Arista patches critical VeloCloud Orchestrator zero-day under active exploitation

·1 views

Arista has released patches for CVE-2026-16812, a CVSS 10.0 unauthenticated OS command injection vulnerability affecting on-premises VeloCloud Orchestrator (VCO) installations. The flaw allows an external attacker to send a crafted request to the VCO web interface without any credentials, reaching internal-only functions and executing arbitrary commands on the host. Attackers can steal configurations, credentials, certificates, and database contents, and may further compromise Edge devices managed by the affected VCO, extending risk across the entire SD-WAN. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 27, 2026, confirming active exploitation in the wild. Arista advises administrators to apply fixed versions immediately and, if compromise is suspected, to rotate all credentials, certificates, and keys and validate the integrity of managed Edge devices.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EYG: New Programming Language Designed With Human Usability in Mind

A developer has introduced EYG, a programming language built with a focus on human-centered design. The project was shared on June 8, 2026, via a personal blog post by its creator. EYG aims to address common pain points programmers face with existing languages by prioritizing usability and accessibility. The announcement was posted to Hacker News, where it attracted early community attention. Details about the language's syntax and features are available on the author's website.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why Enterprise AI Agents Need Runtime Policy Gates, Not Just Prompt Rules

Relying on system prompt instructions to restrict AI agent behavior is insufficient, as probabilistic language models can bypass such guidance under adversarial or complex reasoning conditions. Security experts recommend moving policy enforcement out of the prompt window and into deterministic runtime execution gateways to address the OWASP LLM08 excessive agency risk. A four-tier action classification framework categorizes agent tasks by risk and reversibility, ranging from autonomous read-only queries to high-risk irreversible operations like database deletions or wire transfers that require mandatory human approval. Technical controls such as JSON Schema validation on tool parameters and sidecar policy engines like Open Policy Agent ensure decisions are evaluated independently of the model's internal reasoning. For critical actions, state-preserving circuit breakers pause agent execution and route a dry-run preview to a human approval queue before any irreversible operation proceeds.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Low-Cost RL Fine-Tuning of 9B Model Reportedly Rivals Frontier AI on Catalog Tasks

A report claims that a small open-source 9-billion-parameter language model, fine-tuned using reinforcement learning at a cost of approximately $500, outperformed larger frontier models on a catalog review task. The findings were published on the Fermisense blog. The claim highlights growing interest in cost-efficient fine-tuning techniques as alternatives to expensive large-scale model training. However, the limited engagement on Hacker News — just 3 points and no comments — suggests the results have not yet received broad peer scrutiny. Full methodology and benchmark details would need to be reviewed to assess the validity of the comparison.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Seeks Best OCR Tool to Grade Handwritten Gaokao Math Answers

A developer building an English-language Gaokao math exam platform is searching for a reliable OCR solution to automatically grade handwritten student responses. The challenge is complex because answers often span half a page and include fractions, square roots, crossed-out formulas, and geometry diagrams written under time pressure. Tools under consideration include Mathpix, MyScript iink, Google Cloud Vision, Azure Document Intelligence, and the open-source model TrOCR, each with distinct trade-offs between accuracy and implementation effort. The developer plans to use separate recognizers for formulas and plain handwriting, retain positional and confidence data for each recognized element, and flag unreadable lines as provisional rather than defaulting to a zero score. A real-world test set using authentic Gaokao-style handwriting, including messy and crossed-out samples, is yet to be built before any tool is adopted.

0 comments Read more at DEV Community