A critical Next.js flaw could allow remote code execution via the Node.js ImageResponse implementation in next/og.

A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the hacking tools, the activity logs, and target lists naming ...