command "SEND_MESSAGE_TO_WEB"
id "pentest-probe-1790751196567"
userId "000000000000000001"
username "PENTEST_PROBE"
avatar "https://xxxxxx.xxxxxxxxxxxxxxx.com/logoxxxx.png"
content "[PoC] Unauthenticated message injection â\u0080\u0094 no session required"
color "#FFFFFF"
timestamp "2026-xx-xxXXX:XX:XX.XXXX"
Shows up as a previous message in the websocket, I’ve xxx’d info. Spoopy. A bunch of shit got broken and had to reinstall.
Maybe some automated knockin’ lookin’ for some exposed cheeks.
We think so too but this shit still gives me a fright lol. Nothing very important though it’s just a private streaming server for movie nights with friends, the “send message to web” is probably exploiting the webchat in some way.
I’d double check everything if this happened right before the break. If that was the case I bet it was just some new age script kiddie pushing shit over with an AI. Unless you’re like rebuilding the USSR but digital or something in there.
Nah didn’t happen during any use literally several days between any other usage. I suspect it’s some automated ai agent doing a driveby but also if I were a fed I’d disguise myself as ai activity too now.
I second the automation scanner or something. Was the injection message logged? Might have a zero day to play with.
Nah we got nothing else. Pretty much the only effect was that it made the webpage fall over in such a way we had to reinstall our software and get everyone resetting their cookies.
If you’re worried about feds, I’d do a full reinstall.
If the exploit worked properly the workflow for these sorts of exploits is buffer overflow -> remote code execution -> downloads and runs a rootkit that can survive a reboot.
Like, bare minimum would be an os reinstall. If you really wanna be sure look into cleaning up uefi malware installs.
For future use, if your friend group is small enough, I’d recommend setting up a tailscale or wire guard network for your friends to avoid exposing any ports to the open internet.
Y’all are gonna hate this suggestion but you should get an AI agent to review your code and config and another agent to try a pen test you control. The agents gave gotten crazy good at hacking recently.
Plex or jellyfin or what? Plex had a vulnerability recently, bit without knowing the application its hard to help
First time? Bots from China, Russia, and all other countries that aren’t within the USes jusristicion are constantly trying to hit my machines. That’s why I try keeping everything behind a VPN.
Bots from [IPs that resolve to] China, Russia
Really no telling where they’re actually from
