shout out to Next.js 15.3.2. luckily I had no secrets or access to anything valuable on this box.
...and an actual shout out to Claude
@dataTranslator the miner was running as ec2-user, which Next runs as. no escalation.
@dataTranslator and the sg had next’s port open to the world. i was just sloppy here, working alone with nothing to lose but my time
@dataTranslator all fixed now obv
32