The Daily WTF published a story by Ellis Morning based on a submission from reader Jared B, who spent a year as a curriculum writer at an ed-tech company founded by a mechanical engineering professor referred to as Harry. Harry had built a C interpreter back in the 1990s and, decades later, still treated it as cutting-edge technology, using it as the foundation for a K-12 math and computer science curriculum.

As Chromebooks replaced Windows machines in classrooms, Harry added a browser-based IDE but kept a "Run Locally" button for schools still running Windows. Clicking it installed a background daemon that launched a websocket server on port 12345 at startup, exposing an endpoint called execute_c_program. That endpoint accepted a string of C code and passed it straight to the interpreter, including support for calls like execv().

No authentication protected the endpoint, so any website could quietly send code to localhost:12345 and achieve remote code execution the moment a victim loaded a malicious page. Worse, the server bound to 0.0.0.0, letting any device on the same network reach it directly without any phishing step at all. The flaw went unnoticed for years while the software shipped to thousands of school-owned computers across the state; Harry had staffed the dev team exclusively with his own grad students.

Jared documented and demonstrated the vulnerability to Harry, who released a fixed version but described it only as "security improvements" in the release notes and never told school or district IT staff how urgent the update was. Jared also reported a separate cookie-stealing exploit that threatened student and teacher data, plus a code-injection flaw on another company site where a page ran unsanitized server-side eval() on user-submitted math expressions; exploiting it exposed thousands of transaction records with credit card numbers stored in plain text.

The company is still in business and was recently named to a TIME ranking of top American ed-tech companies. The office router, Jared notes, still runs on the default, Google-searchable admin credentials.