SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Adobe Campaign Classic Patches 18 Critical Flaws, Including a Perfect 10.0 CVE

0
·4 views

Adobe fixed 18 critical vulnerabilities in Campaign Classic in September 2026, as detailed in security bulletin APSB26-142 and Dutch NCSC advisory NCSC-2026-0393. The flaws span OS command injection, SQL injection, server-side request forgery, and incorrect authorization, with ten requiring no authentication to exploit. The most severe, CVE-2026-75699, carries a maximum CVSS score of 10.0, making unpatched deployments a high-priority risk. The fully patched version is Campaign Classic 7.4.4 build 9402, with hosted environments already updated. Until patches are applied, administrators are advised to restrict access to Campaign Classic endpoints and limit outbound connections as interim mitigations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

ShinyHunters Exploits Critical Oracle PeopleSoft Flaw to Deploy Web Shells via WAF Bypass

Threat group UNC6240, linked to ShinyHunters, has been actively exploiting a critical pre-authentication remote code execution vulnerability (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, according to a September 25, 2026 report by Google Threat Intelligence Group and Mandiant. Attackers bypass web application firewalls by percent-encoding the letter 'P' in the target URL path as '%50', causing WAF string-matching rules to miss the request while the backend WebLogic server decodes and processes it normally. JSP web shells have been confirmed on dozens of compromised systems, with some intrusions also involving fileless command execution that leaves no shell files on disk. Following initial access, attackers deployed multiple post-intrusion tools including SIDEEYE for credential theft, Neo-reGeorg for internal SOCKS tunneling, and MeshAgent for remote management on Linux hosts. Oracle has issued a security advisory, and organizations running affected PeopleSoft versions are urged to apply patches and review WAF rules to detect encoded URI variants.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Re-Enabled GitHub Actions Repos Trigger Malicious Code Re-Execution in CI Pipelines

Two GitHub Actions repositories — actions-cool/issues-helper and actions-cool/maintain-one-comment — were re-enabled on September 16, 2026, weeks after being disabled following a supply chain attack discovered in May 2026. The repositories were restored while still carrying malicious tags from the original compromise, meaning no new attacker activity was needed to resume the threat. Security firm Socket confirmed through execution logs that workflows referencing issues-helper re-ran the malicious payload upon the repositories being restored. GitHub's dependency graph shows approximately 15,000 repositories relied on issues-helper, though this figure reflects potential exposure rather than confirmed cases of code execution or data theft. GitHub disabled both repositories again on September 25, 2026, after the renewed risk was identified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Claude Code subagent frontmatter tested: which model settings actually take effect

A developer running Claude Code 2.1.278 on macOS tested whether YAML frontmatter settings in custom subagent files — specifically model and effort fields — are actually honored at runtime. Three subagents were examined: a bulk reader pinned to Sonnet, a deep reviewer pinned to Opus, and a preflight reviewer set to inherit its model. Testing was conducted on September 22, 2026, using seven CLI invocations in an isolated throwaway directory to avoid contamination from existing config files. The experiment tracked which model actually responded to each subagent's first API request, whether effort levels survived a parent session running at a different setting, and how Claude Code handled an unrecognized frontmatter key. Findings revealed measurable per-launch token costs and showed that the validator passed through at least one frontmatter field it did not recognize without raising an error.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds update notifier for ChatGPT Linux app missing built-in checker

OpenAI recently launched a Linux version of its ChatGPT Desktop app, but unlike the Windows counterpart, it lacks a built-in update checker. A developer who switched from Windows to Linux noticed the gap after missing the GPT-6-Astra rollout for several days due to an outdated app. To address this, they built an open-source utility that monitors the system's package manager for ChatGPT updates and sends notifications when a new version is available. The tool also supports one-click installs and rollbacks, along with a control panel for managing upgrade settings. The project has been published on GitHub for other Linux users facing the same issue.

0 comments Read more at DEV Community