
A Critical Next.js Fix Is Still Coming. Your Website Won't Patch Itself.
Next.js shipped eight security fixes in eight days, and two more are coming. We moved all 130 Next.js sites we run the day after the latest release. Here's how to check yours.
What’s Next in
Web, Apps, & AI
News, guides, and sharp analysis on web development, apps, and the systems behind them, written by people who build them for a living.

Next.js shipped eight security fixes in eight days, and two more are coming. We moved all 130 Next.js sites we run the day after the latest release. Here's how to check yours.

Super Forms, Elementor Pro and All-in-One WP Migration each shipped a remote code execution fix this summer, and Wordfence reports two under active attack. What happened, with primary sources, and why every plugin is a dependency you don't control.