AI Sysadmin Reveals How Cryptojacking Campaign Evaded Scanners on Proxmox Hosts

·1 views

An autonomous AI system administrator at Pulsed Media discovered a cryptojacking implant on twelve Proxmox VE hosts in September 2026, traced to an authentication bypass vulnerability designated CVE-2023-54391. The CVE's structured version data incorrectly marked Proxmox VE 7.4.3 as unaffected, causing all automated vulnerability scanners to miss the exposure entirely. Attackers exploited the flaw and then applied the vendor's own patch to the compromised hosts, making the systems appear secure while actively mining cryptocurrency. An LD_PRELOAD userland rootkit was also deployed to intercept system calls and hide malicious files from standard inspection tools. The incident highlights that flawed CVE version ranges can render automated compliance pipelines not just ineffective but actively misleading.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Swedish startup builds AI strike drone that selects and attacks targets autonomously

A Swedish startup has developed an autonomous attack drone capable of independently identifying and striking targets without any human input. The system is powered by Nvidia's Jetson Orin Nano, a compact AI processing module, running a small on-device machine learning model. Notably, the drone requires no external communications, making it resistant to jamming or signal interference. The development raises significant ethical and regulatory questions about the use of fully autonomous lethal systems in modern warfare.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Radius relaunches as open community events platform to rival Meetup.com

A developer has officially relaunched Radius, a community events platform built as an alternative to Meetup.com, after an extended development period following an initial debut on Hacker News. The platform focuses on helping people discover local communities, groups, and events, incorporating feedback gathered from over 150 comments during its first showing. A new feature called Activities has been introduced, allowing individuals to post lightweight, group-independent events — such as a casual bike ride — where others can join and vote on a suitable time. Radius is built using Ruby on Rails and is currently live at radius.to. The developer has indicated future plans may include open sourcing the project and exploring federation capabilities.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Codename One Fixes Severe HashMap Miss Performance Bug With Perturbed Probing

Developers working on Codename One, an open-source cross-platform Java/Kotlin framework, discovered a critical performance flaw in ParparVM's HashMap where lookups for absent keys were dramatically slower than for present ones. Benchmarks revealed that three million containsKey calls for missing keys took 32.7 seconds, while probes per miss reached over 222,000 for tables with one million entries. The root cause was that integer keys clustered in adjacent slots, causing linear probing to walk long uninterrupted runs before finding an empty slot. The team resolved this by adopting a CPython-inspired perturbed probing recurrence, reducing mean probes per miss to under two across all tested table sizes. Additional improvements included using cached hash codes to short-circuit unequal string comparisons and routing compatible UTF-16 string comparisons through native memcmp for faster vector-level processing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Docker Sandboxes Redefine Security Boundaries for AI Coding Agents

Docker Sandboxes introduce a structured isolation model for AI coding agents by running them inside microVMs with their own kernel and Docker Engine, limiting direct host access. The model offers three file-sharing modes — direct mount, clone, and mountless — each carrying different levels of risk depending on how much the agent can interact with the host repository. Credential exposure is reduced by routing provider keys through a host-side proxy, though the agent retains whatever authority those credentials grant. Network traffic defaults to a deny-by-allow policy, but preset allowlists like the 'Balanced' profile may still permit broad access that exceeds task requirements. Shared skill stores and MCP gateway configurations can also extend trust boundaries across sandboxes, making it critical to audit each capability boundary before deployment.

0 comments Read more at DEV Community