Hackers have been exploiting a critical command injection vulnerability in Nextcloud's built-in Collabora Online CODE server app since at least September 10, weeks before the issue received a formal advisory and CVE number. The flaw lets unauthenticated attackers send a crafted request to the app's proxy.php endpoint and run system commands when the bundled CODE server is down, such as after a restart or crash, allowing them to plant PHP webshells and hunt for passwords and crypto wallets.
bleepingcomputer.com
· 2026-10-15
A hobbyist repurposed an aging Zotac MAGNUS EN1070K mini-PC, originally a media-center rig, into a home NAS to escape cloud storage nagging from Google and other providers. The build uses a 3D-printed enclosure extension, a six-bay ICY Dock drive cage, a Pico PSU powered off the machine's original brick, and an ASM1166 SATA adapter in the M.2 slot to support six drives alongside a 1 TB boot SSD.
asmat.ca
· 2026-09-20
DeepSeek V4.1 Flash achieved code execution on all 11 vulnerable systems in an AI hacking benchmark while leaving four patched systems untouched, at a total cost of just $4.65 for accepted runs. A manual review found the model discovered five novel attack paths beyond the six expected solutions, including a faster exploit against Grafana that bypassed the intended vulnerability entirely.
enclave.ai
· 2026-09-16
GoKawiil