--- title: I got hacked, my server started mining Monero this morning. description: A developer discovered their Hetzner server was compromised and mining Monero cryptocurrency for 10 days after an attacker exploited CVE-2025-66478, a Next.js... canonical: https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I got hacked, my server started mining Monero this morning. | daily.dev og:description: A developer discovered their Hetzner server was compromised and mining Monero cryptocurrency for 10 days after an attacker exploited CVE-2025-66478, a Next.js... og:url: https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u og:image: https://api.daily.dev/og/posts/2rfojZh4U.png og:image:alt: I got hacked, my server started mining Monero this morning. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I got hacked, my server started mining Monero this morning. **[Hacker News](https://daily.dev/sources/hn)** · 9 min read · 2 upvotes · 1 comments ## Summary A developer discovered their Hetzner server was compromised and mining Monero cryptocurrency for 10 days after an attacker exploited CVE-2025-66478, a Next.js deserialization vulnerability in their Umami analytics container. The malware ran cryptominers at 800%+ CPU but remained contained within the Docker container because it ran as a non-root user with no volume mounts or privileged access. The incident was resolved by removing the compromised container and hardening the firewall. Key lessons include understanding what frameworks your dependencies use, properly configuring container isolation with non-root users, implementing defense-in-depth security practices, and promptly applying security updates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@akkitto** · 0 upvotes > Nice --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#linux](https://daily.dev/tags/linux), [#docker](https://daily.dev/tags/docker), [#nextjs](https://daily.dev/tags/nextjs) [View this post on daily.dev](https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I got hacked, my server started mining Monero this morning.","url":"https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u"},"datePublished":"2025-12-17T22:59:53.320Z","dateModified":"2025-12-17T23:00:17.363Z","description":"A developer discovered their Hetzner server was compromised and mining Monero cryptocurrency for 10 days after an attacker exploited CVE-2025-66478, a Next.js...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b29fce3c9595fd763a3a857cc736ba6a?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b29fce3c9595fd763a3a857cc736ba6a?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,devops,linux,docker,nextjs","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"I got hacked, my server started mining Monero this morning."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/i-got-hacked-my-server-started-mining-monero-this-morning--2rfojzh4u","comment":[{"@type":"Comment","text":"Nice","datePublished":"2025-12-18T01:10:04.175Z","url":"https://daily.dev/posts/2rfojZh4U#c-wnZsLxwCX","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}}]} ```