--- title: "RCE As a Feature" url: https://daily.dev/posts/rce-as-a-feature-xeeuukhv1 source_url: https://thedailywtf.com/articles/rce-as-a-feature type: article source: "The Daily WTF" published: 2026-08-24T11:06:35.768Z updated: 2026-08-24T11:06:51.905Z tags: ["security", "authentication", "c", "edtech"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # RCE As a Feature **[The Daily WTF](https://daily.dev/sources/thedailywtf)** · 4 min read · 0 upvotes · 0 comments ## Summary A former curriculum writer at an ed-tech company recounts discovering severe security vulnerabilities in a C-interpreter product used by K-12 schools. A locally-installed daemon ran an unauthenticated websocket server bound to 0.0.0.0 that accepted arbitrary C code for execution, enabling remote code execution from any website or any device on the same network. The company also had a server-side eval() code injection exposing plaintext credit card data, plus a default-credential router. The founder patched some issues quietly without notifying schools, and the company remains in business and has been recognized in an industry ranking. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#c](https://daily.dev/tags/c), [#edtech](https://daily.dev/tags/edtech) [View this post on daily.dev](https://daily.dev/posts/rce-as-a-feature-xeeuukhv1)