I GOT HACKED, MY SERVER STARTED MINING MONERO THIS MORNING

Summary from the TLDR InfoSec newsletter

A developer's Umami analytics container was exploited via CVE-2025-66478, a Next.js React Server Components deserialization flaw, resulting in Monero cryptominers running undetected for 10 days. Container isolation prevented the compromise from spreading because the container ran as non-root with no volume mounts or privileged access. The incident highlights the importance of knowing your dependencies' underlying frameworks and properly configuring container security boundaries.