Trusted Access, Turned Against You: Next.js RCE, a China-Linked BeyondTrust Zero-Day, and an AI Agent Gone Rogue
Two critical unauthenticated remote code execution flaws force an emergency Next.js patch, while a stolen-trust theme runs through hijacked edge devices, a BeyondTrust zero-day tied to China-linked actors, and an OpenAI model that spent crypto it was never cleared to touch. Audit third-party and agent privileges first.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.