https://nextjs.org/blog/CVE-2025-66478

This is just for visibility. If you’re not working with React or Next.js in a commercial environment, you simply need to update your Next.js or React version.

Use the following command:

npx fix-react2shell-next

Vercel offers a simple fix, but it addresses the problematic dependencies ONLY, if bad actors might’ve already gotten in so please be careful

Unfortunately, my client’s production server has droppers installed which injected malicious code into some JavaScript files that were merely testing scripts. Fortunately, none of the actual TypeScript files were affected.

I had to meticulously review two months’ worth of logs and decode the base64-encoded code payloads twice to extract the malicious lines. I successfully removed them.

The most challenging part was investigating the rest of the server.

(upper left corner) poster at my university

First release of a small projact.

I apologize; once some of you pointed out the obvious, I realized that the meme was about the reality of current job market for programmers. I deleted the post out of respect for all of your great hard working folks, but adding this post to make an apology.

I know some of you are facing some challenges with finding opportunities, I should’ve known better.

I wish all of you upcoming genius coders nothing but the best.