Most recent
navigate open esc close Corpus index built 2026-06-07 23:58 UTC

§ THE STACK / APPLICATION LAYER

Notebooks

Jupyter, ML research environments

The surfaces humans actually interact with: chat UIs, notebooks, generation studios.

What it is

Jupyter is where most of modern machine-learning research happens. A notebook is a live Python (or R, or Julia) shell with rich output (plots, tables, images) that runs inside a kernel an operator can leave running for days. JupyterLab is the polished IDE on top, JupyterHub the multi-user variant. Every ML grad student, every model fine-tuner, every quantitative analyst lives in this stack.

What goes wrong

A Jupyter server with no token (or a token shared in a public Slack, or a token from a screencast, or a token in a Docker Compose file pushed to GitHub) is a remote Python shell with the operator’s full filesystem, GPU, and cloud credentials available via the imported boto3/google-cloud SDKs. The exposure isn’t the notebook. It’s the kernel behind it. Anyone reaching the port can spawn a new kernel and run arbitrary code under the operator’s identity.

How we test

We probe for the token-prompt page, then the API at /api/sessions to enumerate live kernels (this works without auth in surprisingly many configs, and the response is a perfect operator-attribution payload: kernel paths contain user homedirs, repo names, and dataset filenames). We never spawn a new kernel on the target. The session list alone is sufficient to attribute, draft the disclosure, and demonstrate impact in evidence form.

Receipts

Research

Every survey, case study, and disclosure we've published that touches this layer of the stack. Counts on the cells above tally these directly.

Field cases

9
Case May 21, 2026

sakura.mit.edu — MIT Research Compute Node

34 exposed ports. Services running concurrently on this single host:

Read →
Case May 20, 2026

University AI Infrastructure Exposure: Global Overview

Full sweep of all 10,224 recognized universities worldwide (Hipo dataset, 202 countries). Two lanes ran:

Read →
Case May 19, 2026

University of South Florida: Marine Lab JupyterHubs (auth-enforced) + Adjacent Prometheus `/metrics` Public

USF College of Marine Science operates two JupyterHub instances on the marine.usf.edu subdomain: ocgmod1.marine.usf.edu (131.247.139.171:8000) and manglillo.marine.usf.edu (131.247.136.183:8000). Both…

Read →
Case May 19, 2026

University of Chicago: Two-Host Observation — Streamlit on `helabserver0` (auth-on framework) + JupyterHub on `jupyterhub-dev.grid` (502 Bad Gateway / degraded)

The University of Chicago surfaces two distinct hosts in this survey: helabserver0.uchicago.edu running a Streamlit application on port 8501, and jupyterhub-dev.grid.uchicago.edu running JupyterHub on…

Read →
Case May 19, 2026

University of Southern Maine: 8-Host JupyterHub Fleet on `cs.usm.maine.edu` — Entomology-Themed Research Cluster, All Auth-Enforced

University of Southern Maine's CS department runs an 8-host JupyterHub fleet on the cs.usm.maine.edu subdomain, with hostnames following an entomology theme (wasp, earwig, locust, mosquito, ant, beetl…

Read →
Case May 10, 2026

reputacion.digital: Multi-surface chained exposure (Phoenix + NFS + Prometheus + dev SMTP)

NuClide Research · 2026-05-10

Read →
Case May 7, 2026

Vendor-template adjacent-vendor sweep, planning doc + Shodan dork catalog (2026-05-07)

NuClide Research, 2026-05-07

Read →
Case May 6, 2026

Hilix-class botnet campaign, multi-victim Jupyter-targeted operation (Ulm Cortical Labs + Tencent OpenClaw)

NuClide Research · 2026-05-06

Read →
Case May 6, 2026

Vendor-template default-no-auth on research-instrument web stacks, pattern recognition + fleet-audit roadmap

NuClide Research · 2026-05-06

Read →

Coordinated disclosures

14
HIGH sent May 7, 2026

Hampton Jupyterhub 20 Stale

Hampton University, JupyterHub on `jupyter.cas.hamptonu.edu` running version 2.0.0 (released early 2022, multi-year-old, many CVEs apply)

