Home Today’s Briefing Deep Dives In Play Trending For You Discover My Stack Saved Off Radar Search

Loading today’s stories

Today

AI-assisted reporting, grounded in a per-article claim ledger. Perspective Coverage and Reality Strip separate source viewpoints from evidence, adoption, hype, incentives, and confidence.

Today

Front Page
Today’s Briefing
Newsletters
Trending
For You
Discover
My Stack
Saved
Off Radar
Search

Sections

Security
Build
Invest
Product
Leadership
Science

Company

About
Mission
How this is made
Evidence Index
The desks
The sources we read
Corrections
Press and brand
The daily edition

Trending now

Software Supply Chain Security
AI Infrastructure Capex
AI Accelerator Competition
Security Vendor Earnings
AI Incident Disclosure
Enterprise AI Governance
AI Infrastructure Consolidation
Inference serving infrastructure
AI Agent Security
Enterprise AI Procurement

How this is made

Today For You My Stack Off Radar Search

person

B0RI

Researcher credited by Vercel with responsible disclosure of the Windows path traversal.

Current clusters

security1 distinct publisher

CVE-2026-75604 hands unauthenticated RCE to anyone reaching a Windows-hosted Next.js app

The affected releases stretch back to Next.js 13.4, and for Windows self-hosters the only remedy Vercel offers is the version bump. The AVIF bug shipped in the same release at least has a config gate.

Publishers:thehackernews.com

Reality

Evidence74
Adoption40
Hype gap+12
Incentives58

Confidence63

B0RI — person — Clarity Today