived. Before the doors open, here are a few important details to keep in mind for your visit to La Galería Yu. From venue details and dress code reminders to guest activities, freebies, and the livestream schedule, this guide highlights a few things to remember as we prepare to welcome you into the gallery today. Please take a moment to read through each slide carefully. Please take a moment to look through and read each slide carefully. We can’t wait to finally share this experience with you. 💙

D’ YUniverse OFC

21,448 görüntüleme • 5 ay önce

I am involved in a Danish documentary project about the UFO phenomenon and the fascinating developments in recent years. ✨ Our primary focus so far has been UFOs in Greenland, where we have made some exciting discoveries. We captured this amazing footage about two weeks ago in Greenland. 😳💥 We are very eager to get closer to what has been happening in the US recently. We plan to travel to the East Coast as soon as possible to follow the situation, and we need help establishing contact with relevant sources in the area. We are very interested in speaking with witnesses to drone observations on the East Coast, as well as expert sources in the affected areas. 🇺🇸🛸 If you are interested in discussing this further, or if you know someone who might be an interesting contact, please feel free to send me a message here on X. 🙏 #UFOTwitter #UAPTwitter #uap #ufo #uapx #ufos #drones #dronesightings #dronesoverNJ #njdrones
0:33

I am involved in a Danish documentary project about the UFO phenomenon and the fascinating developments in recent years. ✨ Our primary focus so far has been UFOs in Greenland, where we have made some exciting discoveries. We captured this amazing footage about two weeks ago in Greenland. 😳💥 We are very eager to get closer to what has been happening in the US recently. We plan to travel to the East Coast as soon as possible to follow the situation, and we need help establishing contact with relevant sources in the area. We are very interested in speaking with witnesses to drone observations on the East Coast, as well as expert sources in the affected areas. 🇺🇸🛸 If you are interested in discussing this further, or if you know someone who might be an interesting contact, please feel free to send me a message here on X. 🙏 #UFOTwitter #UAPTwitter #uap #ufo #uapx #ufos #drones #dronesightings #dronesoverNJ #njdrones

UFORKLARLIGT | unexplainable

111,228 görüntüleme • 1 yıl önce

🚨 JUST IN: MI Senate candidate Mike Rogers is MIC DROPPING Abdul El Sayed "Yeah, you BET he wants to change the topic. We don't!" "A guy who is inflammatory, antisemitic, HATES Mackinac Island, HATES Ford trucks, wants to BAN gasoline engines. He wants to take the UAW's healthcare away from them!" "We're out there talking to these people. I would encourage him to continue talking. I'll see in October when people are paying attention. We're going to have a couple of debates, maybe three." "And so we're working through all of those details now. But I'll tell you what. We are swamped with people who are Democrats that are afraid of this guy and Republicans who are fired up about what he wants to do to our state and to our country!" 🔥
1:09

🚨 JUST IN: MI Senate candidate Mike Rogers is MIC DROPPING Abdul El Sayed "Yeah, you BET he wants to change the topic. We don't!" "A guy who is inflammatory, antisemitic, HATES Mackinac Island, HATES Ford trucks, wants to BAN gasoline engines. He wants to take the UAW's healthcare away from them!" "We're out there talking to these people. I would encourage him to continue talking. I'll see in October when people are paying attention. We're going to have a couple of debates, maybe three." "And so we're working through all of those details now. But I'll tell you what. We are swamped with people who are Democrats that are afraid of this guy and Republicans who are fired up about what he wants to do to our state and to our country!" 🔥

Eric Daugherty

92,637 görüntüleme • 1 ay önce

🚨 BREAKING: Treasury Sec. Scott Bessent just sanctioned and severed a TURKISH BANK for aiding the Iranian regime to the tune of tens of millions, FOLLOWING THROUGH on his threats from the G20 BESSENT IS AN ASSASSIN 🔥 Golden Global Yatirim Bankasi Anonim Sirketi is officially designated by OFAC. Boom. Another bank, and its subsidiaries, just FOUND OUT BESSENT: "We know who you are, we know where you are, and we will continue to take action together with our allies and partners until we have buried the head of the Iranian snake." He dropped this a few days ago: "We know who you are, YOU know who you are, and we are probably going to announce a bank sanction THIS WEEK, and we are announcing one the week AFTER."
1:17

🚨 BREAKING: Treasury Sec. Scott Bessent just sanctioned and severed a TURKISH BANK for aiding the Iranian regime to the tune of tens of millions, FOLLOWING THROUGH on his threats from the G20 BESSENT IS AN ASSASSIN 🔥 Golden Global Yatirim Bankasi Anonim Sirketi is officially designated by OFAC. Boom. Another bank, and its subsidiaries, just FOUND OUT BESSENT: "We know who you are, we know where you are, and we will continue to take action together with our allies and partners until we have buried the head of the Iranian snake." He dropped this a few days ago: "We know who you are, YOU know who you are, and we are probably going to announce a bank sanction THIS WEEK, and we are announcing one the week AFTER."

Eric Daugherty

307,935 görüntüleme • 1 ay önce