https://forum.ournem.com/technical-discussion/nem-beta-0-6-26-security-update/

we were focusing on poi, networking and other more complicated things, but we left something
very dumb...

/shutdown API had @ClientApi annotation, instead of @TrustedApi, which allows to shut down any 0.6.25 nis remotely.