Apple Confirms iCloud+ Hide My Email Addresses Will Stay Active on iCloud.com

·4 views

Apple has announced that email addresses created through its iCloud+ Hide My Email feature will continue to function via icloud.com. The Hide My Email service allows users to generate random, anonymous email addresses that forward messages to their real inbox. Apple's confirmation addresses concerns among iCloud+ subscribers about the potential discontinuation or migration of these addresses. The update was shared through Apple's official developer news channel, reassuring users that their privacy-focused email aliases remain intact.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Critical miniOrange SAML SSO flaws let attackers hijack WordPress admin accounts

Two critical authentication bypass vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, have been discovered in the miniOrange SAML 2.0 Single Sign On plugin across seven WordPress editions. The flaws allow attackers to forge SAML responses and obtain valid WordPress administrator session cookies without needing a password, MFA, or access to identity provider credentials. The first vulnerability exploits algorithm confusion by using the RSA public key as an HMAC secret, while the second abuses PHP's openssl_verify() returning -1 on error, which the plugin incorrectly treats as a successful verification. Real-world exploitation was detected by DigitalOcean, where an external actor obtained an admin session cookie, though further damage was prevented by network-level restrictions on the WordPress admin panel. Opportunistic scans targeting miniOrange SSO endpoints have been observed from multiple IP regions, indicating widespread, indiscriminate attack attempts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Calix GS7 Router Flaw Lets Attackers Expose Home Devices via Unauthenticated UPnP

A high-severity vulnerability, tracked as CVE-2026-75501, has been disclosed by CERT/CC affecting the Calix GS7 XGS GS5239XG residential router running EXOS 6.6.47. The flaw stems from MiniUPnPd 2.3.7 exposing UPnP controls on WAN-side TCP port 5000 without any authentication, a service normally restricted to local networks. Remote attackers can send unauthenticated SOAP requests to create persistent port forwarding rules, effectively bypassing NAT and firewall protections to reach internal cameras, NAS devices, and IoT equipment. Critically, forwarding rules set with a zero-second lease duration survive router reboots, meaning exposure persists without user awareness or notification. No active exploitation has been reported yet, and users are advised to disable UPnP on affected devices as no patch has been issued.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Maintaining a Government Custom GPT Demands More Skill Than Building It

A custom GPT built for a government ministry training program may appear complete once the training session ends, but real challenges emerge months into actual use. As procedures are revised, terminology shifts, and departments are reorganized, the tool's knowledge base quietly drifts out of sync with current reality. Unlike outright failures, this degradation is hard to detect because the system continues responding confidently even when its information is outdated. Maintenance requires periodically auditing the existing knowledge base against live source material — a more delicate task than the original build, since it must identify what has become inaccurate without disrupting what remains correct. Yet this ongoing work rarely receives the same resources or attention as initial development, as it lacks the visibility of a concrete deliverable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Risks of Using Free Remote Servers for AI Coding Agents

A developer recently ran a coding agent on a free remote server, accidentally exposing a staging database password and personal git credentials in the run directory without realising it. The incident highlights a broader security gap: most agent workflows treat the boundary between a local machine and a remote host as if it does not exist. Free servers are typically shared, monitored, and eventually recycled, meaning users have no control over who accesses logs or how long data persists. Common mistakes include passing environment variables explicitly into run logs, reusing personal git identities for agent commits, and overlooking temporary files that may contain sensitive configuration. Security experts recommend building a minimal, isolated environment for each remote agent run — using tools like env -i to restrict what variables the agent can access — and relying only on short-lived, scoped credentials rather than production keys.

0 comments Read more at DEV Community