[{"id":"mo8pxoetd26k4wiabzt","type":"editor","content":"

I got hacked for the first time recently — and honestly, it was a wake-up call.

It started not long after I migrated one of my projects from Angular to React/Next.js. At the time, everything seemed fine. The app was running, deployments were smooth, and I didn’t think much about the underlying changes. But what I didn’t realize was that the version I was using had a pretty serious vulnerability.

Turns out, there’s been a critical Remote Code Execution (RCE) issue in certain React/Next.js setups, caused by insecure handling of server-side component data. In simple terms, an attacker can send a specially crafted request and end up executing code directly on your server — no authentication needed.

That’s exactly what happened.

I started noticing weird behavior on my VPS — unexpected processes, things running that definitely weren’t mine. At that point, there’s no “quick fix.” Once someone potentially has code execution on your machine, you have to assume everything is compromised.

So I did the only sane thing: wiped the entire server.

This wasn’t a small job either. I had multiple services, sites, background workers — all running on that box. Rebuilding everything from scratch took hours. Then came rotating secrets: API keys, database credentials, SSH keys, tokens... basically anything that ever touched that server had to go.

The frustrating part is how silent it all was. No obvious “you’ve been hacked” moment — just subtle signs until it clicks.

Looking back, I should’ve been more proactive with dependency updates and security advisories, especially after switching stacks. Vulnerabilities like this aren’t rare, and in this case, they were exploitable in default configurations, which makes it even worse.

Lesson learned the hard way:

Always stay on top of security updates
Treat your server as compromised if there’s any doubt
And never underestimate how much damage one vulnerable dependency can do

It sucked — but I’m definitely running a tighter ship now.

"}]

// For the first time ever, I was HACKED?!