From Next.js RCE to a Fake [ksmd] Kernel Thread: Hunting a Linux Backdoor That Lives in Memory
A Next.js app RCE leaked command output through error digests, dropped Linux backdoors and hid them behind a fake [ksmd] kernel thread. How to find and stop every piece.
Read Article