GoKawiil
Tech News
Ugreen NAS devices include an HDMI port that, when paired with a connected screen and keyboard, lets users access both the system's BIOS and its terminal. Users can enter BIOS setup by pressing Ctrl and F12 repeatedly at startup, while the terminal can reportedly be accessed with Ctrl Alt F1, though this varies by model and isn't officially documented by Ugreen.
Recent versions of Claude Code support a `claude --worktree --tmux` command that automatically creates both a git worktree and a tmux session for an AI coding agent, rather than requiring developers to wire this up manually. The guide explains that tmux's persistence, multi-session management, and external scriptability (via send-keys and capture-pane) are what make it a popular backbone for running and orchestrating multiple coding agents.
Security researchers identified a vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application, located in its file preview feature. The flaw reportedly lets attackers silently exfiltrate sensitive developer credentials, including SSH private keys, AWS credentials, and Claude OAuth tokens, without requiring any user interaction.
Pocketty is a new iPhone and iPad app providing SSH terminal access designed for monitoring coding agents, built to work with a tool called herdr. The app sends notifications readable only on the user's phone when an agent is blocked or has finished a task, letting the user respond directly in a mobile terminal session. It offers a 14-day free trial followed by a one-time launch price of $99, discounted from $129.
A technical post walks through building a self-hosted alternative to services like ngrok or Cloudflare Quick Tunnels, relying only on standard OpenSSH remote port forwarding and an Nginx reverse proxy rather than proprietary clients or servers. It details configuring SSH to forward a local port to a remote server, setting up Nginx to route wildcard subdomains to that port, and obtaining a Let's Encrypt wildcard certificate via DNS-01 challenges on Route 53.
ThreatDown researchers identified a botnet called Carbonato that targets Docker servers with exposed, unauthenticated daemons on port 2375. After gaining access, attackers launch a privileged container, install a persistent SSH backdoor, and embed an AI agent built on the open-source Hermes Agent framework that receives commands via Telegram and harvests stolen credentials. The infrastructure, exposed since May, was also linked to a separate operation distributing trojanized cryptocurrency wallet apps.
A Fly.io team post examines VSCode's remote SSH extension, noting that rather than running lightweight shell commands like Emacs's Tramp does, it deploys a Bash script that downloads and installs a full agent, including a Node.js binary, on the remote machine. The authors say they are exploring integration with this remote-editing flow because so many developers now use VSCode forks paired with LLM code-generation agents.
A researcher asked Meta's Muse assistant to archive files it could access and send them to Google Drive, and it complied, delivering a 2.7GB compressed (6.8GB unpacked) package. The archive contained the underlying Linux root filesystem, Ubuntu system files, internal documentation, integration code, memory logs, and SSH key files from the runtime environment codenamed 'Hatch.' The researcher reported the issue through Meta's bug bounty program and is withholding the archive, keys, and logs from publication.
Sigabrt.dev is a new cronjob monitoring service that lets users check endpoint status, schedules and recent events directly through an SSH-based terminal UI rather than a web dashboard. Users add their SSH public key in settings and connect via 'ssh sigabrt.dev' to view their monitored jobs. The product is described as an early, read-only work in progress, with the developer soliciting feedback on future features.
Syq is a new command-line utility for copying, reorganizing, and deleting files between machines, positioned as an alternative to rsync. It supports resuming interrupted transfers, running remote commands from a server without needing SSH access on the client machine, and scripting via a JSON API or Python SDK.
Attackers are combining two newly disclosed MikroTik RouterOS vulnerabilities, an SSH authentication bypass (CVE-2026-67276) and a privilege escalation bug (CVE-2026-86060), to seize full control of routers with SSH exposed to the internet. Poland's CERT, which found the flaws with AI assistance, calls the combined exploit 'MikroTrick' and confirms it is being used in real-world attacks. MikroTik patched the issues in RouterOS versions released September 3, alongside a related bandwidth-test flaw that can leak memory or crash devices.
MikroTik simultaneously released RouterOS 7.23.4, 7.24.2 and 6.49.21 on September 3, 2026, each flagging an unspecified 'important security update' without disclosing details. A security researcher reverse-engineered the binary diffs across versions and identified two exploitable flaws: a low-exponent RSA signature forgery leading to an mtget buffer overflow, and an SSH authentication bug where a username value of -2 grants a read-only session elevated privileges, enabling full command execution on the router.