Tootfinder

Target's dev server offline after hackers claim to steal source code
https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-after-hackers-claim-to-steal-source-code/

Target's dev server offline after hackers claim to steal source code
Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. After BleepingComputer notified Target, the files were taken offline and the retailer's developer Git server was inaccessible.

https://github.com/coder/code-server

#tinygo is awesome! I can re-use parts of my server code now in a tiny stm32 LoRa controller. Impressive.

Probably that everyone has its own setup but when I read this I’m like, really?, all of this just to operate claude ? is there such thing as “claude burnout” ?
if not it should be patented because all these plugins are making it harder to use, maintain, memorise, its like a server overload
https://rmendes.net/bookmark…

I made a script for this, but then I thought a webui would be better so I could use it in my phone and stuff
I asked an LLM to generate a python webui to run server-side the script I wrote, and surprisingly it 100% worked first try. I was sure it wouldn’t work at all, but I didn’t touch that code and it works.
I can’t even say I “vibe coded” this bc I didn’t even read the code enough to know its vibes lmao. I’m surprised this even works, and it does work well. What the actual fuck.
Welp, not my favourite way to do things but I wasn’t in the mood to do python and figure out the extra libraries and stuff.
And it works so I’ll just use that. In a hardened systemd service to make sure it doesn’t like accidentally delete my whole system or something.

“A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.“
#vulnerability

React discloses an unauthenticated remote code execution flaw in React Server Components; Wiz says 39% of cloud environments contain vulnerable instances (The Hacker News)
https://thehackernews.com/2025/12/critical-rsc-bugs-in-react-and-nextjs.html

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution
Critical RSC flaws in React and Next.js enable unauthenticated remote code execution; users should update to patched versions now.

The thing about a life-logger, is you input sensitive data about your life, lifestyle and activities, so privacy and data-integrity are some of the most important issues.
There can be no server, the data has to be yours and yours alone. Because you can’t tell what is happening to the data in a closed-source app, it must be completely free and open source.
You can’t trust a corporate diary, they must sell to anyone offering enough money.
So it is with my life log app, all data completely in your own device. No home server ever sees anything.
There is no home server. Just the code.
To achieve this Exocortex Log is a Progressive Web App. It downloads when you are online at the website and can be installed onto the homepage of your phone.
It keeps all data on the local device using indexdb.
This means you must be responsible for your own backups. Be sure to export and back up your data regularly. I have gaps in my ten year record where my phone was stolen and most recent backup was months prior.
Once installed it will work offline, airplane mode, no internet, down in the tube station at midnight, anywhere.
There's a blog on the website saying this and more: https://exocortexlog.com/news/articles/2025-12-06-release/

this prompted me to see what https://anagramgenius.com might do, but sadly its anagram server is broken
iirc anagram genius originally came out in about 1990 … i never got a copy because it was a bit expensive for a toy and i wouldn’t have been able to learn from its unobtanium source code
anyway TIL the…

I've recently stumbled upon an RCE "exploit" for the Serendipity blog software, which I happen to use and have contributed to in the past. From what I can tell, it does nothing interesting (it does not even work due to broken indents, if one fixes that it uploads a PHP shell given existing credentials, but that won't be executed unless you have a server config that executes .inc files). I'm 95% certain this is bogus. Yet... in case anyone wants to have a look:

Exploit (probably bogus) on exploit-db · Issue #940 · s9y/Serendipity
I stumbled upon this: https://www.exploit-db.com/exploits/52036 This claims to be a remote code execution exploit for serendipity. I believe it is bogus. I'm sharing what I figured out here, mostly...

With ty, Astral has released a fast Python type checker and language server (LSP): https://astral.sh/blog/ty
It can also be easily integrated into Visual Studio Code and other editors:

ty: An extremely fast Python type checker and language server
ty is an extremely fast Python type checker and language server, written in Rust, and designed as an alternative to mypy, Pyright, and Pylance.

💻 #code-server runs #VSCode in your browser on any machine anywhere #IDE #opensource

Ran the #Wrapstodon thing on this server.
"Oracle" for me again. 😒
Other than My most boosted post and a count of 1443 posts and 250 followers I don't think it means much on a tiny server. Everyone here is in the top 75% of users because there are two users. 😆
The categories are:

Oracle: “You created new posts more than replies, keeping Mastodon fresh and future‑facing.”

​

Social butterfly (replier): You replied far more than posting originals.

​

Cool‑hunter (booster): You mainly amplify others via boosts.

​

Pollster: You created lots of polls compared to everything else.

​

Lurker: You post and interact relatively little overall.
​```

🚀 The #Postman #MCP Server is pure magic — connect your AI agents directly to your #API workflows. 100 tools for testing, code generation & collection management. Works with

MCP all the things.
https://www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/

Anthropic quietly fixed flaws in its Git MCP server that allowed for remote code execution
: Prompt injection for the win