151 Manticore Search Servers Found Exposed Online Via Title Matches

·1 views

Manticore Search is a search engine that uses a SQL-like query language and a MySQL-compatible protocol, and it stores the documents it indexes, so it functions more like a database than a web component. A ZoomEye title search for "Manticore" returned 151 matches as of October 14, 2026, while an application fingerprint search returned none, meaning the product was identified by its title. Because the daemon accepts SQL on its port, anyone who can reach it can run queries directly, bypassing any application-level limits on what users can request. The article recommends checking which daemons are reachable from outside the application tier and restricting access through firewall rules or private networks rather than relying on the daemon's own credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kids Are Getting Around Social Media Bans, and MIT Review Argues That May Not Be a Problem

An article in MIT Technology Review argues that children finding ways around social media bans should not necessarily be treated as a problem requiring a fix. The piece challenges the assumption that every workaround signals a failure of policy enforcement. It frames young people's circumvention as a predictable response to restrictions rather than a crisis in itself. The discussion was shared on Hacker News, where it drew a small amount of engagement. The available source material provides only the article link and basic metadata, so the full argument is not detailed here.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Claude Code Fixes Four Shell Variable Cases That Bypassed Its Permission Checks

Between October 3 and 9, Claude Code's official changelog recorded four fixes for cases where shell variables let commands slip past its permission rules. In two cases, deny or ask rules failed to catch the command, particularly under sandbox auto-allow mode. In the other two, the auto-approval check permitted commands that should have prompted the user. The changelog does not explain who discovered the issues or how the checker failed internally. The article notes that the underlying problem is that text-based rule matching must predict how the shell will expand variables and split words before execution.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ColumnCheck: Local CSV Review Tool with Human Overrides for Freelancers

ColumnCheck is a small offline command-line tool that helps freelancers review messy CSV exports, such as invoices, before importing them elsewhere. It suggests column types from headers using a scikit-learn classifier and applies fixed validators for emails, ISO dates, decimal amounts, and whole-number quantities. Users can override suggestions through a JSON mapping, and reports preserve the original model output while flagging the override. The tool produces JSON and HTML reports without modifying the source file or making network calls. The developer notes it is a functional prototype and that its business demand and performance advantage over simple rules remain unvalidated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Token Rotation Leaves Old Tokens Valid; Bound Marker Secrets Offer a Fix

A common assumption is that rotating a Kubernetes service account token invalidates the previous one, but TokenRequest-issued tokens remain valid until their expiry claim. The author, who works on the zenxPAM access platform, describes a fix using the boundObjectRef feature, which ties a token to an object so it stops working when that object is deleted. Because no Pod exists for external workloads, they use a dedicated marker Secret as the anchor. In lab tests on a single-node k3s cluster, revoked tokens were refused roughly 9 to 11 seconds after deletion, reflecting the API server's authentication cache. The design adds two alternating marker slots per identity, a verification step using SelfSubjectReview before switching, and compensating rollback on failure.

0 comments Read more at DEV Community