AI Agent Uncovers 18-Year-Old Critical nginx Heap Bug Patched in May 2026

·1 views

A critical heap vulnerability in nginx's URL rewriting module, tracked as CVE-2026-42945, was discovered by an AI-powered code audit tool after going undetected for roughly 18 years since version 0.6.27 in 2008. The flaw, scored 9.2 on CVSS v4.0 by NVD and F5, affects all nginx releases from 0.6.27 through 1.30.0, as well as NGINX Plus R32–R36. Patches were shipped on 13 May 2026 with nginx versions 1.30.1 and 1.31.0, and NGINX Plus R37. The bug stems from an uncleared internal flag in the regex substitution engine that causes a size mismatch between buffer allocation and data copying, enabling a heap overflow. Despite alarming estimates of 5.7 million potentially exposed servers, independent scans of real-world GitHub configurations found the vulnerable setup to be extremely rare in active production environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Founder Shuts Down Startup Ravah Despite 100 Waitlist Signups, Shares Key Lessons

A founder has shut down Ravah, an AI content-generation startup for founders, after months of building and growing the product. Despite attracting around 100 waitlist signups — many from a Reddit post — the founder concluded that interest alone did not constitute genuine product-market fit. The scope of the product kept expanding, from content generation to campaign coordination, analytics, and integrations, but customer evidence of repeated use or willingness to pay never materialized. The founder acknowledged that technical progress, such as shipping features and improving onboarding, created a false sense of momentum while the core business question went unanswered. The key takeaway is that a waitlist validates a promise, not a product, and founders must distinguish between signals of interest and evidence of genuine, recurring need.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FastMCP lets developers build Claude-compatible AI tools in dozens of lines of Python

FastMCP is a Python library that simplifies building Model Context Protocol (MCP) servers, which allow AI models like Claude to call external tools and functions. Normally, creating an MCP server requires implementing complex low-level protocol details, but FastMCP handles that automatically when a developer marks a standard Python function with the @mcp.tool decorator. The library auto-generates the required schema by inspecting the function's argument and return types, making the process accessible to anyone with basic web development experience. A DEV Community tutorial demonstrates this by building a fortune-telling tool — named after the Japanese word for fortune-telling, 'uranai' — that Claude Code can invoke, using only a few dozen lines of code. The guide also flags a common pitfall: decorator syntax differs between the standalone fastmcp package and the official MCP Python SDK, which can cause confusing errors if code is copied between tutorials.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Founder Builds In-App Learning Tool HeyBraza to Teach Software by Doing

Timur, a solo founder from Uzbekistan, has launched HeyBraza, a tool designed to help users learn complex software such as Photoshop, video editing, and 3D modeling without leaving the application. The platform addresses a common frustration where learners watch tutorials elsewhere, return to their own screen, and still struggle to replicate the steps. HeyBraza works by letting users trigger help via a hotkey, ask a question aloud, and receive real-time visual guidance drawn directly onto their screen within the app. Unlike traditional online courses or certificates, the tool focuses on guiding users through actual workflows on their own files. HeyBraza is currently live at heybraza.com, and the founder is actively seeking user feedback to improve the product.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build GDPR-Compliant AI Agent KPI Dashboards with Metrics and Logs

Engineering guidance for gaming AI-agent admin dashboards recommends using pre-aggregated metrics for KPI charts and structured logs for incident investigation, rather than relying on a single storage system for both. Metrics suit recurring, bounded questions like p95 latency by release, while logs preserve the event-level detail needed to reconstruct why a specific game session behaved unexpectedly. Rollback safety is framed as a release requirement, meaning teams must retain the measurements that justified a change even after reverting it. For EU-based SaaS teams, the approach also addresses GDPR compliance by classifying data fields upfront — separating aggregate metrics from personally identifiable content — rather than applying privacy labels after implementation. A pre-release signal catalog defining each metric's name, unit, dimensions, freshness target, and rollback question is recommended to avoid the common mistake of adding charts simply because data is available.

0 comments Read more at DEV Community