Read →
MEDIUM sent May 7, 2026

Ncsu Jupyterhub Cve 2026 33709

NC State University (operator) and MCNC (network owner), JupyterHub on `jupyter.csc.ncsu.edu` running 5.3.0 with CVE-2026-33709 open-redirect; otherwise good security posture

Read →
MEDIUM sent May 7, 2026

Uic Jupyterhub Cve 2026 33709

University of Illinois Chicago, JupyterHub on `compaasgold06.evl.uic.edu` (Electronic Visualization Lab compute appliance) running 5.3.0 with CVE-2026-33709

Read →
HIGH sent May 7, 2026

Umd Jupyterhub 402 Cves

University of Maryland, JupyterHub on `carrot.umd.edu` running version 4.0.2 (3 unpatched CVEs apply)

Read →
HIGH sent May 7, 2026

Uw Atmos Rservices Nfs Exposed

University of Washington Atmospheric Sciences, `orca.atmos.washington.edu` exposes 1980s-era r-services (rexec/rlogin/rsh on tcp/512-514) and NFS (tcp/2049) to the public internet, plus 3 custom Tornado services on alt-ports

Read →
HIGH sent May 7, 2026

Vt Jupyterhub Http Only

Virginia Polytechnic Institute and State University, JupyterHub on `waingram418808.lib.vt.edu` served over HTTP-only with credentials in plaintext on every login; running version 4.0.2 (3 unpatched CVEs)

Read →
CRITICAL sent May 6, 2026

Akamai Linode 172 233 96 208 C2 Takedown

Akamai/Linode US, confirmed botnet C2 server (Hilix-class) currently receiving reverse shell from compromised medical research device

Read →
HIGH sent May 6, 2026

Cogent 38 87 117 84 Malware Host

Cogent Communications / DATALIX, host velonodes.in served Hilix botnet malware (Hilix.x86_64) used in medical-research-device compromise; appears offline now but worth confirming

Read →
CRITICAL sent May 6, 2026

In TPC3.ipynb (created 2026-05-05 17:14 UTC):

Cortical Labs (vendor), CL1 v0.28.3 ships operational dashboard + Jupyter on public ports without authentication; one customer (Ulm Med Faculty) confirmed compromised by Hilix botnet via this default; fleet-wide advisory recommended

Read →
CRITICAL sent May 6, 2026

Tencent 101 34 81 166 Jupyter Compromise

Tencent Cloud Beijing, customer Jupyter Notebook compromised since March 2026; 50+ days of attacker artifacts including AF_ALG kernel root exploit (uid=0 confirmed) and likely-same Hilix botnet payload as Ulm Cortical Labs incident

Read →
CRITICAL sent May 6, 2026

On the lab device - stop Jupyter and kill the orphaned socat:

Universität Ulm Medical Faculty (labdevice.medizin.uni-ulm.de), ACTIVE COMPROMISE, attacker reverse shell still running

Read →
CRITICAL sent May 6, 2026

Via the unauth Jupyter kernel WebSocket (same access path as the attacker):

Universität Ulm Medical Faculty (labdevice.medizin.uni-ulm.de), FORENSIC FOLLOW-UP + active attacker shell terminated

Read →
CRITICAL sent May 6, 2026

Uni Ulm Cert Port80 Dashboard Followup

Universität Ulm Medical Faculty (labdevice.medizin.uni-ulm.de), SECOND-PASS finding: entire Cortical Labs CL1 operational dashboard exposed unauth on port 80, separate from the port-8888 Jupyter compromise; allows direct control of living-neuron life support

Read →
CRITICAL sent May 6, 2026

Uni Ulm Cert Resend Active Compromise

Universität Ulm Medical Faculty (labdevice.medizin.uni-ulm.de), RESEND of 2026-05-06 disclosure (it-sicherheit@uni-ulm.de bounced); ACTIVE COMPROMISE on Cortical Labs CL1, attacker shell terminated by NuClide intervention

Read →